Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: If I get locked out of everything, please try to help me

news.ycombinator.com

Post reply on HN
Print view View original

301–310 of 350 posts

Re: Ask HN: If I get locked out of everything, please try to help me

#301

Post by Wowfunhappy »

katbyte wrote: post #285
HPMOR wrote: post #203

Earlier quoted context omitted.

The issue though is 2FA is now required. That's literally the whole reason of this post.

according to google you can turn it off: https://support.google.com/accounts/answer/1064203?hl=en&co=...

Kind of. The problem is that even when 2FA is disabled, Google's security panopticon will sometimes insist on additional verification anyway, even if you know your password, if it thinks something is suspicious.

If you don't have a verification method—or cannot access it—Google will literally just lock you out.

I have personally experienced this on accounts I don't access regularly.

Re: Ask HN: If I get locked out of everything, please try to help me

#302

Post by Wowfunhappy »

password4321 wrote: post #56
crooked-v wrote: post #6

There was a post a while back around poor and homeless people encountering exactly this problem on a regular basis. Lots of people in the comments were incredibly dismissive and sometimes actively malign about it. Edit: One suggestion from me would be to try and start the dead phone connected to power but with the battery physically removed (assuming it's removable). That might bypass whatever issue it's having and l…

Librarian's Letter to Google Security https://news.ycombinator.com/item?id=32304320

See also: https://news.ycombinator.com/item?id=33120534

Re: Ask HN: If I get locked out of everything, please try to help me

#303

Post by modeless »

Tainnor wrote: post #262
modeless wrote: post #144

Earlier quoted context omitted.

You need the password too. That's what makes it two factor.

If one of the factors is widely known, it's effectively not two-factor anymore.

No security system is absolute, and treating all threats as equally possible leads to terrible security decisions like not using printed recovery codes for fear of them getting stolen. You must pick a threat model before you can evaluate the security of a system.

Treating printed paper codes as "widely known" and effectively useless simply because they could theoretically be stolen is silly. In a reasonable threat model for almost all people, the intersection of the set of threats that might get access to printed paper codes and the set of threats that might hack/phish your password is very small. The vast majority of threats are still protected against, while the very real possibility of being locked out of your account is drastically reduced. It's a good trade for almost everyone.

Re: Ask HN: If I get locked out of everything, please try to help me

#304

Post by Wowfunhappy »

dotnet00 wrote: post #209
jrmg wrote: post #54

Earlier quoted context omitted.

Ah, I see we both have a more similar view than I thought! I really should be storing some codes for my password manager somewhere…

Although not as safe as a printout, I keep codes encrypted on a couple of flash drives, one stays in a drawer and one that's always on my person with my keys, yubikey etc. Haven't needed the codes thus far but feels like a decent compromise.

Note that flash drives typically use the absolute cheapest NAND cells available and I'm not sure what their shelf life would be...

Re: Ask HN: If I get locked out of everything, please try to help me

#305

Post by modeless »

Eleison23 wrote: post #154
modeless wrote: post #144

Earlier quoted context omitted.

You need the password too. That's what makes it two factor.

They are, however, secret codes, and should be regarded as confidential. Just because you can divulge them without direct harm does not mean you should publish them on billboards and Facebook for safekeeping.

This is true but isn't relevant to my advice. If you can't see the difference between keeping a nondescript piece of paper at the bottom of a drawer at your parents' house and posting it on Facebook then you should not be making any decisions relevant to security. And using the word "secret" causes people to treat the codes as more precious than they really are, and make bad decisions like not printing them at all.

Re: Ask HN: If I get locked out of everything, please try to help me

#306

Post by ridgered4 »

Abimelex wrote: post #219
Wowfunhappy wrote: post #4

This is my nightmare. This is why I refuse to use 2FA. (Except on services that require it, and I wish they didn't require it.) Am I worried about getting hacked? Absolutely! But when I weigh the likelihood of (1) someone else getting into my account without 2FA and (2) locking myself out of my own account with 2FA, the latter seems much more likely! I understand how backup codes work. I promise you I will loose them…

There are redundancy systems to avoid getting locked out of 2FA. - 1st Backup Codes: Store a bunch of 2FA backup codes on a safe location, best not in YOUR home, in case it burns down. - 2nd SMS verification: some services offer you a fallback to SMS in case you don't have your 2FA device with you. But keep in mind, that SMS is also one of the least secure 2FA methods. - 3rd instead of having your auth codes only on…

> - 2nd SMS verification: some services offer you a fallback to SMS in case you don't have your 2FA device with you. But keep in mind, that SMS is also one of the least secure 2FA methods.

Isn't this a common complaint that SMS fallback cannot even be turned off? People say SMS is not secure enough so they switch to something better, but all the services do SMS fallback anyway so what is the point of using the more secure one?

Re: Ask HN: If I get locked out of everything, please try to help me

#307

Post by ridgered4 »

thiht wrote: post #282
alpentmil wrote: post #266

Earlier quoted context omitted.

remove mobile app as a 2FA. Use U2F/FIDO.

There’s no way to remove it if you have the app installed

What does it do if your device is off or somewhere inaccessible? (sounds frustrating)

Re: Ask HN: If I get locked out of everything, please try to help me

#308

Post by ridgered4 »

rurp wrote: post #89
jrmg wrote: post #50

I have long wondered if two factor authentication actually causes more economic harm than it solves - it just doesn’t cause that harm to be noticeably all in one place (the harm is spread to millions of users who will lose access at some point during their lives rather than concentrated on the company that implements TFA dealing with fraud). It feels like it might. This isn’t counting the productivity that’s lost to…

Not to mention the chances that your 2FA method will be used as another tracking and marketing vector. These days I'm deeply suspicious of companies that require 2FA.

I feel like virtually every service demands a phone number on sign up partially for bots but mostly for for tracking.

Re: Ask HN: If I get locked out of everything, please try to help me

#309

Post by paledot »

ridgered4 wrote: post #291
velox_neb wrote: post #181

Earlier quoted context omitted.

> they're often connecting from public IPs that are "suspicious" which causes automated systems to treat them more harshly. What's worse is that the the error messages never explain the problem. It's just an endless sequence of "Oops! Something went wrong" "We could not fulfill your request" "Please try again later". Could drive someone crazy if they're not savvy enough to realize what's going on.

I tried to sign up for a tutanota email account the other day through a VPN and when it came back and said "We don't trust your IP, use another connection." rather than being annoyed I was just glad they gave me a straight answer for once. It wasn't the answer I wanted but it sure beat being gaslighted into thinking I was having connection timeouts or browser incompatibilities to waste my time.

It's a straight answer sufficiently couched in jargon that a non-technical person still isn't likely to understand the problem or how to resolve it.

Re: Ask HN: If I get locked out of everything, please try to help me

#310

Post by ridgered4 »

djha-skin wrote: post #163

I wanted to point out a very serious problem related to this post: Google will no longer simply accept totp as a verification but insists on sending you a notification to one of your devices. Now I can't just use KeepassXC to get into Google anymore, I have to use my phone. The problem that the OP points out provides very real and poignant evidence that this is not only annoying but dangerous. What is it that compani…

> What is it that companies have against totp?

It isn't useful for tracking since it is private.

Post reply on HN