Same thing happened to me. The backup paper 2FA codes I kept failed when my Pixel phone spontaneously bricked itself.
Tell HN: It is impossible to disable Google 2FA using backup codes
101–110 of 352 posts
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#102I hate current popular implementations 2FA and similar IT fads for this exact reason. They are inherently insecure, and any security professional who pushes them without serious thought through all the failure modes should be blacklisted from the industry.
This isn't a security flaw, this is incompetency. Google not allowing disabling or altering 2FA after resorting to a backup code is simply bad design. They could've done the same with any method of authentication. Using a password isn't even enough for Google any more these days, look at Gmail+IMAP. This is pure incompetency, not a flaw in 2FA. Whatever device this person is on has been flagged insecure enough to nee…
[deleted]
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#103“How’s our 2FA working out?”
“Fantastic. We haven’t heard from anyone with a complaint!”
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#104Get off Google so you dont have to deal with zero customer service:
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#105> What am I supposed to do in this situation? This. Support systems in the world post computers eating everything is basically HN posts.
That or embarrass the company publicly in front of your large twitter audience
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#106I hate current popular implementations 2FA and similar IT fads for this exact reason. They are inherently insecure, and any security professional who pushes them without serious thought through all the failure modes should be blacklisted from the industry.
Passwordless is going to make this even worse - there's no migration path (yet) from platform ecosystems to each other. I've not seen any serious progress on how to switch from Apple to Google, which doesn't involve doing things one by one, site by site.
And more to the point, a way of handling "I've lost my phone and had to buy a new cheap one" seems to be a potentially problematic edge case. Bootstrapping trust and authentication for end users without any physical token is hard, but seems necessary, especially for non technical end users, for whom password reset processes might even be the default route of access.
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#107Get off Google so you dont have to deal with zero customer service: https://github.com/tycrek/degoogle
I use fastmail almost entirely, this is a historical account. My wife just happened to share something to my Google docs leading me to log into this mess today
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#108Many years ago, I lost my phone with Google Authenticator (which doesn't have a backup option like Authy does) and got locked out from AWS. The next day there was a production issue with our website. Long story short, our website was down for more than 2 weeks while I was trying to regain access to our AWS account. #2faneveragain
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#109Earlier quoted context omitted.
High fees mean that most people even in places like the USA cannot afford it. Would be nice to have modest customer service options for everyone.
That’s expensive.
Won't somebody just think of Googles pocketbook. The only way they can stay afloat is telling people to go fuck themselves when Google messes something about their entire online identity up, clearly.
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#110> What am I supposed to do in this situation? This. Support systems in the world post computers eating everything is basically HN posts.
Maybe the next million new jobs is just rebuilding a reasonable level of customer support at all tech companies, funded by modest usage fees. $5/mo, $50/yr, or $500 for lifetime guaranteed permanent access so no lockouts are possible, I would definitely pay for Gmail or an equivalent service. And there are people who I’m sure would pay much more. Another short term option: $500-1000 right now to get a couple hours of…
> I would definitely pay for Gmail
You already can. It’s called Google Workspace and comes with support.