Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you start over with 2FA after losing your phone?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 112 posts

Re: Ask HN: How do you start over with 2FA after losing your phone?

#61

Post by konha »

goosedragons wrote: post #56
carlosjobim wrote: post #54

Earlier quoted context omitted.

> Nobody has a secure password on their phone, so your requirement fails. > maybe finger prints, but I have found them unreliable and so I quit using them You mean that you specifically do not have a secure password on your phone because you chose not to. The rest of us use finger print sensors or facial recognition to make our devices as secure as can be. Your argument applies only to you and a handful of people. Th…

How long is the pin code that can be used to log-in into your phone and likely must be used when you restart it? 4-6 digits?

Use a long passphrase and unlock via biometrics.

Disable biometrics when handing the phone to somebody else or even remotely (e.g. mark as lost via “find my”).

Good compromise of usability and security.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#62

Post by wordyskeleton »

tashbarg wrote: post #42
lifely wrote: post #11

I've never trusted a single device for two factor authentification, My solution, trust in 1Password and it's encryption, I have access to my 2fa anywhere I need but it a computer, phone, tablette. Soon it will be passkeys and they'll be safe in the 1Password vault, no worrying about losing the device w/ the keys again.

So ... your solution is no tfa? Putting second factor material in password managers is terrible advice. For reasons unknown to me, it might be the right solution for you. But in general, it defeats the two factor authentication purpose if you reduce the factors again to knowledge alone. The whole point of tfa is, that the second factor is something you possess and not something you know (which is the first factor).

You're assuming a compromised password == compromised 1Password vault which is clearly not going to be the case most of the time

Re: Ask HN: How do you start over with 2FA after losing your phone?

#63

Post by ethicalsmacker »

This is a complex problem. I considered this for many hours.

How does one securely restore their secure measures once their devices are lost?

Assume you lost your phone, laptop is also gone and your house burned down and your papers are gone with it.

I personally symmetrically encrypt my ssh keys and send them to my wife every six months or so. I also send them to a burner gmail account I use basic password auth with.

In a chaotic moment I can just ask my wife to download the file from her email and I can decrypt and ssh into my server where I store all files and important things encrypted.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#64

Post by geraldhh »

ethicalsmacker wrote: post #63

This is a complex problem. I considered this for many hours. How does one securely restore their secure measures once their devices are lost? Assume you lost your phone, laptop is also gone and your house burned down and your papers are gone with it. I personally symmetrically encrypt my ssh keys and send them to my wife every six months or so. I also send them to a burner gmail account I use basic password auth with…

> I personally symmetrically encrypt my ssh keys and send them to my wife every six months or so.

curious, how do you store that key?

Re: Ask HN: How do you start over with 2FA after losing your phone?

#65

Post by jononomo »

josteink wrote: post #8

When you enable 2FA you are on pretty much every service asked to download recovery-codes, and save them somewhere safe. Did you do that, and if not, why not? Also: Didn't you backup the 2FA codes somewhere else where you can "sync" them in? I use Bitwarden Authenticator for 2FA (part of Bitwarden Pro) and it syncs my 2FA codes to all devices where I log on to Bitwarden. That way I avoid a single point of failure. Co…

I have backup codes saved in 1Password for maybe 10% of the online accounts with which I use 2FA + Google Authenticator.

I'm concerned about the online accounts for which I don't have backup codes.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#66

Post by ahofmann »

djha-skin wrote: post #44

I use KeepassXC password manager[1], it keeps my TOTP information and makes it available to use on all my devices. It syncs between my devices using Dropbox. Kepassium[2] makes it available on iOS, and Keepass2Android[3] makes it available on Android. It also manages my SSH keys and adds them to the ssh-agent, even on Windows. It houses a backup of my GPG keys. I even found that it can manage my credentials for use i…

This is the way. The KeepassXC File is under your control, and you're able to make as many copies, as are necessary. 2fa is the right thing, but having the TOTP Codes on only a single device will get you in bad situations.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#67

Post by geraldhh »

konha wrote: post #59
jkepler wrote: post #58

Earlier quoted context omitted.

Biometric phone security is only secure until a judge or police officer compels you to unlock your phone; and legally you must comply, because your face or finger aren't speech. However, if you use a passphrase, (at least in the US and other countries with string freedom of speech laws) you can't be legally compelled to unlock the phone, as that would impinge on freedom of speech. I never use biometrics to unlock my…

On iPhones you can press Volume Down + Power to disable biometrics (faceid) before you hand it to somebody else or when going through customs etc. It will require your passphrase to unlock then.

so the main usecase of this feature is to defeat the nice policeman/customs officer?

thanks! i always wondered

Re: Ask HN: How do you start over with 2FA after losing your phone?

#68

Post by jononomo »

capableweb wrote: post #3

Use your backup codes that you've downloaded and safe-kept somewhere (you did this right?). If not, I'm afraid you're out of luck. There are two possible outcomes from contacting support for a service, asking to regain control over a 2FA-protected account, both which sucks, but on different levels. 1. You write them, proving who you are, and they tell you to get lost unless you have the 2FA proper codes, or backup co…

I have backup codes saved in 1Password for maybe 10% of the online accounts with which I use 2FA + Google Authenticator.

I'm concerned about the online accounts for which I don't have backup codes.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#69

Post by ahofmann »

bluGill wrote: post #21
josteink wrote: post #8

When you enable 2FA you are on pretty much every service asked to download recovery-codes, and save them somewhere safe. Did you do that, and if not, why not? Also: Didn't you backup the 2FA codes somewhere else where you can "sync" them in? I use Bitwarden Authenticator for 2FA (part of Bitwarden Pro) and it syncs my 2FA codes to all devices where I log on to Bitwarden. That way I avoid a single point of failure. Co…

Where do you download those codes that is safe and secure? Everything I can think of, I can also think of a counter that means that mode is likely to fail. I'm a professional in the computer industry, so i'm more aware of possible failure modes than most people, but I also am aware of safe storage modes that most people don't have. The recovery codes as implemented are not useful backups for most people. Telling peop…

I have the backup codes of my most important account (email) printed and in my wallet. Without a hint to which account they belong. This helped me multiple times, where my phone was not available. I would recommend this to everyone, who uses 2fa.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#70

Post by ethicalsmacker »

geraldhh wrote: post #64
ethicalsmacker wrote: post #63

This is a complex problem. I considered this for many hours. How does one securely restore their secure measures once their devices are lost? Assume you lost your phone, laptop is also gone and your house burned down and your papers are gone with it. I personally symmetrically encrypt my ssh keys and send them to my wife every six months or so. I also send them to a burner gmail account I use basic password auth with…

> I personally symmetrically encrypt my ssh keys and send them to my wife every six months or so. curious, how do you store that key?

Memorized.

If I don’t or can’t recall it then I’m dead or may as well be.

Post reply on HN