Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you start over with 2FA after losing your phone?

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 112 posts

Re: Ask HN: How do you start over with 2FA after losing your phone?

#81

Post by jareklupinski »

jqpabc123 wrote: post #49

Always, always create a backup. Or three. I carry a backup with me strapped to my wrist. It is a cheap digital watch with a strap modified to securely hold a microSD card with all my really important, must have data ---encrypted with Bitlocker. This data is as safe as I am. I leave a copy of this card in a fireproof safe at home. A trusted family member has the combination. A friend has the Bitlocker decrypt key. My…

thanks for the details! I do something simmilar with three flash drives, but wondering if it's overkill

curious, how long have your microsd cards been working for, and have you experienced any bit-rot / bad blocks yet?

Re: Ask HN: How do you start over with 2FA after losing your phone?

#82

Post by manv1 »

Use a 2FA app that backs up to iCloud or syncs to another copy of itself somewhere.

Google authenticator is great, until it wipes out all your entries. It did that a few years ago for reasons unknown, so I moved to 2STP (which is now unavailable).

Also, the app you use should have an apple watch app, so at least if your phone dies you can use your watch to authenticate.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#83

Post by tpoacher »

Not that this is of help to you now, but my own controversial take is, avoid any services that push 2FA. Especially if they do so aggressively.

This includes things like switching from github to sourcehut for me (though MS+copilot didnt help either)

For services where you cant avoid it (e.g. your company email), download a local OTP app, effectively converting back to 1FA, for each device you use to access that service.

2FA is a cancer and needs to die. Mandatory-phone-based 2FA doubly so. The only thing mandatory phone 2FA has done for me is it gives websites an excuse to make a phone a "necessary" field, so now I get spam/scam on my phone as well as my email.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#85

Post by jqpabc123 »

jareklupinski wrote: post #81
jqpabc123 wrote: post #49

Always, always create a backup. Or three. I carry a backup with me strapped to my wrist. It is a cheap digital watch with a strap modified to securely hold a microSD card with all my really important, must have data ---encrypted with Bitlocker. This data is as safe as I am. I leave a copy of this card in a fireproof safe at home. A trusted family member has the combination. A friend has the Bitlocker decrypt key. My…

thanks for the details! I do something simmilar with three flash drives, but wondering if it's overkill curious, how long have your microsd cards been working for, and have you experienced any bit-rot / bad blocks yet?

I have had minimal issues with SD cards but I always buy name brand --- and I have 2 copies just in case. Plus, the working data is also stored on my in-house network.

The first thing I do with any new memory card is reformat it. Many (if not most) cheapo, off brand, Chinese cards won't even format properly. Either the stated capacity is being faked outright or the card was a factory reject with bad blocks that shouldn't have been sold. Do not buy --- end of story.

In any case, my xcopy update script will totally rebuild the backup from network source if I decide to replace one of the cards with a new empty one. I replace at the first sign of trouble but this has only occurred every few years.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#87

Post by ASalazarMX »

codegeek wrote: post #86

I don't know if I can help OP but anyone reading this who uses Google Authenticator. PLEASE BACKUP AUTHENTICATOR on another phone. It is very easy. Here are the steps: https://www.protectimus.com/blog/google-authenticator-backup...

Also, while it defeats the 2FA somewhat, you can activate TOTP in your KeePass entries, obviating the need for a third authentication app.

If you really want to be superstrict, you can have one KeePass database with your passwords, and another, with a different master passwords, for your TOTPs. It's less convenient, but it still stays completely under your control.

Except for Apple, which rolled their 2FA in their own, incompatible way... for your convenience and safety, of course.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#88

Post by ASalazarMX »

tpoacher wrote: post #83

Not that this is of help to you now, but my own controversial take is, avoid any services that push 2FA. Especially if they do so aggressively. This includes things like switching from github to sourcehut for me (though MS+copilot didnt help either) For services where you cant avoid it (e.g. your company email), download a local OTP app, effectively converting back to 1FA, for each device you use to access that servi…

One of the best ways to rob someone of their non-2FA account, is to find their password, and then activate 2FA on an attacker's device. 2FA makes your credentials more secure, specially when you use standards so it can be integrated with third-party apps, like authenticators or password managers.

I completely agree about the phone authentication, it's bullshit meant to get your phone number in your profile. SMS is obsolete as a security measure.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#89

Post by [deleted] »

ethicalsmacker wrote: post #63

This is a complex problem. I considered this for many hours. How does one securely restore their secure measures once their devices are lost? Assume you lost your phone, laptop is also gone and your house burned down and your papers are gone with it. I personally symmetrically encrypt my ssh keys and send them to my wife every six months or so. I also send them to a burner gmail account I use basic password auth with…

[deleted]

Re: Ask HN: How do you start over with 2FA after losing your phone?

#90

Post by DogLover_ »

The problem with backup codes is that many people don't understand how crucial they are if they loose their device. Even IT people. I believe it is a step many skips because they falsely believe they can get access in some other way if necessary.

That it has become standard makes me think the inventors/providers have not thought it through.

Post reply on HN