Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: If I get locked out of everything, please try to help me

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 350 posts

Re: Ask HN: If I get locked out of everything, please try to help me

#121

Post by ImaCake »

Wowfunhappy wrote: post #4

This is my nightmare. This is why I refuse to use 2FA. (Except on services that require it, and I wish they didn't require it.) Am I worried about getting hacked? Absolutely! But when I weigh the likelihood of (1) someone else getting into my account without 2FA and (2) locking myself out of my own account with 2FA, the latter seems much more likely! I understand how backup codes work. I promise you I will loose them…

I understand this view. Unlike every other reply to your comment I am not going to suggest various 2FA schemes that I would invariably screw-up and just add my voice to yours.

2FA might be good for security, but it's also very ableist.

Re: Ask HN: If I get locked out of everything, please try to help me

#122

Post by NaturalPhallacy »

stubish wrote: post #116
crooked-v wrote: post #52

Earlier quoted context omitted.

It makes plenty of sense to Google: engineer for the 98% use case and the remaining 2% should just go away and stop wasting their time.

100% of devices will fail, eventually. It is kicking the can down the road.

Hey it worked for the UNIX epoch, till those guys retired.

Re: Ask HN: If I get locked out of everything, please try to help me

#123

Post by TimC123456 »

crooked-v wrote: post #26
jrochkind1 wrote: post #23

Earlier quoted context omitted.

I use authy (free) for 2FA TOTP and have it set up on my work laptop, my home laptop, and my phone. As long as least one of those is still good, I should still be able to get in. I honestly don't know what's going on behind the scenes to know if this is not as secure as it "should" be. But this was my reaction specifically to the non-SMS TOTP 2fa: Wait, if I lose my phone there's literally no way possible to get in?…

> As long as least one of those is still good, I should still be able to get in. Google has, in some cases, started requiring auth codes sent to specific devices , even if you're already using your own configured TOTP 2FA.

> Google has, in some cases, started requiring auth codes sent to specific devices, even if you're already using your own configured TOTP 2FA

This exact situation has been such a thorn in my side at my company lately. Does anyone know any way to disable this behavior, even just with Google Workspace accounts?

Re: Ask HN: If I get locked out of everything, please try to help me

#124

Post by TeMPOraL »

DoreenMichele wrote: post #25
shyn3 wrote: post #19

Earlier quoted context omitted.

I think you should take your phone to a store which can fix your phone. Googles code doesn't come as an SMS it comes as a notification from the Google app. Almost lost an account to this last week. Turned off 2fa.

I'm in a small town. I have no car. I no longer drive. I don't see well enough. I work from home due to my medical situation. I have no friends locally who can drive me someplace. Etc etc etc. This is a non-starter for me. I need Google to fix this. I can't do anything about the busted phone at this point.

On the off chance it helps, because I don't see anyone else mentioning it: could it be that your charging port is stuffed with lint? If you have a thin needle, try to poke inside and see how much material can you get out of the port.

Despite this being a common problem, it's not well recognized, and it's easy to forget about it too. I went through several charging cables and almost replaced my phone half a year ago, before I remembered - and sure enough, all my charging issues were caused by a layer of lint at the back of the port, that got compacted by the charging cable so well that it formed a flat "false wall". I forgot all about it, even though I've performed the exact same fix on other people's devices in the past.

Hope it helps; if not, I apologize for wasting your time.

Re: Ask HN: If I get locked out of everything, please try to help me

#125

Post by corsac »

charcircuit wrote: post #59
DoreenMichele wrote: post #11

Earlier quoted context omitted.

It's a smaller of the two problems for the company . If you are really poor, losing access to your online life because you couldn't pay your phone bill or something can be a huge, huge problem. I have been homeless. I'm not currently. But this is an extremely stressful situation that could do all kinds of damage to my life if I can't get it sorted.

Losing access because someone stole your account is even worse because of how much access a Google account gives someone.

For a careless user, or one who does not bother to learn about the risks, having one's account stolen is more of a danger. On the other hand, for a reasonably cautious user with a basic understanding of the risks involved, and whose life varies at all from predictable (affluent) norms, losing account access due to Google's protective measures is a bigger danger – and more of a hassle to guard against – because these protections are so easily triggered

Re: Ask HN: If I get locked out of everything, please try to help me

#126

Post by fregante »

imtyler wrote: post #117

Is there any service that presents an elegant solution to managing actual identities on the Internet? If not, it seems like a real problem that needs solving. I understand people value the ability to express themselves anonymously, but I've also been locked out of legitimate accounts-- If everyone is anonymous nobody can be verified. If everyone's identity is tied to their handle there's no anonymous expression. If s…

Italy has SPID. It’s a federated login system based on your fiscal code (every Italian has one). You can use it to log into any government service and potentially banks and such. If you do lose access to your 2FA (required, it’s your phone), you can:

- re-verify yourself with the provider, with a real ID

- get a new ID with another provider, which still points to the same fiscal code

As a global solution, it would be great to have a “real identity provider” that offers this but also allows me to log into services without giving them too much information.

Apple ID seems relatively good for this given that it lets me hide the address and change my name during registration.

Re: Ask HN: If I get locked out of everything, please try to help me

#127

Post by derekp7 »

imtyler wrote: post #117

Is there any service that presents an elegant solution to managing actual identities on the Internet? If not, it seems like a real problem that needs solving. I understand people value the ability to express themselves anonymously, but I've also been locked out of legitimate accounts-- If everyone is anonymous nobody can be verified. If everyone's identity is tied to their handle there's no anonymous expression. If s…

There is the Notary Public service for physical documents. I did a quick search a while ago out of curiosity, and there appears to be an eNotary service that uses X509 certs to notarize a digital document. I've never seen this used "in the wild", but if it is rooted in the traditional Notarization services, and is based on open standards, why wouldn't tech companies utilize this as a last resort identity service?

Something else I thought about is if someone could come up with a CA service that specializes in personal / client side certs. They could then indicate what fields they have verified (name, address, etc). Also an option to indicate if they have that information on file but not disclosed. And if someone wants a truly anonymous cert, have variable pricing for those. The cert would tell how much someone paid for it. That way services such as message boards could allow anonymous users but set a nominal threshold for certificate cost that they would accept -- high enough that it would limit duplicate spam accounts, but low enough that it would not be much of a burden for a typical user.

Re: Ask HN: If I get locked out of everything, please try to help me

#128

Post by dheera »

jrochkind1 wrote: post #43
jrmg wrote: post #39

Earlier quoted context omitted.

> work laptop, my home laptop, and my phone There’s a fire or gas explosion or earthquake or something, and you need to leave all those behind. What do you do? > Oh, everyone else is just hoping they never lose their phone? Really? I would be very, very surprised if that’s not what the vast majority of the population is doing. Many people have a phone as their _only_ computing device, and no printer, and don’t really…

> What do you do? I get screwed! I guess the right answer is that I have the backup codes carefully preserved.... off site! In case of natural disaster. Every time I sign up for a new account, I print out the backup codes, and take them to an off-site secure storage location, which of course i have... somewhere. There's no way 90%+ of internet users are doing that. I'm not even going to pretend I have any chance of d…

> I have the backup codes carefully preserved.... off site

Yeah f no. Most people just screenshot their backup codes and put it in a Google doc somewhere in plain text, at best. And at worst, they go "what the hell are these codes" and close the window.

Which, security-minded folks would know, is effectively equivalent to just writing passwords down in plain text.

Nobody thought to put even a tiny speck of product management into this system.

Re: Ask HN: If I get locked out of everything, please try to help me

#129

Post by zelphirkalt »

Gigachad wrote: post #8
crooked-v wrote: post #6

There was a post a while back around poor and homeless people encountering exactly this problem on a regular basis. Lots of people in the comments were incredibly dismissive and sometimes actively malign about it. Edit: One suggestion from me would be to try and start the dead phone connected to power but with the battery physically removed (assuming it's removable). That might bypass whatever issue it's having and l…

Problem is that support people mistakenly resetting account auth when the attacker calls up and social engineers them is a bigger and more common issue than people’s only device dying. Not to say that’s not a thing that happens, but it’s a smaller of the two problems.

Maybe, since Google wants to be that important to people's lives, they should be force to have representatives, to whom one can go and have things sorted. Needs to check your id and then phones home (...) to get your account unlocked.

Re: Ask HN: If I get locked out of everything, please try to help me

#130

Post by DoreenMichele »

TeMPOraL wrote: post #124
DoreenMichele wrote: post #25

Earlier quoted context omitted.

I'm in a small town. I have no car. I no longer drive. I don't see well enough. I work from home due to my medical situation. I have no friends locally who can drive me someplace. Etc etc etc. This is a non-starter for me. I need Google to fix this. I can't do anything about the busted phone at this point.

On the off chance it helps, because I don't see anyone else mentioning it: could it be that your charging port is stuffed with lint? If you have a thin needle, try to poke inside and see how much material can you get out of the port. Despite this being a common problem, it's not well recognized, and it's easy to forget about it too. I went through several charging cables and almost replaced my phone half a year ago,…

Thank you. That is not the issue.
Post reply on HN