If you have lost your phone, you will need to contact your authentication provider to disable 2FA on your account. Once you have regained access to your account, you will need to re-enable 2FA.
Ask HN: How do you start over with 2FA after losing your phone?
101–110 of 112 posts
Re: Ask HN: How do you start over with 2FA after losing your phone?
#102I right-click / "Save Image As..." on the image with the QR code, and store all the images in a directory so I can re-import them as needed.
Low-tech compared with all the other suggestions here, I should look into how to extract/store the actual seed values instead, etc... but it works for me and has done for years.
Re: Ask HN: How do you start over with 2FA after losing your phone?
#103Keep hard copies... Share an export from an app like Aegis
Google's doesn't have an export AFAIR. If rooted you might be able to import to Aegis.
Oh right, an iPhone. And you lost the phone? You're screwed
You can only try to to get the 2FA removed, but for AWS this process is hard, others might be OK... Or unreachable, like Google. Ive been through this, but luckily kept backups in another accounts, just had a hard time remembering the password under stress. My devices were stolen from my home.
Re: Ask HN: How do you start over with 2FA after losing your phone?
#104Not that this is of help to you now, but my own controversial take is, avoid any services that push 2FA. Especially if they do so aggressively. This includes things like switching from github to sourcehut for me (though MS+copilot didnt help either) For services where you cant avoid it (e.g. your company email), download a local OTP app, effectively converting back to 1FA, for each device you use to access that servi…
What is the inherent issue with 2FA? I see the point about phone-number - that is absolutely valid. But if you could I would like to have a few more details about categorizing 2FA as cancer in general?
Re: Ask HN: How do you start over with 2FA after losing your phone?
#105Earlier quoted context omitted.
Ah, did not knew that, just check it out. Thanks for the hint. Uh, if I select only one entry the QR code gets smaller in itself. So basically same problem still. facepalm :-D
> if I select only one entry the QR code gets smaller in itself Does it block you from taking a screenshot? Maybe you could screenshot it and then zoom in the gallery app.
Yes, it blocks on purpose to take screenshots.
Re: Ask HN: How do you start over with 2FA after losing your phone?
#106Earlier quoted context omitted.
Memorized. If I don’t or can’t recall it then I’m dead or may as well be.
ah, so i assume your "symmetric key" for the ssh-key is a password?
That's correct-- secure password encrypts the ssh keys. Those keys then access the server, which has my pass vault, gpg keys, two factor recovery codes, etc.
Re: Ask HN: How do you start over with 2FA after losing your phone?
#107Always, always create a backup. Or three. I carry a backup with me strapped to my wrist. It is a cheap digital watch with a strap modified to securely hold a microSD card with all my really important, must have data ---encrypted with Bitlocker. This data is as safe as I am. I leave a copy of this card in a fireproof safe at home. A trusted family member has the combination. A friend has the Bitlocker decrypt key. My…
can you share the strap design to hold the microSD? how do you decrypt it when accessing it? very cool!
Here is a link to a composite photo on shutterfly.
https://link.shutterfly.com/isWBFWNm0xb
This shows two views --- the normal outside and inside/back with a microSD card partially inserted. The card latches in place using the notch built into every microSD card.
I've toyed with the idea of selling this completely assembled as a "data watch" for say $30 as a practical geek toy --- but there probably isn't enough demand to justify the effort.
Re: Ask HN: How do you start over with 2FA after losing your phone?
#108I know it doesn’t help now, but next time use Authy instead of Google Authenticator. It can sync to multiple devices. I have it synced to my laptop so if I lose my phone, I still have Authy on my laptop with all 2FA.
Microsoft Authenticator also provides the same.
It does not do this on desktop
Re: Ask HN: How do you start over with 2FA after losing your phone?
#109Earlier quoted context omitted.
What? Where the 2FA codes come from isn't relevant, as long as the device (laptop, phone, desktop, hardware) is protected in some way or another (like password). Backup codes come from the service which is 2FA protected anyways, not from the 2FA authenticator itself. Edit: oh, reading your message again, are you referring to SMS-based 2FA? I assumed TOTP 2FA in this submission. If you mean SMS-based 2FA, then yeah I…
Nobody has a secure password on their phone, so your requirement fails. There is no way to get a secure password on a phone as one of the requirements of a phone is quick access, and no fast password is secure. (maybe finger prints, but I have found them unreliable and so I quit using them) If your phone based code system is also available on other accounts, and you can access those other accounts without the phone t…
Idk how secure this is, but my iPhone is protected with Face ID and a 16-character long password with a mix of upper and lower case letters, numbers and symbols.
The password itself was generated randomly and I managed to memorise it (it took a while).
Re: Ask HN: How do you start over with 2FA after losing your phone?
#110Backups: you MUST have a backup! One thing I do is avoid proprietary apps like Google Authenticator and make sure I store the TOTP key separately so I can reconstitute my TOTP codes in another app if necessary. Backups are kept on a backup handset, on my computer, and in an encrypted volume in the cloud at a minimum. What's a little harder to deal with are the services/providers that insist on SMS 2FA (and not to a V…
> One thing I do is avoid proprietary apps like Google Authenticator and make sure I store the TOTP key separately so I can reconstitute my TOTP codes in another app if necessary
I'm not sure what avoiding Google Authenticator has to do with that. You can store the keys separately for any TOTP app. That's kind of inherent in the way TOTP works.