Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: I can't login to Gmail due to phone cannot be used for verification

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 48 posts

Re: Tell HN: I can't login to Gmail due to phone cannot be used for verification

#11

Post by iosjunkie »

joncrane wrote: post #5
Eric_WVGG wrote: post #4

This phone verification shit is so awful. I have two friends who moved overseas and disconnected their cellphone plans without thinking about their MFA situation. Today I have to enforce MFA at the small company I'm working at, and just a month prior I held a cybersecurity seminar for them and explained that "phone MFA is… okay… but you should really use verification apps." But I didn't realize that you can't even en…

So I have used Authy, which apparently is somehow protocol compatible with Google Authenticator, and you can back up your tokens with a password. I got a new phone, installed the app, entered the password, and all my tokens were there.

which apparently is somehow protocol compatible with Google Authenticator

Nothing mysterious. Authy and Google Authenticator simply implement the same standard, RFC 6238.

https://datatracker.ietf.org/doc/html/rfc6238

Re: Tell HN: I can't login to Gmail due to phone cannot be used for verification

#12

Post by Nostrada »

joncrane wrote: post #5
Eric_WVGG wrote: post #4

This phone verification shit is so awful. I have two friends who moved overseas and disconnected their cellphone plans without thinking about their MFA situation. Today I have to enforce MFA at the small company I'm working at, and just a month prior I held a cybersecurity seminar for them and explained that "phone MFA is… okay… but you should really use verification apps." But I didn't realize that you can't even en…

So I have used Authy, which apparently is somehow protocol compatible with Google Authenticator, and you can back up your tokens with a password. I got a new phone, installed the app, entered the password, and all my tokens were there.

That is the answer. Authy can be used on several machines at the same time. Totally rocks - and is free

Re: Tell HN: I can't login to Gmail due to phone cannot be used for verification

#13

Post by hobo_mark »

joncrane wrote: post #5
Eric_WVGG wrote: post #4

This phone verification shit is so awful. I have two friends who moved overseas and disconnected their cellphone plans without thinking about their MFA situation. Today I have to enforce MFA at the small company I'm working at, and just a month prior I held a cybersecurity seminar for them and explained that "phone MFA is… okay… but you should really use verification apps." But I didn't realize that you can't even en…

So I have used Authy, which apparently is somehow protocol compatible with Google Authenticator, and you can back up your tokens with a password. I got a new phone, installed the app, entered the password, and all my tokens were there.

So now your second factor is... the Authy master password?

Re: Tell HN: I can't login to Gmail due to phone cannot be used for verification

#14

Post by b3lvedere »

night-rider wrote: post #2

Have you tried clicking the 'Try another way' link?

The 'try another way' works perfectly fine and i can use my authenticator app of choice to login. But why Google insists on using the YouTube app on my smartphone as the first method of verification baffles me. Can't disable it or put authenticator method as preferred method as well.

Re: Tell HN: I can't login to Gmail due to phone cannot be used for verification

#16

Post by sawirricardo »

andrewmcwatters wrote: post #10

I kid you not. Google's actual official answer to this is... create another account![1][2][3] Edit: Now that I have your attention: PSA: Go create "Backup codes" for your Google Account in your 2-Step Verification settings. [1]: https://support.google.com/accounts/troubleshooter/2402620?h... [2]: https://support.google.com/accounts/answer/7682439 [3]: https://support.google.com/accounts/answer/7299973

Oh my, obviously not the solution we look for

Re: Tell HN: I can't login to Gmail due to phone cannot be used for verification

#18

Post by throwanem »

joncrane wrote: post #5
Eric_WVGG wrote: post #4

This phone verification shit is so awful. I have two friends who moved overseas and disconnected their cellphone plans without thinking about their MFA situation. Today I have to enforce MFA at the small company I'm working at, and just a month prior I held a cybersecurity seminar for them and explained that "phone MFA is… okay… but you should really use verification apps." But I didn't realize that you can't even en…

So I have used Authy, which apparently is somehow protocol compatible with Google Authenticator, and you can back up your tokens with a password. I got a new phone, installed the app, entered the password, and all my tokens were there.

TOTP ("Time-based One-Time Password") isn't exactly a "protocol", just a big random number as a pre-shared key plus a method for hashing that with the current time to produce a six-digit number. Whatever you're authenticating to does the same computation with the key and, if the result you provide matches the one it got, it knows you have the same key it does.

SMS 2FA is a different proposition, in that the authentication provider sends you the intended response directly. This is a little easier for nontechnical users in that it doesn't require an app that can compute TOTP responses, but it's markedly less secure in that anyone receiving or intercepting the SMS can immediately respond to the challenge, and less resilient in that you can't authenticate at all if you don't receive the SMS - which is the failure mode under discussion here.

Re: Tell HN: I can't login to Gmail due to phone cannot be used for verification

#19

Post by refurb »

What worked for me was to try it again from an IP I had logged in with before. For some reason it causes Gmail to not ask for a phone number verification.

Once logged in I could change the phone number.

Really stupid way to do it. No reason to lock someone out with the right password.

A better alternative would be to show partial digits of an old number and ask you to complete it.

Re: Tell HN: I can't login to Gmail due to phone cannot be used for verification

#20

Post by adyavanapalli »

I once changed my Gmail password and promptly forgot it. When I was trying to recover it, I had no MFA set up (I had a yubikey, but somehow that wasn't allowed???), so the only option left for me was to provide them with the month and year I created the account. Since it was roughly a 10 year old account, I had no idea what those numbers were. There was also no way to reach out to an actual human for help through their account recovery workflow. I ended up creating a Twitter bot that would tweet at one or two of the handles owned by Google, once a day. After about a week, I had someone reach out, and I was finally able to prove that I actually owned the account and recover it. It was definitely a stressful time.
Post reply on HN