Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you start over with 2FA after losing your phone?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 112 posts

Re: Ask HN: How do you start over with 2FA after losing your phone?

#91

Post by warner25 »

DogLover_ wrote: post #90

The problem with backup codes is that many people don't understand how crucial they are if they loose their device. Even IT people. I believe it is a step many skips because they falsely believe they can get access in some other way if necessary. That it has become standard makes me think the inventors/providers have not thought it through.

I'll admit to being an IT person who didn't understand how they worked for a whole year after I first set them up on my Google account. I seriously thought that they were one-time passwords by themselves. About a year later, I decided to test my disaster recovery plan and found that I also needed to have my Google password memorized; I couldn't depend on retrieving it from my KeePass database stored in Google Drive. In retrospect, yes I was stupid, but this honestly wasn't clear to me at first.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#92

Post by Zetobal »

latchkey wrote: post #80
Zetobal wrote: post #41

Earlier quoted context omitted.

I use the yubikey authenticator app for the ones that don't. The secrets are saved on the key and you can password protect it... and as with all keys back it up to your spare.

When you're traveling to Costa Rica, where do you keep your spare? Do you stay locked out until you get home? What if you're a nomad and you don't have a 'home'?

One of my spares is usually with my spouse (it's still password protect) and if both get lost I kinda deserve to be logged out until I get home.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#93

Post by nashashmi »

Google Authenticator is the worst, last time I used it. Too often my 2FA codes would not remain after updates. And when it did remain, it would not transfer to new phones.

iPhone has a built in 2FA code generator.

HTTP://TOTP.app is a web app that stores 2FA codes. Awesome to use. But you have to remember to download and back up the codes stored in TOTP.

Microsoft Authenticator used to be my favorite because it would sync phenomenally well.

In the following order, I would rank the 2FA code generators:

1. iPhone (especially if you are using iCloud password manager).

2. totp.app (you can use it even on desktops and every device you possibly have)

3. Microsoft auth (it only backs up to iCloud on iPhone. On android it backs up to an MS account. Can’t be used on desktop).

Depending on the service, you have locked yourself out of that service. I screenshot and store 2FA codes on paper because too often I lost my codes because of Terrible unreliable apps.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#94

Post by ProllyInfamous »

tpoacher wrote: post #83

Not that this is of help to you now, but my own controversial take is, avoid any services that push 2FA. Especially if they do so aggressively. This includes things like switching from github to sourcehut for me (though MS+copilot didnt help either) For services where you cant avoid it (e.g. your company email), download a local OTP app, effectively converting back to 1FA, for each device you use to access that servi…

I have closed two bank accounts, both because they required 2FA (I do not use a phone).

Re: Ask HN: How do you start over with 2FA after losing your phone?

#95

Post by TurkishPoptart »

jqpabc123 wrote: post #49

Always, always create a backup. Or three. I carry a backup with me strapped to my wrist. It is a cheap digital watch with a strap modified to securely hold a microSD card with all my really important, must have data ---encrypted with Bitlocker. This data is as safe as I am. I leave a copy of this card in a fireproof safe at home. A trusted family member has the combination. A friend has the Bitlocker decrypt key. My…

can you share the strap design to hold the microSD? how do you decrypt it when accessing it? very cool!

Re: Ask HN: How do you start over with 2FA after losing your phone?

#96

Post by huhneverthot »

codegeek wrote: post #86

I don't know if I can help OP but anyone reading this who uses Google Authenticator. PLEASE BACKUP AUTHENTICATOR on another phone. It is very easy. Here are the steps: https://www.protectimus.com/blog/google-authenticator-backup...

That article is hot garbage, predictably since the app is purpose built to not allow proper backups/migrations.

"Go back in time and save the raw secrets" might as well be a certain-fingered emoji to basically literally everyone.

At this point, the only hope is getting webauthn everywhere and train people to always enroll a primary and backup token.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#97

Post by more_corn »

jkepler wrote: post #58
carlosjobim wrote: post #54

Earlier quoted context omitted.

> Nobody has a secure password on their phone, so your requirement fails. > maybe finger prints, but I have found them unreliable and so I quit using them You mean that you specifically do not have a secure password on your phone because you chose not to. The rest of us use finger print sensors or facial recognition to make our devices as secure as can be. Your argument applies only to you and a handful of people. Th…

Biometric phone security is only secure until a judge or police officer compels you to unlock your phone; and legally you must comply, because your face or finger aren't speech. However, if you use a passphrase, (at least in the US and other countries with string freedom of speech laws) you can't be legally compelled to unlock the phone, as that would impinge on freedom of speech. I never use biometrics to unlock my…

On iOS you can disable face and Touch ID with Siri “who’s phone is this” or by tapping the power button.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#98

Post by jqpabc123 »

TurkishPoptart wrote: post #95
jqpabc123 wrote: post #49

Always, always create a backup. Or three. I carry a backup with me strapped to my wrist. It is a cheap digital watch with a strap modified to securely hold a microSD card with all my really important, must have data ---encrypted with Bitlocker. This data is as safe as I am. I leave a copy of this card in a fireproof safe at home. A trusted family member has the combination. A friend has the Bitlocker decrypt key. My…

can you share the strap design to hold the microSD? how do you decrypt it when accessing it? very cool!

Bitlocker is transparent drive encryption built into MS Windows.

Insert a microSD card into a USB port (using a card reader) and Windows will prompt for the decrypt key if encryption has been applied. Once the correct key is provided, the drive can be accessed just like any other.

As for the strap, the card holder is a 3-D printed extension inserted inline with it. I'll try to upload a photo someplace and post a link to it.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#99

Post by theonething »

capableweb wrote: post #3

Use your backup codes that you've downloaded and safe-kept somewhere (you did this right?). If not, I'm afraid you're out of luck. There are two possible outcomes from contacting support for a service, asking to regain control over a 2FA-protected account, both which sucks, but on different levels. 1. You write them, proving who you are, and they tell you to get lost unless you have the 2FA proper codes, or backup co…

I have Google Authenticator and Authy running on both my iPhone and my iPad (which always stays at home)

Is this a bad way to do backup?

Re: Ask HN: How do you start over with 2FA after losing your phone?

#100

Post by geraldhh »

ethicalsmacker wrote: post #70
geraldhh wrote: post #64

Earlier quoted context omitted.

> I personally symmetrically encrypt my ssh keys and send them to my wife every six months or so. curious, how do you store that key?

Memorized. If I don’t or can’t recall it then I’m dead or may as well be.

ah, so i assume your "symmetric key" for the ssh-key is a password?
Post reply on HN