May 7, 2024 at 06:36AM
Google has simplified the process of enabling two-factor authentication (2FA) for users with personal and Workspace accounts. The update includes a new two-step method and removal of the need for less secure SMS-based authentication. Additionally, users can now disable 2FA without having their enrolled second steps automatically removed.
Meeting Notes Takeaways:
– Google is simplifying the process of enabling two-factor authentication (2FA) for personal and Workspace accounts to enhance security against takeover attacks.
– Users can now add a second step method, such as an authenticator app or a hardware security key, before turning on 2FA. This eliminates the less secure SMS-based authentication.
– Workspace account holders may still need to enter their passwords alongside their passkey based on the admin policy for “Allow users to skip passwords at sign-in by using passkeys.”
– Modern authentication methods like FIDO2 resist phishing and session hijacking attacks, but recent research found potential vulnerabilities, particularly with single sign-on solutions.
– A threat actor could potentially bypass FIDO2 by exploiting an adversary-in-the-middle (AitM) attack, exposing vulnerability in applications that do not protect session tokens created after authentication and lacking validation on the requesting device.
– To mitigate this risk, it’s recommended to implement token binding to bind security tokens to the Transport Layer Security (TLS) protocol layer, and Google has announced a new feature in Chrome called Device Bound Session Credentials (DBSC) to protect against session cookie theft and hijacking attacks.
Overall, the meeting covered advancements in authentication security, potential vulnerabilities, and recommended measures to strengthen user protection.