Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Wednesday July 25 2018, @03:58PM   Printer-friendly
from the [un]intended-consequences? dept.

Brian Krebs has written a blog post about how Google has been using security keys to neutralize phishing of their employees. It stops the phishing quite well but comes at a high cost. No, not the hardware cost of a security dongle, it's the cost of losing third-party mail applications like Thunderbird and their add-ons like Enigmail.

I have been using Advanced Protection for several months now without any major issues, although it did take me a few tries to get it set up correctly. One frustrating aspect of having it turned on is that it does not allow one to use third-party email applications like Mozilla’s Thunderbird or [others]. I found this frustrating because as far as I can tell there is no integrated solution in Gmail for PGP/OpenGPG email message encryption, and some readers prefer to share news tips this way. Previously, I had used Thunderbird along with a plugin called Enigmail to do that.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by c0lo on Thursday July 26 2018, @02:33AM (1 child)

    by c0lo (156) Subscriber Badge on Thursday July 26 2018, @02:33AM (#712876) Journal

    how Google has been using security keys to neutralize phishing of their employees.

    So, yeah, really, Google is on its way to world domination, one employee (or more than one) at a time. Did I get you right?

    --
    https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2  
  • (Score: 1, Insightful) by Anonymous Coward on Thursday July 26 2018, @08:47AM

    by Anonymous Coward on Thursday July 26 2018, @08:47AM (#712977)

    Not really. The partially supported 2FA that Google supplies is the same across the board for both their employees and for their useds. Google has not made 2FA mandatory for their useds but strongly recommend it and are steering their useds towards it. The condition for adopting 2FA is giving up access by third-party programs. So it is clear that is the direction they are moving. Notice self-destructing e-mails [soylentnews.org] also require both parties to be using Google's own, proprietary interface. Google is in a strong position, it's not like they have serious competition for "free" e-mail and your average SMB or private citizen aren't likely to be able to find the skill and time to set up their own mail servers, even if the big players weren't dead set on squeezing the small self-hosters out of the market through a variety of means [blogspot.com]. (Sufficiently advanced incompetence is indistinguishable from malice.)

    It looks like that when Google get enough traction, they will do away with IMAPS first and later maybe even SMTP. It'd be helpful to see those protocols replaced by newer, better open standards not by something proprietary.