Live data from Hacker News

Ask HN: If I get locked out of everything, please try to help me

news.ycombinator.com

141–150 of 350 posts

Re: Ask HN: If I get locked out of everything, please try to help me

#141
> Google says it will send me a link in 72 hours.

Right, so why don't you believe that? A lot of people have lost their only second factor in the past. That's what the recovery flow is there for.

Why not at least wait that amount of time first before escalating to using HN as a support forum?

> Google is convinced I'm trying to break into my own accounts

That's like saying that the front door is convinced you're trying to break into your house, if you try the wrong key. First, it's not useful to anthropomorphize companies and systems like that. Second, "convinced" implies certainty. Of course there is no certainty that these attempts are coming from an attacker. They're even unlikely to. But for 2FA to be a useful security product, it needs to be predictable. It cannot be that there's a button that says "I've lost my phone and need access to this account right now", even if such a button would be very useful to legit users, because obviously attackers could click on that as well.

And that's why the 72 hour wait. If it's an attacker, the legit user will be notified and can reject the recovery attempt. If it's the legit user who really doesn't have access to the account any more, then the passage of time acts as additional proof of this.

Re: Ask HN: If I get locked out of everything, please try to help me

#142
post #50

I have long wondered if two factor authentication actually causes more economic harm than it solves - it just doesn’t cause that harm to be noticeably all in one place (the harm is spread to millions of users who will lose access at some point during their lives rather than concentrated on the company that implements TFA dealing with fraud). It feels like it might. This isn’t counting the productivity that’s lost to…

Hard disagree.

MFA is the best mechanism to stop hackers from constantly hacking everyone. Without it everyone would be getting brute forced 24/7.

Re: Ask HN: If I get locked out of everything, please try to help me

#143

This is my nightmare. This is why I refuse to use 2FA. (Except on services that require it, and I wish they didn't require it.) Am I worried about getting hacked? Absolutely! But when I weigh the likelihood of (1) someone else getting into my account without 2FA and (2) locking myself out of my own account with 2FA, the latter seems much more likely! I understand how backup codes work. I promise you I will loose them…

I use authy (free) for 2FA TOTP and have it set up on my work laptop, my home laptop, and my phone. As long as least one of those is still good, I should still be able to get in. I honestly don't know what's going on behind the scenes to know if this is not as secure as it "should" be. But this was my reaction specifically to the non-SMS TOTP 2fa: Wait, if I lose my phone there's literally no way possible to get in?…

Considering that Authy relies on an SMS OTP for the account creation (and possibly account recovery), I prefer to use something else that provides the benefits of cloud syncing across devices and isn’t tied to a phone number. I understand that SMS OTP is simple for most people to handle (encouraged by many platforms over the years), but I just cannot get past that barrier to choose Authy over something else for personal use.

Re: Ask HN: If I get locked out of everything, please try to help me

#144

A lot of people treat printable recovery codes as something that should be protected, locked in a safe, etc. As a result they don't bother to use them as it seems like too much effort to secure them. Please do not treat them this way. They do not grant access to your account. Print many copies of your recovery codes and spread them around. Wallet, home, car, parents' house, etc. It doesn't matter if they get stolen o…

> Please do not treat them this way. They do not grant access to your account. Can you expand on that? Once I have such code, what’s stopping me from “stealing” the account?

You need the password too. That's what makes it two factor.

Re: Ask HN: If I get locked out of everything, please try to help me

#145

Earlier quoted context omitted.

> There was a post a while back around poor and homeless people encountering exactly this problem on a regular basis. Lots of people in the comments were incredibly dismissive and sometimes actively malign about it. Even worse than that, they're often connecting from public IPs that are "suspicious" which causes automated systems to treat them more harshly. In Canada it's gotten to the point where you need an interne…

but big tech discriminates against anything that's not a personal computing device. To be precise, anything that's not a "personal" computing device running the latest spyware-filled locked-down software and a browser that can be anything as long as it's the three that Google implicitly "approve". government, banking, etc.. Banking is private-sector, but I believe the government should always be accessible even if yo…

> Banking is private-sector, but I believe the government should always be accessible even if you live like the Amish

I got a notice from my state that I'm required to make future tax payments electronically. For that they require ACH. Banking may be private sector but participating in it is increasingly non-optional.

Re: Ask HN: If I get locked out of everything, please try to help me

#146
post #135

You have to click forget password. Then keep pressing "Try another way" until you see "Choose how you want to sign in:" Then select "Get a verification code" It should text the code to telephone number linked on the new cell phone. After signing in on the new phone with the new password, you will have to do the same thing. Press try another way until you see send a verification code to your phone number. Then it will…

the try another way sometimes just goes to sorry we can't help you right away and is a dead end. even with correct password and 2fa.

This loop and a lockout was a nightmare for me. No suspicious IP address or browser changes, but Google would still not let me in. Worse, it asked me to verify with a phone number and after I verified, it still wouldn’t even send any codes to the phone and stopped me from recovering or logging in to the account.

The people who created this useless and draconian account “protection” system seem to have no clue about the real world.

Re: Ask HN: If I get locked out of everything, please try to help me

#147

Earlier quoted context omitted.

Tying someone's identity to their phone number is not the answer, though. I have this at the moment - I'm travelling, moving country every few weeks, so I need a new SIM card and phone number every few weeks. My phone number is temporary at best. I'd massively prefer to take the risk of my identity being stolen than constantly fighting security measures that assume people never change their phone number (or country o…

You don't need to use a phone number for google. I don't have a phone number attached to my google account at all due to the risk of sim swapping despite asking my carrier to lock it, instead i have multiple hardware keys and devices + backup codes in a safe deposit box.

You do for lots of other things (and many people have it for Google as well). Most banking or payment, a random selection of apps that decide you now need verification, new apps in the new country...

Re: Ask HN: If I get locked out of everything, please try to help me

#148

I recently lost my Android phone, and in order to use Find my Phone service, I needed to login into my google account. But I couldn't log in from my notebook, because it required me to approve the login using ... my lost phone! Is this what Google programmers are paid $250k salaries for?

Sounds exactly like a deep bureaucracy at work! How do they even sit and design such systems and who signs off on such designs? It’s as if the company that prides itself for tech has mostly incompetent people with no real world experience or real world information gathering skills.

Re: Ask HN: If I get locked out of everything, please try to help me

#149

If anyone got afraid and wants to disable 2fa, go to https://myaccount.google.com/security

The trick isn't to disable 2FA. It's to add a bunch of 2FA methods that don't rely on your cell phone: authenticator app, yubi keys, backup codes.

"Ways we can verify it's you" seems to be limited to 1 email and 1 phone number now.

Re: Ask HN: If I get locked out of everything, please try to help me

#150
This is the issue with companies forcing 2FA on people. I don't see why it's so controversial that people should be able to make their own security decisions on their own accounts.

Yes, I know 2FA is more secure, but sometimes, I just don't care that much.

Post reply on HN