Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you start over with 2FA after losing your phone?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 112 posts

Re: Ask HN: How do you start over with 2FA after losing your phone?

#21

Post by bluGill »

josteink wrote: post #8

When you enable 2FA you are on pretty much every service asked to download recovery-codes, and save them somewhere safe. Did you do that, and if not, why not? Also: Didn't you backup the 2FA codes somewhere else where you can "sync" them in? I use Bitwarden Authenticator for 2FA (part of Bitwarden Pro) and it syncs my 2FA codes to all devices where I log on to Bitwarden. That way I avoid a single point of failure. Co…

Where do you download those codes that is safe and secure? Everything I can think of, I can also think of a counter that means that mode is likely to fail. I'm a professional in the computer industry, so i'm more aware of possible failure modes than most people, but I also am aware of safe storage modes that most people don't have.

The recovery codes as implemented are not useful backups for most people. Telling people to use them is the wrong answer.

Sadly I know the above, but I don't have a better solution. It is a hard problem.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#22

Post by Aldipower »

lordnacho wrote: post #18

You can back up your 2FA codes to another phone, at least Google Authenticator lets you do this. An old phone is the easiest, most convenient way to do this since it has a camera that you can use to scan the code on your main phone. If you don't have the backup codes or the one-time codes, you're going to have a problem and you'll need to contact the services to somehow let you in or take off 2FA. Depending on what t…

BTW this process is broken with small display. I have a very tiny Android phone and to backup the codes I need to scan an QR code on this small display, which isn't working out. The resolution is too small. And there is no other way to backup Google Authenticator I am aware of. So be careful in smaller display, you probably cannot backup Goggle Authenticator.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#24

Post by dncornholio »

nigamanth wrote: post #5

This same thing happened to me with Discord once, I just wrote to them and filed a complaint saying my account got "hacked" and that the hacker changed the 2fa mobile number. With adequate proof and justification I think you should be able to get back your accounts, that is if your service does allow you to get back your account. One tip is to have multiple phones for 2fa and then just not using the other phone, if y…

Why did you decide to lie in your complaint?

Re: Ask HN: How do you start over with 2FA after losing your phone?

#25

Post by phphphphp »

bluGill wrote: post #21
josteink wrote: post #8

When you enable 2FA you are on pretty much every service asked to download recovery-codes, and save them somewhere safe. Did you do that, and if not, why not? Also: Didn't you backup the 2FA codes somewhere else where you can "sync" them in? I use Bitwarden Authenticator for 2FA (part of Bitwarden Pro) and it syncs my 2FA codes to all devices where I log on to Bitwarden. That way I avoid a single point of failure. Co…

Where do you download those codes that is safe and secure? Everything I can think of, I can also think of a counter that means that mode is likely to fail. I'm a professional in the computer industry, so i'm more aware of possible failure modes than most people, but I also am aware of safe storage modes that most people don't have. The recovery codes as implemented are not useful backups for most people. Telling peop…

Security is layered. A backup code is only useful with the password, and your password is only useful with a second factor. You can be fairly liberal with storing your backup codes: make a couple of copies, keep them in secure places (one at home, one in your office). I agree that backup codes aren’t perfect but they’re pretty robust.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#27

Post by vulcan01 »

bluGill wrote: post #21
josteink wrote: post #8

When you enable 2FA you are on pretty much every service asked to download recovery-codes, and save them somewhere safe. Did you do that, and if not, why not? Also: Didn't you backup the 2FA codes somewhere else where you can "sync" them in? I use Bitwarden Authenticator for 2FA (part of Bitwarden Pro) and it syncs my 2FA codes to all devices where I log on to Bitwarden. That way I avoid a single point of failure. Co…

Where do you download those codes that is safe and secure? Everything I can think of, I can also think of a counter that means that mode is likely to fail. I'm a professional in the computer industry, so i'm more aware of possible failure modes than most people, but I also am aware of safe storage modes that most people don't have. The recovery codes as implemented are not useful backups for most people. Telling peop…

Download, print, and store them in a safe or safe deposit box. It's not like people lose their phone often.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#28

Post by rat9988 »

capableweb wrote: post #19
bluGill wrote: post #15

Earlier quoted context omitted.

This is why phone based 2fa is not secure and not recommended. Sure it is easy, but it isn't secure in important ways

What? Where the 2FA codes come from isn't relevant, as long as the device (laptop, phone, desktop, hardware) is protected in some way or another (like password). Backup codes come from the service which is 2FA protected anyways, not from the 2FA authenticator itself. Edit: oh, reading your message again, are you referring to SMS-based 2FA? I assumed TOTP 2FA in this submission. If you mean SMS-based 2FA, then yeah I…

I'm pretty sure he talks about totp too.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#29

Post by owurkan »

Hopefully you have recovery codes for all these accounts. With that said, I don't like to rely on these recovery codes bc of some horror stories. Alternatively when setting up 2FA, you can for example: - use Authy bc it syncs tokens in the cloud and so you can recover your 2FA tokens on a new phone based on your phone nbr. I used to do that but have stopped bc Twilio (owner of Authy) is slowly retiring the product. - Keep a copy of each token when you set up 2FA. I keep an encrypted disk image with a list of my 2FA tokens. Yes, it weakens a little bit the security. But I sleep well bc I won't lock myself out in case of trouble. It's a trade-off I embrace.

Re: Ask HN: How do you start over with 2FA after losing your phone?

#30

Post by can16358p »

Happens all the time when I get a new phone because for some reason Auhenticator (MS) never transfers the authentication codes while setting up new iPhone (just why?).

Providing any services that I don't have backup codes with identity documents solve the problem. Never had issue with any service but it's annoying.

Post reply on HN