@Andrew
And would those ubiquitous security questions be any better if you could specify the question and the answer both?
Yes, to the extent that the number of bits each question represents as a challenge is much larger than the ~3 bits that are usually present for a pre-made list. Regardless, your response to the challenge should never be some basic fact about your life that is easy to find and/or shared by many sites. Always give them a random string with enough bits to satisfy your needs for security (e.g., a UUID).
@Vesselin Bontchev
Many people (even infosec experts) seem to be confused about what "two-factor authentication" (2FA) really is.
Worse, they use 2FA, or other protocols, in ways that completely negate their purpose. The greatest sin, as the article points out, is that the second communication channel is collapsed into a single channel, and/or there is no unique challenge that prompts the response. It's simply too easy to sit in the middle of any authentication process that boils down to just sending information to an HTTP(S) server.
Is authenticating via password and SMS send to your phone "2FA"? No, it is not!
It could be if the protocol was more than just "now also send me the code I just texted you". Again, the real issue that needs to be addressed is that the server connection can be spoofed.
You use two instances of the same factor ("something you know") but obtained via different ways.
All factors reduce to "something you know" when they are used as nothing more than digitized information that is sent in one direction over one communications channel. That's why biometrics are such a silly choice for remote authentication.
Also note that the security even of proper 2FA depends very much on the threat model.
Indeed. And I'm not even sure what threat Google thinks is significant enough to try to impose yet another dongle solution. There are all sorts of approaches that implement "the *site* has to prove itself to the key" that don't involve that added expense/complexity. I've personally never been phished, mainly because my first step in registering an account with a site is to give them a unique email address (and, notably, one not controlled by Google).
bd34fc8e5c52e14ca7462cbd756ded786b2f9e5c059c24fbdf29b224914bff84