Skip to main content

Authentication as a Service - mixed incentives

Posted by: admin 13 years, 5 months ago

In the past, we've commented on the 'Vendor-in-the-middle' issues in the past, in particular we've pointed out this weakness when using SMS as a one-time passcode delivery mechanism.  As always, such reliance may be ok based on your risk tolerance.  Another example of this risk occurred to me today when someone on twitter mentioned pointed to this Wordpress plugin that add two-factor authentication to Wordpress using Google's authenticator.   There is also one for SSH via a PAM module.  

I have always lauded Google and Facebook for adding two-factor authentication to their products. At WiKID, our competition is static passwords and there is plenty of room for improvement there.  But do you want to use it for other products? 

We like to point our risks, especially where they are created by diverse incentives.  Because Google is not in the two-factor authentication business. They are in the advertising business.  And they will make decisions based on what they see as best for their advertising business.  It was difficult to point my finger on a good example though, until today:   Google has been suspending accounts for violation of their Google+ terms of service.  And apparently Google is, at least sometimes, suspending all services, not just G+.

So my question is: what happens to your Google Authenticator account when Google suspends your account?  

UPDATE:

The answer is nothing, according to Mike Smith.  We have a real focus on Enterprise two-factor authentication, so I pre-maturely assumed that Google Authenticator included communication with a server in the middle.  Turns out, it doesn't.  What this means is that it is a fine solution for two-factor authentication for personal sites and servers, but without a server in the middle to manage users, it is not an enterprise worthy solution.

Kudos to Google, shame on me for jumping the gun. 

Current rating: 1

Recent Posts

Archive

2024
2022
2021
2019
2018
2017
2016
2015
2014
2013
2012
2011
2010
2009
2008

Categories

Tags

Authors

Feeds

RSS / Atom