11

I use Google's two-factor authentication, because I know that access to my email account is the skeleton key to all my other accounts.

And... it's pretty annoying - I'm frequently swapping computers and other devices, and use a lot of native apps that need access to my google accounts, but I know it's the least I need to do to protect my email, since it's the only thing between me and ne'er do wells who might want to reset my Netflix password and stream bad movies that could muck up my recommendations.

The primary way to get the login code you need (in addition to your passoword) for Google's two factor auth is through the Google Authenticator app that you can install on your phone.

But, if you don't have it installed, or it's not set up, or something else goes wrong, they'll send you the code via SMS, which is presented as more of a backup method. Which brings me to my question. Assuming I'm comfortable with the security of my SMS communication:

Isn't SMS a better way to get the codes, at least from a convenience perspective?

If I disable authenticator (triggering SMS codes), whenever I need a code, it's instantly pushed to my phone, with no actions from me, and appears on any screen I'm on. I'm done.

With Authenticator running, I have to unlock my phone, open authenticator, pick the right code (I have two Google accounts), hope the code's not about to expire (the text sends one that's "fresh"), etc.

I completely understand that SMS is slightly less protected: Someone who has my phone (and presumably my password), but can't unlock the phone can see the SMS notifications, but couldn't open Authenticator. But that's a long shot. There's also the fact that services like iMessage push SMS to other devices, like Macs, iPads, etc. But again, assuming that I'm good with my control of access to my SMS:

Is there any reason to use Google's App vs. just getting texts?

Improve this question

3 Answers 3

Reset to default
11

Authenticator works even when you don't have any sort of network available for your smartphone.

I don't know about your mobile provider, but I don't trust mine to deliver SMS messages in anything that resembles a timely manner.

Beyond that, it is more secure, as you've noted.

Improve this answer
5
  • 1
    The Google Authenticator has a visual countdown timer so you always know when the code is going to change next. Picking the right code is easy too. I have 6 accounts (2 Gmail) in Authenticator
    – Kevan Sheridan
    Commented Oct 9, 2014 at 3:28
  • This is a great answer - I hadn't thought of that. Will accept tomorrow, assuming nothing else appears that seems more relevant. Out of curiosity, do you know how it does that with no connection? I assume it just caches a bunch of the codes in-app, so you have enough to fill some time period, although I guess it could also generate them in-app (presumably indefinitely) in some what that's replicated on the server side.
    – Jaydles
    Commented Oct 9, 2014 at 18:58
  • I don't have any particular insight into Google's Secret Sauce™. What I've read about other similar systems is that the algorithm uses a shared key (why you needed to scan a QR code) and the time to generate a six-digit number every 60 seconds.
    – ale
    Commented Oct 9, 2014 at 20:49
  • Google authenticator is just wrapping a strong autogenerated password and generating based on time (rounded down to the next 30 seconds) or a counter and the strong password the one-time-passwords.
    – allo
    Commented Jul 10, 2016 at 11:41
  • The algorithm is really simple, see en.wikipedia.org/wiki/…. The default authenticator replaces the counter with a timestamp, but you can optionally use a counter in the most authenticator apps, which helps when your clock isn't synchronized with the server's clock.
    – allo
    Commented Jul 10, 2016 at 11:43
1

SMS is the most common way to deliver OTPs. It’s convenient as almost everyone has a phone so they can easily get SMS. At the same time, SMS is considered as one of the least secure methods to get an OTP due to the risk that SMS messages may be intercepted or redirected. NIST is no longer recommending two-factor authentication systems that use SMS, because of their many insecurities. They issued new Digital Identity Guidelines urging to use other forms of two-factor authentication.

Google Authenticator stores secret keys in phone’s protected memory areas. If your phone isn’t rooted only Google Authenticator can get access to them. They cannot be intercepted or retrieved. So, Google Authenticator is more secure and reliable than SMS.

Improve this answer
-2

The authenticator app is a little tool to recovery of a password

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.