Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: It is impossible to disable Google 2FA using backup codes

news.ycombinator.com

Post reply on HN
Print view View original

181–190 of 352 posts

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#181

Post by deepfriedrice »

lmz wrote: post #168
arriu wrote: post #124

Whenever one of these threads about Google (or Apple) come up, I am shocked at the lack of response from people working at those companies. It seems reasonable that this site would be where you'd find someone from a team that interacted with logic that OP is having trouble with. I'd expect to see something like a "hey, yeah, I know a guy on our team that might be able to get in touch with the team who maintains this.…

If a random employee can do that, a random employee can do that and I guess it's better for everyone if no employees can bypass user security based on a forum post.

The suggestion isn't to bypass, but to surface a missing use case to the relevant folks

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#182

Post by dec0dedab0de »

There are going to be way too many people affected by this within the next few years as warranties expire and it's not worth repairing phones. There is no way they won't come up with a better solution as they see engagement drop across all of their properties.

That said, this is probably a business oppurtunity for reverse engineering and recovering the 2fa code from broken phones. I suspect there is a key stored locally, and tied to the device id. If you could get a setup together for reliably extracting/cloning that info, people locked out of essential services would be willing to pay.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#183

Post by fullstop »

browningstreet wrote: post #162
Groxx wrote: post #54

Earlier quoted context omitted.

Specifically you need multiple registered keys, to prevent this current situation. But yeah, this is why I dislike 2FA. There are clear security benefits, but it comes with the extreme downside of "what you know is not sufficient". When it's e.g. a corporate-controlled account and your IT desk can just reset it to "password123!" to let you back in, it's quite a good trade-off. When it's your main email, i.e. your pri…

How does it work if you have 3 Gmail/Workspace accounts? Do you need multiple keys for each account?

The keys can be used on any number of accounts.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#185

Post by jchw »

jeffbee wrote: post #125
jchw wrote: post #50

Earlier quoted context omitted.

Weird, this used to work... I guess they changed it at some point.

It's a mistake to believe that every user will uniformly see the same things on the same pages. Google's account abuse system will offer different options to different users based on how suspicious their behavior appears to be.

Which abuse system? I worked there and I wasn't aware of myaccount changing behavior based on how "suspicious" the session is. In fact, I didn't know sessions had such an attribute, assuming this is true. Granted, I didn't work on the account dashboard, but still.

I'd assume it's more likely the behavior really is changing, specifically because in the past, the user's login session was treated as a valid factor alongside the user's password for disabling 2FA, which was criticized as being less secure than expected. However, I'm not sure they intended for the fix to that to not allow backup codes...

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#186

Post by jandrese »

jchw wrote: post #50
gravitronic wrote: post #38

Earlier quoted context omitted.

I cannot access the Two Factor authentication page at all - it is when attempting to access that page that I'm forced to log in again and provide a 2FA code.

Weird, this used to work... I guess they changed it at some point.

You might be surprised just how subtly corporations will break accounts that they are suspicious of. There is a whole world of anti-bot measures that come across to humans as just slightly odd behavior or weird bugs. It can be weirdly capricious as well. For example, I recently was having trouble logging into a website and was having to do a ton of SMS re-authentications. When logging into the website using Chrome I was given SMS messages with a 15 minute timeout. When logging in with Firefox the same SMS verification message only had a 5 minute timeout. Several times I would go through the authentication flow and then the service would seem to just crash, loading only a blank page, but I'm pretty sure that was just an anti-bot measure kicking in. I eventually only got it to work normally by switching over to my Phone's hotspot. The website was just hating on my IP address for no disclosed reason.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#187

Post by boomer918 »

Thank you for posting and reminding us that multiple 2FA methods are a good backup plan with Google.

I just added:

- SMS - Authenticator app (Authy, of course) - Generated backup codes

That in addition to my Pixel 4, and maybe 3-4 authorized devices (laptop, ubuntu desktop, windows desktop), I feel a bit better about this.

Sorry for your trouble though, I hope you figure it out.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#188

Post by bityard »

Spivak wrote: post #18
ReptileMan wrote: post #11

And that is why I utilize the "very secure" flow of also keep the original qr codes ... in a keepass vault, but still. Most of the security is theater. On the other hand I think that every tech savvy person should at least try to keep the TOTP seeds.

In Bitwarden you can just store the key itself and it'll generate the codes for you, right next to your password, so convenient!

I expect the "so convenient" is sarcastic, but yes it is more convenient and also more secure.

It helps to consider the threat model. 2FA is protection against (at least) several things: brute-force password guessing, a stolen password, a hijacked email account, etc. Since password vaults like bitwarden are designed to be uncrackable on their own, the only plausible way for an attacker to compromise one is to gain control of the user's device, at which point they don't really need access to the vault because they don't just have the keys to the kingdom, they have the kingdom.

Any technology that allows users to add security to their assets while still being convenient enough to use daily, leads to greater security overall.

Personally I think we're about a decade or two overdue to switch away from passwords (as currently implemented) and towards public/private keys managed by the browser or an extension, but I don't see that happening anytime soon as it's 100% certain that if it's ever tried, each FAANG will just try to push their own system, break the whole effort with fragmentation, and everyone will still just be using passwords in frustration for the next 100 years.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#189

Post by Nextgrid »

babyshake wrote: post #130

Is the only viable solution to have 2FA setup on multiple devices, with at least device in a "break glass in emergency" type of vault storage?

This is extremely inconvenient as it means if you're signing up for an account you need to have access to all those devices, even the one that's supposed to be in vault storage (potentially a bank vault, etc).

TOTP just isn't a good protocol for this. Last-resort 2FA should be based on public key crypto where your last-resort device has a public/private key and you can enroll it as a recovery token by providing the (static) public key - this means you do not need active access to the device to enroll it.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#190

Post by Nextgrid »

omarhaneef wrote: post #88

Microsoft Authenticator syncs across all instances so you just have to log in to a new Authenticator on the new phone and the codes are there. (I think it uses OneDrive). I am sure that is less secure than a local only copy but this may be least bad of all alternatives. You might even give a trusted person a login and have it on their phone so you can use theirs in an emergency.

How do you login to the authenticator itself? If it's MS-account-based doesn't that itself requires 2FA and you thus have a chicken & egg problem?
Post reply on HN