Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: It is impossible to disable Google 2FA using backup codes

news.ycombinator.com

Post reply on HN
Print view View original

191–200 of 352 posts

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#191

Post by jandrese »

Spivak wrote: post #13
torstenvl wrote: post #6

I hate current popular implementations 2FA and similar IT fads for this exact reason. They are inherently insecure, and any security professional who pushes them without serious thought through all the failure modes should be blacklisted from the industry.

Competently administering 2FA essentially requires human intervention to handle the "I lost all my credentials" case because it will happen with probability 1 eventually. Workplaces can do this because you can call IT and have an already established identity based in the real world.

The problem with this is that we are talking about pseudo-anonymous signup for websites. They can't go back and verify the credentials you used to create the account because you didn't provide any. But if this is the case then the help desk is a major security vulnerability, since just anybody can claim to be you and take over your account. The help desk has little to no way to actually verify your identity.

At the very least if the helpdesk does reset your account, there should be a 48 hour lockout and a message sent to the account allowing the owner to dispute the change. Yes it is inconvenient in cases where the actual owner lost all of their login credentials, but this is hopefully rare.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#192

Post by hunter2_ »

crazygringo wrote: post #170
tmerse wrote: post #117

Earlier quoted context omitted.

But be careful. If you access the passwords and 2fa secrets via the same credentials you are back to one factor authentication if secret + pass store ever get compromised. Imho it's a different story if you use a separate gpg-key/secret to access the 2fa secrets (which should also only happen in emergency cases). This can easily be done with pass.

Yeah... I do the same thing. 2FA secrets in my password vault. I KNOW it defeats the purpose. But honestly, where the heck else am I supposed to put them? I know from experience that printouts gets lost, and also that if someone were determined to hack me, the easiest route would be to break into my home and find the printouts. So I guess I'm technically supposed to subscribe to a second password manager and store ju…

> store 2FA secrets in a different place from their passwords is just not something normal people are ever going to do

Normal people, in the sense of people who do what the interface says to do instead of layering anything else on top, are told 2FA means "something you know, and something you have."

"Know" means it exists only in your mind; it is not stored elsewhere. "Have" means you cannot possibly produce it with your mind; it's stored elsewhere.

When abiding by this concept, "storing 2FA secrets in a different place from their passwords" (the former in some electronic or printed format; the latter in one's mind) is simple. Things get complicated when people start storing both in some electronic or printed format, but that's not what any login interface tells people to do.

The neologism "passkey" (a string used in lieu of a password, but which is not memorable, and therefore is destined to be something you "have") will probably help to sort out this concept: there would be no confusion about the fact that combining a passkey with totp constitutes two "have" items, and therefore is 1FA until combined with something else (biometric, probably).

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#193

Post by rhn_mk1 »

eigenvalue wrote: post #60
gravitronic wrote: post #29

Earlier quoted context omitted.

I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

And this is how you turn a second factor into another first factor.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#194

Post by nogridbag »

Related: I recently bought some Yubikey Security Keys (U2F/FIDO2/WebAuthn only) and decided to update all websites I use with those keys. The problem is virtually no website supports them. I think out of the hundreds of accounts I have only Google, Cloudflare, and 1Password support them. But also the UX is a bit of a disaster:

https://blog.silverorange.com/web-authn-ux

I had an old set of YubiKeys which I used as a MFA option for LastPass. In comparison to WebAuthn, the process is dead simple. Input master password and LastPass prompts to touch yubikey. Dead simple with no scary dialogs. I have not seen any website offer an integration with Yubikeys like that. Is that only possible because LastPass was a Chrome extension? Or is it simply lack of demand?

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#196

Post by Merad »

londons_explore wrote: post #90
rhacker wrote: post #16

> What am I supposed to do in this situation? This. Support systems in the world post computers eating everything is basically HN posts.

Allowing customer service to bypass customer auth requirements is just weakening your system. There will always be a CS agent who is bribed, makes a mistake, etc. And besides, the agent following a flow chart has no better info to make the decision on than a computer. Instead the auth requirements should be sane from the start, well publicised, and make a good tradeoff between letting bad guys in vs locking the real…

> Allowing customer service to bypass customer auth requirements is just weakening your system. There will always be a CS agent who is bribed, makes a mistake, etc. And besides, the agent following a flow chart has no better info to make the decision on than a computer.

This is true, but OTOH there will _always_ be edge case scenarios that no one anticipates until they actually happen. Or maybe someone did anticipate, but they were drowned out by the other voices in the room saying "that can't/won't happen," so it wasn't included in the requirements. What happens when a customer encounters a problem that doesn't fit neatly into one of the user journeys that the product team planned out? Are they just shit out of luck?

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#197

Post by Nextgrid »

reaperducer wrote: post #128

I had a similar situation with Facebook. Set up 2FA with an app called Duo-somethingorother. Broke my phone. Trying to use Facebook with new phone requires 2FA. Duo-somethingorother app on the new phone won't authorize my Facebook login because the app on the new phone isn't linked to my Facebook account. Result: I'm locked out of Facebook Every year or so I follow Facebook's login authentication steps, including sen…

> I'm not in Europe, so I have no rights to my photos and nowhere to complain.

If it makes you feel any better, Facebook doesn't care about the law and Europeans don't have any more luck than you do when it comes to this: https://ruben.verborgh.org/facebook/

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#198

Post by oftenwrong »

renonce wrote: post #126

Maybe too late to give you any helpful advice, but setting up Advanced Protection may make sense. You need to buy at least two (preferably three) YubiKeys and the password plus any of these keys allow you to login to your account. Nothing more, nothing less. Costs a few bucks, but at least the auth flow is very clear. Another thing you can do is to wait for a week and see if anything changes. Having the session last…

One downside of Advanced Protection for Android users that intend on linking the account to their device is that you will not be able to install apps from "aftermarket" app stores, like F-Droid. You can still install apps with `adb install`, though.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#199

Post by princevegeta89 »

gravitronic wrote: post #29
andrewmcwatters wrote: post #26

Oh my god. 2-Step verification on your Google Account is actually less secure than not using it at all. I just posted about something similar maybe 3 months ago?[1] > I kid you not. Google's actual official answer to this is... create another account![1][2][3] > Edit: Now that I have your attention: > PSA: Go create "Backup codes" for your Google Account in your 2-Step Verification settings. > [1]: https://support.go…

I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.

Thank you for this. I will make extra backups of my 2fa seeds. I currently have all of them in my bitwarden vault which won't probably ever fail me but it's better to be extra safe

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#200

Post by [deleted] »

random2021 wrote: post #180
arriu wrote: post #124

Whenever one of these threads about Google (or Apple) come up, I am shocked at the lack of response from people working at those companies. It seems reasonable that this site would be where you'd find someone from a team that interacted with logic that OP is having trouble with. I'd expect to see something like a "hey, yeah, I know a guy on our team that might be able to get in touch with the team who maintains this.…

Any of these large companies are like governments. Assume you complain to a Chinese or US or European that your govt does this bad/crazy/illogical thing. how do they respond? Do you think if you tell an engineer from John Deere that they have unethical practices the are going to complain in the next meeting? Or a Volkswagen person that does care about pollution but will be quiet. They just look at pay checks. Any com…

[deleted]
Post reply on HN