Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: It is impossible to disable Google 2FA using backup codes

news.ycombinator.com

Post reply on HN
Print view View original

141–150 of 352 posts

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#141

Post by taftster »

arriu wrote: post #124

Whenever one of these threads about Google (or Apple) come up, I am shocked at the lack of response from people working at those companies. It seems reasonable that this site would be where you'd find someone from a team that interacted with logic that OP is having trouble with. I'd expect to see something like a "hey, yeah, I know a guy on our team that might be able to get in touch with the team who maintains this.…

Maybe when Google was an exciting place to work and a darling of the internet, possibly somebody working there would consider going out of their way to help a user out and considered themselves empowered to do so.

I get the feeling that anymore people just don't care. There might even be disincentives to report or try to address such issues. It's maybe just me, but it seems the excitement over the dotcom has subsided and we're all just in a technical slump right now. Corporate takeover of the internet has taken hold.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#142

Post by torstenvl »

g_p wrote: post #106
torstenvl wrote: post #6

I hate current popular implementations 2FA and similar IT fads for this exact reason. They are inherently insecure, and any security professional who pushes them without serious thought through all the failure modes should be blacklisted from the industry.

Passwordless is going to make this even worse - there's no migration path (yet) from platform ecosystems to each other. I've not seen any serious progress on how to switch from Apple to Google, which doesn't involve doing things one by one, site by site. And more to the point, a way of handling "I've lost my phone and had to buy a new cheap one" seems to be a potentially problematic edge case. Bootstrapping trust and…

2FA is any two of what you know, what you have, or who you are.

It would be so easy to have a Google Android/iOS app that lets you take a photo of a credit card matching a payment method from the Play Store or one of Google's paid services. That proves something you have in addition to your password.

Though, TBH, Amazon is probably in the best position to solve this problem. They have payment methods and they have physical presence everywhere. Companies like Google or whomever could hook into an Amazon API to verify identity with a one-time recovery code.

How do you get the recovery code? You show up at Whole Foods or Kohls or eventually even to an Amazon Hub Locker and prove your identity with a photo ID card. You're then provided a recovery code linked to one of your full legal name, an e-mail you've already had registered with your Amazon account, a phone number you've already had registered with your Amazon account, or a credit card number you've already had registered with your Amazon account.

A service that knows one of those things about you can then be recovered by submitting the key and selecting the link modality. (Keys submitted with the wrong link modality should be invalidated, obviously.)

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#144

Post by AlexanderTheGr8 »

eigenvalue wrote: post #60
gravitronic wrote: post #29

Earlier quoted context omitted.

I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

Wait, they have the authority to block your google auth app? Last I checked, the app is not connected to your google account. And the app's functionality is open source (TOTP). So how does enforcement work?

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#145

Post by eigenvalue »

j1elo wrote: post #74
eigenvalue wrote: post #60

Earlier quoted context omitted.

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

The QR that you mention, is just an encoding of an actual string key (edit: I'm reading now that it's called seed ). If possible, it is better to get the string directly, instead of its QR encoded counterpart. This is needed for example to store the TOTP in a device that has no camera. Or in your Bitwarden Pro account. Obviously you wouldn't be able to scan a QR with such an application, so the actual string is neede…

You can scan any QR code with the iPhone default camera app and get the string back that way. But yeah, all QR codes are just encoded strings.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#146

Post by tmerse »

eigenvalue wrote: post #60
gravitronic wrote: post #29

Earlier quoted context omitted.

I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

This article helped me to understand how totp works and how it can be implemented [1]

[1]: https://digitalbunker.dev/how-do-time-based-one-time-passwor...

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#147

Post by yieldcrv »

happytoexplain wrote: post #56
yieldcrv wrote: post #30

Earlier quoted context omitted.

Really? At what point do we blame the victim because this is so obvious to me. I keep the TOTP and only sometimes keep the backup codes I avoid the issue created from losing my phone, because the next device can generate codes immediately by importing or scanning the TOTP I also don’t call it “2 factor” I just call it “one time passcode”

Nothing is "obvious" in tech any more, because there is simply too much. Two "tech savvy" people will often each have things they think is "obvious" that the other isn't familiar with. And this isn't even a good example of something that is "obvious" to some people, because Google makes it very, very clear that saving the QR code is NOT a backup option. It is labeled only as a mechanism to transfer to a new phone, so…

all TOTP is the same

it doesn't matter what Google says is normal

is this really people's only experience with TOTP delivered via QR codes?

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#148

Post by gravitronic »

londons_explore wrote: post #90
rhacker wrote: post #16

> What am I supposed to do in this situation? This. Support systems in the world post computers eating everything is basically HN posts.

Allowing customer service to bypass customer auth requirements is just weakening your system. There will always be a CS agent who is bribed, makes a mistake, etc. And besides, the agent following a flow chart has no better info to make the decision on than a computer. Instead the auth requirements should be sane from the start, well publicised, and make a good tradeoff between letting bad guys in vs locking the real…

In this particular case I feel like it's a bug that backup codes are not treated as secure as 2fa codes, and that I need explicitly a 2fa code to disable 2fa is just broken (in my specific case)

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#149

Post by freedomben »

jeroenhd wrote: post #91
gravitronic wrote: post #29

Earlier quoted context omitted.

I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.

I remember Google not letting me log in with my TOTP code when it insisted on me clicking a prompt I hadn't received. Only after two timeouts did it add the option to use a TOTP code. If I recall correctly, I had to let the thing fail and then click "let me try another way" or something similar. This leads me to believe that maybe Google hides certain options by default. However, I also think that Google keeps track…

Yep it absolutely ratchets up "suspicion" on your account, and failed attempts will quickly get your account in some sort of state where you're locked out. It's absolutely maddening.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#150

Post by fl0id »

tppiotrowski wrote: post #129

I lost access to my Coinbase account a while back because I was using Authenticator on the iPhone and when I bought a new phone and set it up, my Authenticator codes did not transfer with the rest of my data. At that point I stopped using Authenticator. I hope that's still not an issue upgrading iPhones today.

This is by design with the app. There are other authenticator apps like authy that save/sync 2FA.
Post reply on HN