Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: It is impossible to disable Google 2FA using backup codes

news.ycombinator.com

Post reply on HN
Print view View original

161–170 of 352 posts

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#161

Post by NikolaNovak »

arriu wrote: post #124

Whenever one of these threads about Google (or Apple) come up, I am shocked at the lack of response from people working at those companies. It seems reasonable that this site would be where you'd find someone from a team that interacted with logic that OP is having trouble with. I'd expect to see something like a "hey, yeah, I know a guy on our team that might be able to get in touch with the team who maintains this.…

I would be surprised if they were allowed to do so by their workplace policies, and clearly they don't feel it's worth the risk to stick their neck out. Not only is there limited win scenario for themselves or their company, there are multiple lose scenarios - there's likely NO response that everybody will be happy with, and some percentage of these scenarios end up with more than initially meets the eye.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#162

Post by browningstreet »

Groxx wrote: post #54
gravitronic wrote: post #25

Earlier quoted context omitted.

If you lose your U2F security key, are you sure you'll be able to remove it from your Google account? Because what I'm experiencing right now is that they support TOTP and you can't remove it if you lose it..

Specifically you need multiple registered keys, to prevent this current situation. But yeah, this is why I dislike 2FA. There are clear security benefits, but it comes with the extreme downside of "what you know is not sufficient". When it's e.g. a corporate-controlled account and your IT desk can just reset it to "password123!" to let you back in, it's quite a good trade-off. When it's your main email, i.e. your pri…

How does it work if you have 3 Gmail/Workspace accounts? Do you need multiple keys for each account?

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#163

Post by RulerOf »

purpleblue wrote: post #81

I lost a bunch of email addresses because they decided to start enforcing the use of security answers even when I had the correct password. Then I lost some more email accounts because I logged in from different locations (I moved) and they thought I was a fraud, even though I was able to confirm using the backup email address. I'm fairly concerned that eventually I'm going to lose all my email addresses due to these…

>due to these increasingly draconian requirements that are sprung upon us.

I'm all for improving authentication, but it's profoundly annoying when authentication requirements are not made clear before logging in.

For a user with a password manager, forcing a user to answer "security questions" will compromise UX at best, and reduce overall security at worst.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#164

Post by ozim »

eigenvalue wrote: post #60
gravitronic wrote: post #29

Earlier quoted context omitted.

I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

Well I have a backup phone - where I would scan 2FA code with 2 phones.

Now it is not that necessary because google authenticator allows transfer of data.

But when authenticator had no such option I was quite terrified and came up with idea to get another phone just as a backup and scanning 2FA code with 2 phones always for all websites. Of course backup one is always on my desk - but I don't have offsite backup for these. Problem is I don't want these TOTP tokens offsite really so it is a bit of a challange :) to come up with everything proof plan.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#165

Post by jandrese »

ironmagma wrote: post #43
gravitronic wrote: post #29

Earlier quoted context omitted.

I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.

Time to repeal 2FA. I can't believe it's required for SOC2 type 2 compliance.

This really isn't a problem with 2FA. It is a problem with Google not understanding the reason for backup codes. It's just plain old bad design on Google's part.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#166

Post by jakedata »

Do you have access to an Android device (or the gmail app on IOS)? If you can sign that device into your Google account with one backup code you may be able to get Google login prompts without explicitly authorizing that feature in the blocked account settings page. I know when I have set up crappy tablets with my credentials they automatically started showing prompts to approve logins from other devices. If nothing else it may save you from running out of backup codes.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#167

Post by loriverkutya »

nicoburns wrote: post #46

This is why I use SMS as my second factor for my Google account. Much harder to lose. It could be vulnerable to sim swapping attacks, but I consider Google locking me out of my own account a more likely threat (and frankly I'm probably not a high-profile enough target for anyone to bother with that, and in any case they'd still need my password).

Instead of SMS, get a pair of yubikey recommended by some other posters, so you are not depending on your mobile provider as they own the number and it is just "rented" to you.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#168

Post by lmz »

arriu wrote: post #124

Whenever one of these threads about Google (or Apple) come up, I am shocked at the lack of response from people working at those companies. It seems reasonable that this site would be where you'd find someone from a team that interacted with logic that OP is having trouble with. I'd expect to see something like a "hey, yeah, I know a guy on our team that might be able to get in touch with the team who maintains this.…

If a random employee can do that, a random employee can do that and I guess it's better for everyone if no employees can bypass user security based on a forum post.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#169

Post by phonon »

epicureanideal wrote: post #53
rhacker wrote: post #16

> What am I supposed to do in this situation? This. Support systems in the world post computers eating everything is basically HN posts.

Maybe the next million new jobs is just rebuilding a reasonable level of customer support at all tech companies, funded by modest usage fees. $5/mo, $50/yr, or $500 for lifetime guaranteed permanent access so no lockouts are possible, I would definitely pay for Gmail or an equivalent service. And there are people who I’m sure would pay much more. Another short term option: $500-1000 right now to get a couple hours of…

Buying Google One entitles you to general Google apps support.

https://one.google.com/about/support

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#170

Post by crazygringo »

tmerse wrote: post #117
jvanderbot wrote: post #84

Earlier quoted context omitted.

You can do this, or you can write down the secret (Click to get the text), and use oathtool to generate codes rather than google's auth. I keep all my 2fa secrets in pass for this reason. Never lose access again!

But be careful. If you access the passwords and 2fa secrets via the same credentials you are back to one factor authentication if secret + pass store ever get compromised. Imho it's a different story if you use a separate gpg-key/secret to access the 2fa secrets (which should also only happen in emergency cases). This can easily be done with pass.

Yeah... I do the same thing. 2FA secrets in my password vault.

I KNOW it defeats the purpose. But honestly, where the heck else am I supposed to put them? I know from experience that printouts gets lost, and also that if someone were determined to hack me, the easiest route would be to break into my home and find the printouts.

So I guess I'm technically supposed to subscribe to a second password manager and store just my 2FA secrets inside of that, with a different master password. Or, put the 2FA secrets inside their own encrypted file stored in my password manager, but once again with their own password that... I can't keep in my password manager. But the biggest problem with both of these is I'm going to forget the password. I never forget my password manager master password because I use it weekly. But asking me to remember a password I last used 3 years ago because that's when I set up 2FA? It's not gonna happen.

It all feels so absurd that the UX side of me just rebels. Expecting users to store 2FA secrets in a different place from their passwords that is also just as secure... is just not something normal people are ever going to do.

Post reply on HN