Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: If I get locked out of everything, please try to help me

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 350 posts

Re: Ask HN: If I get locked out of everything, please try to help me

#91

Post by nyolfen »

Wowfunhappy wrote: post #4

This is my nightmare. This is why I refuse to use 2FA. (Except on services that require it, and I wish they didn't require it.) Am I worried about getting hacked? Absolutely! But when I weigh the likelihood of (1) someone else getting into my account without 2FA and (2) locking myself out of my own account with 2FA, the latter seems much more likely! I understand how backup codes work. I promise you I will loose them…

you can set up multiple redundant mfa methods, eg i have two yubikeys in separate locations plus phone totp

Re: Ask HN: If I get locked out of everything, please try to help me

#92

Post by DoreenMichele »

charcircuit wrote: post #59
DoreenMichele wrote: post #11

Earlier quoted context omitted.

It's a smaller of the two problems for the company . If you are really poor, losing access to your online life because you couldn't pay your phone bill or something can be a huge, huge problem. I have been homeless. I'm not currently. But this is an extremely stressful situation that could do all kinds of damage to my life if I can't get it sorted.

Losing access because someone stole your account is even worse because of how much access a Google account gives someone.

Having spent nearly six years homeless and also had a college class from SFSU in Homelessness and Public Policy and having written about homelessness for years, I can assure you that for the vast majority of homeless people, losing their physical phone or being unable to pay for it is a much bigger problem than other people wanting to break into their accounts and steal their identity or some such.

Re: Ask HN: If I get locked out of everything, please try to help me

#93

Post by valenterry »

toomuchtodo wrote: post #79
valenterry wrote: post #70

Earlier quoted context omitted.

In the current state, I believe it indeed causes more economic and personal harm. Properly executed MFA by both the provider and the user are great, but we have a long way to get there.

The recovery user flow, at the end of the day, should provide an option for identity proofing through a service that can consume a government provided identity credential. Login.gov, Stripe Identity, ID.me, whatever, something that can attest that you are you when provided a sanctioned credential. You should be given the option to opt out of this, have your data E2E encrypted, and if you lose your creds your data los…

More than just that. 2FA should

1a) be possible to be disabled or

1b) Offer non-electronic second factors such as paper codes

2) Offer a broad range of options in general, not just phone or even worse only SMS. I can count the services that I can use my Yubikeys with on one hand

3) Be predictable (or at least be configurable like that) by the user and not behave different on weird conditions such as your IP

4) Allow to configure more than just 2 factors. 2 factors are really bad. It should usually be 1 or 3+.

5) It should educate properly about how to use it and also about the risks (e.g. increased change of losing access, especially when certain factors are used)

I think that when identity proofing actually becomes important, we should fully leave private services. That is something too important, so the state should either standardize and enforce it or offer it. Maybe, offering a wide-scale MFA / Auth solution should come with similar restrictions that we have for finance, including the identity proofing fallback your mentioned.

Re: Ask HN: If I get locked out of everything, please try to help me

#94

Post by smeej »

crooked-v wrote: post #26
jrochkind1 wrote: post #23

Earlier quoted context omitted.

I use authy (free) for 2FA TOTP and have it set up on my work laptop, my home laptop, and my phone. As long as least one of those is still good, I should still be able to get in. I honestly don't know what's going on behind the scenes to know if this is not as secure as it "should" be. But this was my reaction specifically to the non-SMS TOTP 2fa: Wait, if I lose my phone there's literally no way possible to get in?…

> As long as least one of those is still good, I should still be able to get in. Google has, in some cases, started requiring auth codes sent to specific devices , even if you're already using your own configured TOTP 2FA.

I had a similarly frustrating issue happen with PayPal, only they were refusing to let me log in with my YubiKey, insisting on SMS. But their phone system couldn't send a message to me by SMS. It errored before it even tried, because I could have gotten a code on that phone if they had actually sent it.

If I've agreed to use and keep track of a very small physical device to access my account, don't be going letting any ol' person who can access my phone number in there!

Re: Ask HN: If I get locked out of everything, please try to help me

#95

Post by bee_rider »

jrmg wrote: post #50

I have long wondered if two factor authentication actually causes more economic harm than it solves - it just doesn’t cause that harm to be noticeably all in one place (the harm is spread to millions of users who will lose access at some point during their lives rather than concentrated on the company that implements TFA dealing with fraud). It feels like it might. This isn’t counting the productivity that’s lost to…

I think it is hard to say actually. An account that gets killed off by 2FA failures is dead, which is definitely extremely annoying. But on the other hand — the maximum cost that could be incurred is just the value of the account, and lots of our accounts are actually basically valueless (Facebook, Twitter).

On the other hand if your account is taken over, it could be used to perpetuate scams (which could harm your loved ones if they fall for the scams), it could be used for various things that might hurt your reputation. Or depending on the type of account it might be a stepping stone to get into, I dunno, your bill-paying account for some utility company, which will probably have all your bank account details in there because utilities companies tend to not be super on the ball about that kind of thing.

Re: Ask HN: If I get locked out of everything, please try to help me

#96

Post by powerapple »

Feel sorry for you. I have been locked out of my gmail account for a few weeks. I can receive verification code with my registered mobile, but it is not enough for Google to confirm my identity. It happened twice when I switched to a new phone, I have planned to move away from Google but I didn't. It is painful. Everyday I would realize there is a service I cannot access because I don't have access to my gmail account any more.

I am moving to iCloud, the setup is better than gmail in my opinion. I am not sure if I can get my digital game library back, and many other accounts. I will try to recover my gmail account once a week, and hopefully something can happen. But as far as what I read from internet, people have been locked out their email account for years, and no one cares.

Re: Ask HN: If I get locked out of everything, please try to help me

#97

Post by userbinator »

donmcronald wrote: post #32
crooked-v wrote: post #6

There was a post a while back around poor and homeless people encountering exactly this problem on a regular basis. Lots of people in the comments were incredibly dismissive and sometimes actively malign about it. Edit: One suggestion from me would be to try and start the dead phone connected to power but with the battery physically removed (assuming it's removable). That might bypass whatever issue it's having and l…

> There was a post a while back around poor and homeless people encountering exactly this problem on a regular basis. Lots of people in the comments were incredibly dismissive and sometimes actively malign about it. Even worse than that, they're often connecting from public IPs that are "suspicious" which causes automated systems to treat them more harshly. In Canada it's gotten to the point where you need an interne…

but big tech discriminates against anything that's not a personal computing device.

To be precise, anything that's not a "personal" computing device running the latest spyware-filled locked-down software and a browser that can be anything as long as it's the three that Google implicitly "approve".

government, banking, etc..

Banking is private-sector, but I believe the government should always be accessible even if you live like the Amish...

https://en.wikipedia.org/wiki/Amish#Canada

...and I wonder how they get along there since they're apparently present in Canada too.

Re: Ask HN: If I get locked out of everything, please try to help me

#98

Post by class4behavior »

Wowfunhappy wrote: post #29
class4behavior wrote: post #16

Earlier quoted context omitted.

>This is why I will not use 2FA except on services where it is absolutely required Software 2FA just computes a number based on a secret string. You treat the latter the same way you take care of your passwords. That's why it's best to handle them with your password manager. 2FA over SMS is even less of an issue (except maybe with a broken eSIM chip). Physical methods are a problem, so you have to spend money for a b…

I could store the secret in my password manager if I paid for Bitwarden Premium (and at $10 a year, price isn't really the issue), but then what is even the point? If my password and my secret are stored in the same place then that's really just a single factor, so I'm making the login process more annoying for no reason.

How many well-formed passwords can and will you remember? How often are you willing to change them afterwards? How secure is your 2FA app? How secure is your device against keylogging? How sure are you no one will watch what you've typed in or when you reveal it to fix a typing error? And so on. It isn't as if there are no issues with the classic way.

That's why you maintain the knowledge-possession separation at the access to your password manager (file) with a combination of a password and either a key file or hardware key.

If you store your secrets in encrypted files rather than specialized server solutions, it's also easier to separate and store them in different locations.

Re: Ask HN: If I get locked out of everything, please try to help me

#99

Post by im3w1l »

I'd argue that the most logical long term solution is that Google figures something out with the government. E.g. go to the DMV to recover your account. The government is the fundamental root of trust and authority on who is who, so it just makes sense that your "official" online life should tie in with that like say your google account and online banking (for more casual stuff like say a reddit account, the drawbacks outweigh the benefits).
Post reply on HN