Can't you get the seed values out of Google's Authenticator (which is TOTP?)? I would put these somewhere safe--rather than save a bunch of backup codes.
Ask HN: How do you start over with 2FA after losing your phone?
31–40 of 112 posts
Re: Ask HN: How do you start over with 2FA after losing your phone?
#32If you’re reading this and don’t have backup codes for Google auth stored somewhere offline then this is your wake-up call to do it now.
Re: Ask HN: How do you start over with 2FA after losing your phone?
#33Earlier quoted context omitted.
This is why phone based 2fa is not secure and not recommended. Sure it is easy, but it isn't secure in important ways
What? Where the 2FA codes come from isn't relevant, as long as the device (laptop, phone, desktop, hardware) is protected in some way or another (like password). Backup codes come from the service which is 2FA protected anyways, not from the 2FA authenticator itself. Edit: oh, reading your message again, are you referring to SMS-based 2FA? I assumed TOTP 2FA in this submission. If you mean SMS-based 2FA, then yeah I…
Nobody has a secure password on their phone, so your requirement fails. There is no way to get a secure password on a phone as one of the requirements of a phone is quick access, and no fast password is secure. (maybe finger prints, but I have found them unreliable and so I quit using them)
If your phone based code system is also available on other accounts, and you can access those other accounts without the phone then maybe. However many people only have a phone, and no other computer (or at least not a computer they use often enough that we can trust the 2fa isn't expired).
The 2fa I've seen mostly has a SMS based fallback, and thus is no more secure than SMS.
Re: Ask HN: How do you start over with 2FA after losing your phone?
#34Not a solution for the OP, but to anyone else reading: do not set up 2FA with a single point of failure. If you lost any one thing, would you be locked out like the OP?
If you have to use TOTP codes be religious about saving your backup codes. Otherwise, using multiple security keys means you can recover from losing one, with the bonus of phishing protection (since they can't be tricked into supplying your codes to the wrong domain).
Re: Ask HN: How do you start over with 2FA after losing your phone?
#35I know it doesn’t help now, but next time use Authy instead of Google Authenticator. It can sync to multiple devices. I have it synced to my laptop so if I lose my phone, I still have Authy on my laptop with all 2FA.
Microsoft Authenticator also provides the same.
Re: Ask HN: How do you start over with 2FA after losing your phone?
#36You can back up your 2FA codes to another phone, at least Google Authenticator lets you do this. An old phone is the easiest, most convenient way to do this since it has a camera that you can use to scan the code on your main phone. If you don't have the backup codes or the one-time codes, you're going to have a problem and you'll need to contact the services to somehow let you in or take off 2FA. Depending on what t…
BTW this process is broken with small display. I have a very tiny Android phone and to backup the codes I need to scan an QR code on this small display, which isn't working out. The resolution is too small. And there is no other way to backup Google Authenticator I am aware of. So be careful in smaller display, you probably cannot backup Goggle Authenticator.
There is on a rooted android phone with an adb shell
sqlite3 /data/data/com.google.android.apps.authenticator2/databases/database \
'select email,secret from accounts'
Re: Ask HN: How do you start over with 2FA after losing your phone?
#37Backups: you MUST have a backup! One thing I do is avoid proprietary apps like Google Authenticator and make sure I store the TOTP key separately so I can reconstitute my TOTP codes in another app if necessary. Backups are kept on a backup handset, on my computer, and in an encrypted volume in the cloud at a minimum. What's a little harder to deal with are the services/providers that insist on SMS 2FA (and not to a VoIP number).
Re: Ask HN: How do you start over with 2FA after losing your phone?
#38Use your backup codes that you've downloaded and safe-kept somewhere (you did this right?). If not, I'm afraid you're out of luck. There are two possible outcomes from contacting support for a service, asking to regain control over a 2FA-protected account, both which sucks, but on different levels. 1. You write them, proving who you are, and they tell you to get lost unless you have the 2FA proper codes, or backup co…
This is why phone based 2fa is not secure and not recommended. Sure it is easy, but it isn't secure in important ways
What is recommended?
Re: Ask HN: How do you start over with 2FA after losing your phone?
#39Use your backup codes that you've downloaded and safe-kept somewhere (you did this right?). If not, I'm afraid you're out of luck. There are two possible outcomes from contacting support for a service, asking to regain control over a 2FA-protected account, both which sucks, but on different levels. 1. You write them, proving who you are, and they tell you to get lost unless you have the 2FA proper codes, or backup co…
I so wish u2f/yubikey was supported on all websites :-(
Re: Ask HN: How do you start over with 2FA after losing your phone?
#40For the services that don’t allow their keys to be included in the backup this is a common occurrence and they will probably have a support system that will allow you to reset the authentication. Which makes 2fa worthless theatre but that’s reality.