New version of Google Authenticator is a new app, old one won't update | Hacker News Reader

New version of Google Authenticator is a new app, old one won't update

androidpolice.com

60 pointsajdecon13 comments

The speculation is that someone lost the signing key.

Oh the irony...

So the new version of Authenticator can apparently import the credentials from the old version. I don't know much about Android security, but if Google lost the signing key, would they still be able to import from the old app?

The credentials are stored in plaintext on your phone. You can trivially extract them with a backup of your phone and a SQLite database editor.

Are these credentials all that are needed to impersonate your authenticator?

This seems "bad" - as I'd personally expect there to be no "magic" data migration path between different apps.

There should be a confirmation step from the security manager at least.

I'm familiar with the 'extract from a backup' vulnerability for any information stored on Android. However, I'm more concerned that another (non root-privileged) app can access credentials without confirmation.

I believe you'd need a rooted device for it to access another app's files, and even then you should get a popup prompting for access.

I have a few apps in the marketplace that I made on my old pc years ago. The keys I used to sign the apps weren't lost, unfortunately, the original Android eclipse plugin was signing my apps as part of my build process (I think they have fixed that now).

I wiped the machine, and hey presto, I can't update those apps anymore. I was shocked there was no workaround, and it seems Google have been hit by this now also. At least they're sticking to their own policy I guess, I'm sure they could update the app if they really wanted to.

Wouldn't it be impossible for them (assuming proper PKI implementation) for them to regenerate the signing key once lost?

ie, you lose it, it's gone... the way it should be.

Proper PKI doesn't exclude key escrow... but Google would have little interest in trying to support the process to keep that secure.

Can you explain some more? You lost the keys or you didn't? If you didn't, why can't you sign the apps?

Sorry, let me elaborate. I have the keys I purposefully signed the apps with. I would export the apk from eclipse, and sign it, submit it.

However, as part of the eclipse build, eclipse was signing the apk. Therefore it ended up signed by TWO keys. When I re-installed eclipse, this hidden key that I wasn't aware of was lost.

I couldn't submit to the Android market without the app being signed by BOTH keys. That is what I found strange...

New app is here: https://play.google.com/store/apps/details?id=com.google.and...

Well, you can't say the chinese aren't persistent.

Reply on news.ycombinator.com