151–160 of 352 posts
I lost access to my Coinbase account a while back because I was using Authenticator on the iPhone and when I bought a new phone and set it up, my Authenticator codes did not transfer with the rest of my data. At that point I stopped using Authenticator. I hope that's still not an issue upgrading iPhones today.
Earlier quoted context omitted.
The QR that you mention, is just an encoding of an actual string key (edit: I'm reading now that it's called seed ). If possible, it is better to get the string directly, instead of its QR encoded counterpart. This is needed for example to store the TOTP in a device that has no camera. Or in your Bitwarden Pro account. Obviously you wouldn't be able to scan a QR with such an application, so the actual string is neede…
You can scan any QR code with the iPhone default camera app and get the string back that way. But yeah, all QR codes are just encoded strings.
Many years ago, I lost my phone with Google Authenticator (which doesn't have a backup option like Authy does) and got locked out from AWS. The next day there was a production issue with our website. Long story short, our website was down for more than 2 weeks while I was trying to regain access to our AWS account. #2faneveragain
Whenever one of these threads about Google (or Apple) come up, I am shocked at the lack of response from people working at those companies. It seems reasonable that this site would be where you'd find someone from a team that interacted with logic that OP is having trouble with. I'd expect to see something like a "hey, yeah, I know a guy on our team that might be able to get in touch with the team who maintains this.…
Is the only viable solution to have 2FA setup on multiple devices, with at least device in a "break glass in emergency" type of vault storage?
I dropped my main phone into the toilet a week ago, completely fried it. Moved the SIM card to my backup phone, and carried on like almost nothing happened. I then powered up my 10-year old Nexus 7 tablet, and duplicated all my 2FA codes to the tablet. When I get a new replacement phone, I will duplicate my 2FA codes again.
Earlier quoted context omitted.
But be careful. If you access the passwords and 2fa secrets via the same credentials you are back to one factor authentication if secret + pass store ever get compromised. Imho it's a different story if you use a separate gpg-key/secret to access the 2fa secrets (which should also only happen in emergency cases). This can easily be done with pass.
I'm sure all of this will make sense to grandma, too. (Gmail's main target is not devs, or even computer literate people. And owning a smart phone =! literate.)
Who is more likely to visit this page (and use tools like pass) is up for you to decide.
The point still stands. Storing passwords and 2fa secrets inside in the same box will weaken the 2 in 2fa.
(Gmail's main target is not devs, or even computer literate people. And owning a smart phone =! literate.)
Grandma can always print the 2fa seed or write down the alphanumeric value and store it not next to the sheet with her passwords – same principle (I think she won't use pass anyway as opposed to the person I was originally replying to which tells me they are most likely technically literate).
Earlier quoted context omitted.
The QR that you mention, is just an encoding of an actual string key (edit: I'm reading now that it's called seed ). If possible, it is better to get the string directly, instead of its QR encoded counterpart. This is needed for example to store the TOTP in a device that has no camera. Or in your Bitwarden Pro account. Obviously you wouldn't be able to scan a QR with such an application, so the actual string is neede…
You are correct about the QR code just representing a (fairly short) string, but applications can handle QR code just fine - 1password can read it directly from the screen.
I had this same issue just a few weeks ago. I recall being asked for my 2FA on a few separate occasions and could never disable it or switch to a new authenticator app even though I had backup codes. However, I tried it a 3rd time one day and for whatever reason I was able to do it. If I recall correctly, it suddenly gave me the option to instead authenticate with my password again, which I did. Good luck!