All based upon your email password, and having a recovery account on another service. One email address to rule them all, and one email address per device.
Ask HN: If I get locked out of everything, please try to help me
331–340 of 350 posts
Re: Ask HN: If I get locked out of everything, please try to help me
#332Earlier quoted context omitted.
I could store the secret in my password manager if I paid for Bitwarden Premium (and at $10 a year, price isn't really the issue), but then what is even the point? If my password and my secret are stored in the same place then that's really just a single factor, so I'm making the login process more annoying for no reason.
How many well-formed passwords can and will you remember? How often are you willing to change them afterwards? How secure is your 2FA app? How secure is your device against keylogging? How sure are you no one will watch what you've typed in or when you reveal it to fix a typing error? And so on. It isn't as if there are no issues with the classic way. That's why you maintain the knowledge-possession separation at the…
Sorry, I don't understand where you're going with your questions. I do use a password manager (Bitwarden). I do not use 2FA. I don't understand how using so-called 2FA but storing my secrets in the same place as my passwords would make me more secure.
Re: Ask HN: If I get locked out of everything, please try to help me
#333Earlier quoted context omitted.
> Am I worried about getting hacked? Absolutely! If you set a strong, long, unique password for every account, your chances of getting the account compromised are just about zero. 2FA is a good thing in most cases, but I do hate how the industry has blindly adopted it as some sort of mantra that you can't exist without. The reality is that if you chose 128+ bit passwords generated out of /dev/random, they cannot be b…
How will you avoid fake login pages? Those can even phish SMS and TOTP 2FA. Yubikey 2FA (and equivalents) help to solve this.
Bitwarden will show if I'm not on the right domain. It's not perfect, but a USB key is a nonstarter for me (going back to "I'm more worried about locking myself out than someone else getting in.")
Re: Ask HN: If I get locked out of everything, please try to help me
#334Re: Ask HN: If I get locked out of everything, please try to help me
#335Earlier quoted context omitted.
Google will send you codes to devices that don’t even have the app installed. Ask me how I know.
use AndOTP with QR code from fdroid. Go to account settings in desktop browser and remove the phone as 2FA. It will not ask any code to device.
Google somehow seems to think I own this device despite it not being one of the devices on my account.
Re: Ask HN: If I get locked out of everything, please try to help me
#336Earlier quoted context omitted.
I understand this view. Unlike every other reply to your comment I am not going to suggest various 2FA schemes that I would invariably screw-up and just add my voice to yours. 2FA might be good for security, but it's also very ableist.
I was able to answer something snarky to you, but then I gave it more thought and realized you're right. Anything beyond a simple password is very complicated when you're dirt poor. Printing is complicated. Having a physical vault is complicated. Buying a yubikey is complicated. Paying for the premium version of a password manager is complicated. Just like with accessibility on the web, it's so easy to forget about t…
Thanks for a lovely comment. I am privileged myself, which makes it hard for me to see what systems oppress those less fortunate. But I often "peak over the fence" when I deal with my ADHD and face the challenges of renting in a volatile market. I move often, and I forget/lose stuff constantly. I have to laugh when people suggest a physical yubikey - there is no way I am not going to lose it eventually.
I don't have a lot of sympathy for big tech when it so clearly fails to enfranchise those that need it most.
Re: Ask HN: If I get locked out of everything, please try to help me
#337Earlier quoted context omitted.
How many well-formed passwords can and will you remember? How often are you willing to change them afterwards? How secure is your 2FA app? How secure is your device against keylogging? How sure are you no one will watch what you've typed in or when you reveal it to fix a typing error? And so on. It isn't as if there are no issues with the classic way. That's why you maintain the knowledge-possession separation at the…
Sorry, I don't understand where you're going with your questions. I do use a password manager (Bitwarden). I do not use 2FA. I don't understand how using so-called 2FA but storing my secrets in the same place as my passwords would make me more secure.
You should reread your own posts. I'm only responding to what you write yourself.
If you do not understand the purpose 2FA, there are plenty of online resources available.
As I explicitly wrote, you can store secrets in separate places, and if you don't, you still protect yourself against password recovery attacks or interception and add redundancy.
Re: Ask HN: If I get locked out of everything, please try to help me
#338Earlier quoted context omitted.
Although not as safe as a printout, I keep codes encrypted on a couple of flash drives, one stays in a drawer and one that's always on my person with my keys, yubikey etc. Haven't needed the codes thus far but feels like a decent compromise.
Note that flash drives typically use the absolute cheapest NAND cells available and I'm not sure what their shelf life would be...
That's a fair point, maybe I should have some SSD backups in addition to cloud backups.
Re: Ask HN: If I get locked out of everything, please try to help me
#339I had a huge scare when I moved to a different country and my sim from my home country stopped receiving SMS for OTP. I got locked out of everything, my financials, emails, work etc. I paid a premium amount for international roaming to get access to incoming SMS and changed the phone number for OTP. That was anxiety full day. Later realised that I need to backup my recovery codes on my system somewhere.
I had the same issue and lost access to a few things. Next time I moved overseas I found a provider that offers $99/yr unlimited talk/text (in Canada) but gives free incoming SMSs when roaming. They even support eSIM so I can have it at all times on my iPhone, although I turn it off since it seems to use extra battery being connected to two networks at once.
Re: Ask HN: If I get locked out of everything, please try to help me
#340I'm sorry that is happening.