Ask HN: If I get locked out of everything, please try to help me • Hacker News Board

Re: Ask HN: If I get locked out of everything, please try to help me

#171

Post by opan » Tue, Dec 13, 2022, 5:09 AM UTC

djha-skin wrote: post #163

I wanted to point out a very serious problem related to this post: Google will no longer simply accept totp as a verification but insists on sending you a notification to one of your devices. Now I can't just use KeepassXC to get into Google anymore, I have to use my phone. The problem that the OP points out provides very real and poignant evidence that this is not only annoying but dangerous. What is it that compani…

Unless something changed, you can enable SMS MFA, add TOTP as a secondary MFA option, then remove SMS to only have TOTP. I did this a couple years ago after someone explained it to me. It is stupid, tedious, and still requires giving up your phone number to Google, but it may help you as it did me.

I also use KeePassXC and have had phone issues in the past, so I hate relying on my phone for anything important (it's also just not as convenient as copy/pasting from KeePassXC).

Re: Ask HN: If I get locked out of everything, please try to help me

#172

Post by 8n4vidtmkvmk » Tue, Dec 13, 2022, 5:11 AM UTC

newscracker wrote: post #146

sfmike wrote: post #135

Earlier quoted context omitted.

the try another way sometimes just goes to sorry we can't help you right away and is a dead end. even with correct password and 2fa.

This loop and a lockout was a nightmare for me. No suspicious IP address or browser changes, but Google would still not let me in. Worse, it asked me to verify with a phone number and after I verified, it still wouldn’t even send any codes to the phone and stopped me from recovering or logging in to the account. The people who created this useless and draconian account “protection” system seem to have no clue about t…

not disagreeing with anything but do you have printed backup codes? might be a good idea to print some now. I've only done it twice while traveling years ago, but they worked well then

Re: Ask HN: If I get locked out of everything, please try to help me

#173

Post by 8n4vidtmkvmk » Tue, Dec 13, 2022, 5:14 AM UTC

donmcronald wrote: post #32

crooked-v wrote: post #6

There was a post a while back around poor and homeless people encountering exactly this problem on a regular basis. Lots of people in the comments were incredibly dismissive and sometimes actively malign about it. Edit: One suggestion from me would be to try and start the dead phone connected to power but with the battery physically removed (assuming it's removable). That might bypass whatever issue it's having and l…

> There was a post a while back around poor and homeless people encountering exactly this problem on a regular basis. Lots of people in the comments were incredibly dismissive and sometimes actively malign about it. Even worse than that, they're often connecting from public IPs that are "suspicious" which causes automated systems to treat them more harshly. In Canada it's gotten to the point where you need an interne…

i moved to the US.. im now locked out of BCs health thingy now because my bc services card expired. and also my android version is too new

Re: Ask HN: If I get locked out of everything, please try to help me

#174

Post by opan » Tue, Dec 13, 2022, 5:15 AM UTC

havo wrote: post #111

discardedrefuse wrote: post #87

Earlier quoted context omitted.

The trick isn't to disable 2FA. It's to add a bunch of 2FA methods that don't rely on your cell phone: authenticator app, yubi keys, backup codes.

This is terrible advice. Please don't ever rely on authenticator apps. Try changing your phone, resetting your phone or losing your phone and watch yourself get locked out of your accounts with absolutely no recourse.

TOTP can also be used from a PC with something like KeePassXC, and you can have the DB sync to other devices with SyncThing (including your phone where you can access them with KeePassDX). Much better than SMS which really is tied to your phone (or SIM, rather).

Re: Ask HN: If I get locked out of everything, please try to help me

#175

Post by bawolff » Tue, Dec 13, 2022, 5:24 AM UTC

DoreenMichele wrote: post #11

Gigachad wrote: post #8

Earlier quoted context omitted.

Problem is that support people mistakenly resetting account auth when the attacker calls up and social engineers them is a bigger and more common issue than people’s only device dying. Not to say that’s not a thing that happens, but it’s a smaller of the two problems.

It's a smaller of the two problems for the company . If you are really poor, losing access to your online life because you couldn't pay your phone bill or something can be a huge, huge problem. I have been homeless. I'm not currently. But this is an extremely stressful situation that could do all kinds of damage to my life if I can't get it sorted.

I sympathise that this would be really difficult for homeless people.

But i am not homeless. I'm sorry if this is cold, but should i have to have an insecure account because homeless people exist?

Its not like google has a monopoly on email service providers.

Re: Ask HN: If I get locked out of everything, please try to help me

#176

Post by ck2 » Tue, Dec 13, 2022, 5:28 AM UTC

adding: they call it "backup codes" built into android phones even with 2FA turned off

https://support.google.com/accounts/answer/1187538

My old android phone had some kind of hidden code generation tool for Google that worked even when it was offline without a working sim.

Never seen that before or can figure how it works. Must have been some pre-shared encryption before it went offline.

I think it was buried under one of the "try another way" options and they walk you through it with instructions.

(I do NOT have 2FA turned on)

Re: Ask HN: If I get locked out of everything, please try to help me

#177

Post by bawolff » Tue, Dec 13, 2022, 5:29 AM UTC

crooked-v wrote: post #28

fncivivue7 wrote: post #17

Earlier quoted context omitted.

We're talking about hackers getting access to users accounts, that's not a Google problem, that's an everyone problem.

I'm sure plenty of people would rather live with the small chance of a hacker even wanting to gain access to their account than the very large chance of eventually losing access to the account entirely.

Although they probably wouldn't want to live with all their emails being discarded because gmail becomes so easy to hack and everyone assumes gmail accounts are spammers.

Re: Ask HN: If I get locked out of everything, please try to help me

#178

Post by praveen9920 » Tue, Dec 13, 2022, 5:30 AM UTC

I had a huge scare when I moved to a different country and my sim from my home country stopped receiving SMS for OTP. I got locked out of everything, my financials, emails, work etc.

I paid a premium amount for international roaming to get access to incoming SMS and changed the phone number for OTP. That was anxiety full day.

Later realised that I need to backup my recovery codes on my system somewhere.

Re: Ask HN: If I get locked out of everything, please try to help me

#179

Post by bawolff » Tue, Dec 13, 2022, 5:30 AM UTC

crooked-v wrote: post #13

Gigachad wrote: post #8

Earlier quoted context omitted.

Problem is that support people mistakenly resetting account auth when the attacker calls up and social engineers them is a bigger and more common issue than people’s only device dying. Not to say that’s not a thing that happens, but it’s a smaller of the two problems.

The solution to that is to make the increasingly intrusive security processes an opt in, not to completely write off anyone who can't reliably keep a particular physical device on their person and working indefinitely.

Opt-in is pretty useless. If users followed security procedures, people would use strong unique passwords and we wouldn't need 2fa.

Re: Ask HN: If I get locked out of everything, please try to help me

#180

Post by bawolff » Tue, Dec 13, 2022, 5:33 AM UTC

Wowfunhappy wrote: post #29

class4behavior wrote: post #16

Earlier quoted context omitted.

>This is why I will not use 2FA except on services where it is absolutely required Software 2FA just computes a number based on a secret string. You treat the latter the same way you take care of your passwords. That's why it's best to handle them with your password manager. 2FA over SMS is even less of an issue (except maybe with a broken eSIM chip). Physical methods are a problem, so you have to spend money for a b…

I could store the secret in my password manager if I paid for Bitwarden Premium (and at $10 a year, price isn't really the issue), but then what is even the point? If my password and my secret are stored in the same place then that's really just a single factor, so I'm making the login process more annoying for no reason.

Really 2FA is just a complex way to give users a strong unique password. Everything else about it is security theatre (e.g. why do you care about your password and secret stored in the same place, when your session cookie is just stored in one place and all the attacker needs)