Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: It is impossible to disable Google 2FA using backup codes

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 352 posts

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#131

Post by halkony »

arriu wrote: post #124

Whenever one of these threads about Google (or Apple) come up, I am shocked at the lack of response from people working at those companies. It seems reasonable that this site would be where you'd find someone from a team that interacted with logic that OP is having trouble with. I'd expect to see something like a "hey, yeah, I know a guy on our team that might be able to get in touch with the team who maintains this.…

Developers at large corporations are strictly informed that they are not the public face of the company and can't do that. These aren't mom and pop developer shops.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#132

Post by gravitronic »

arriu wrote: post #124

Whenever one of these threads about Google (or Apple) come up, I am shocked at the lack of response from people working at those companies. It seems reasonable that this site would be where you'd find someone from a team that interacted with logic that OP is having trouble with. I'd expect to see something like a "hey, yeah, I know a guy on our team that might be able to get in touch with the team who maintains this.…

Nothing yet, but I just added an email in profile if any helpful googlers are able to assist

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#133

Post by dfdz »

renonce wrote: post #126

Maybe too late to give you any helpful advice, but setting up Advanced Protection may make sense. You need to buy at least two (preferably three) YubiKeys and the password plus any of these keys allow you to login to your account. Nothing more, nothing less. Costs a few bucks, but at least the auth flow is very clear. Another thing you can do is to wait for a week and see if anything changes. Having the session last…

Best advice in this thread:

https://landing.google.com/advancedprotection/

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#134

Post by jneal »

I had this same issue just a few weeks ago. I recall being asked for my 2FA on a few separate occasions and could never disable it or switch to a new authenticator app even though I had backup codes. However, I tried it a 3rd time one day and for whatever reason I was able to do it. If I recall correctly, it suddenly gave me the option to instead authenticate with my password again, which I did. Good luck!

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#135

Post by mr_mitm »

tmerse wrote: post #117
jvanderbot wrote: post #84

Earlier quoted context omitted.

You can do this, or you can write down the secret (Click to get the text), and use oathtool to generate codes rather than google's auth. I keep all my 2fa secrets in pass for this reason. Never lose access again!

But be careful. If you access the passwords and 2fa secrets via the same credentials you are back to one factor authentication if secret + pass store ever get compromised. Imho it's a different story if you use a separate gpg-key/secret to access the 2fa secrets (which should also only happen in emergency cases). This can easily be done with pass.

How is a regular user supposed to think of all this in advance? It's ridiculous. Securely proving your identity in case of loss of proof of identity is hard enough with just passwords. With 2FA it's pretty much impossible.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#136

Post by stonemetal12 »

jeroenhd wrote: post #76
torstenvl wrote: post #6

I hate current popular implementations 2FA and similar IT fads for this exact reason. They are inherently insecure, and any security professional who pushes them without serious thought through all the failure modes should be blacklisted from the industry.

This isn't a security flaw, this is incompetency. Google not allowing disabling or altering 2FA after resorting to a backup code is simply bad design. They could've done the same with any method of authentication. Using a password isn't even enough for Google any more these days, look at Gmail+IMAP. This is pure incompetency, not a flaw in 2FA. Whatever device this person is on has been flagged insecure enough to nee…

>Google not allowing disabling or altering 2FA after resorting to a backup code is simply bad design.

You would think that using a backup code would prompt a "Do you want to alter 2FA?" work flow since the user is already at the 2FA has gone wrong point.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#137

Post by reaperducer »

epicureanideal wrote: post #53
rhacker wrote: post #16

> What am I supposed to do in this situation? This. Support systems in the world post computers eating everything is basically HN posts.

Maybe the next million new jobs is just rebuilding a reasonable level of customer support at all tech companies, funded by modest usage fees. $5/mo, $50/yr, or $500 for lifetime guaranteed permanent access so no lockouts are possible, I would definitely pay for Gmail or an equivalent service. And there are people who I’m sure would pay much more. Another short term option: $500-1000 right now to get a couple hours of…

Maybe the next million new jobs is just rebuilding a reasonable level of customer support at all tech companies, funded by modest usage fees

This already exists.

It's why if you have a certain bank balance, when you call the bank a human in your own country picks up and speaks to you in your native tongue immediately. And if you don't have a certain bank balance, you sit on hold for 90 minutes and are repeatedly told how important your call is.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#138

Post by MetaWhirledPeas »

jay-barronville wrote: post #80
ironmagma wrote: post #43

Earlier quoted context omitted.

Time to repeal 2FA. I can't believe it's required for SOC2 type 2 compliance.

2FA/MFA isn’t the problem. Google is just a pain to deal with when their products don’t work as expected. On one hand, security-wise, it’s good that they tend to design their algorithms to err on the side of being restrictive, but on the other hand, they have no legit support, so if you or their algorithms mess up and you’re locked out of your account, you’re basically on your own. For a company so many of us rely on…

The alternative is picking a smaller company that might be an easier hacking target or might go out of business when you're not paying attention. I have a Protonmail account but I do wonder how long they'll be around.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#139

Post by b112 »

tmerse wrote: post #117
jvanderbot wrote: post #84

Earlier quoted context omitted.

You can do this, or you can write down the secret (Click to get the text), and use oathtool to generate codes rather than google's auth. I keep all my 2fa secrets in pass for this reason. Never lose access again!

But be careful. If you access the passwords and 2fa secrets via the same credentials you are back to one factor authentication if secret + pass store ever get compromised. Imho it's a different story if you use a separate gpg-key/secret to access the 2fa secrets (which should also only happen in emergency cases). This can easily be done with pass.

I'm sure all of this will make sense to grandma, too.

(Gmail's main target is not devs, or even computer literate people. And owning a smart phone =! literate.)

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#140

Post by sneak »

yjftsjthsd-h wrote: post #52
sneak wrote: post #21

TOTP is bad 2FA. Google supports U2F security keys. Use them.

> TOTP is bad 2FA How so? The only downside is that you have to glance up and make sure you're on a google.com domain before entering it, in exchange for which you get massively simpler implementation, a wider variety of options, and the ability to back up token if you really want.

"just glance up at the address bar" is not phishing-proof, and is failure prone.
Post reply on HN