Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: It is impossible to disable Google 2FA using backup codes

news.ycombinator.com

Post reply on HN
Print view View original

201–210 of 352 posts

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#201

Post by arriu »

halkony wrote: post #131
arriu wrote: post #124

Whenever one of these threads about Google (or Apple) come up, I am shocked at the lack of response from people working at those companies. It seems reasonable that this site would be where you'd find someone from a team that interacted with logic that OP is having trouble with. I'd expect to see something like a "hey, yeah, I know a guy on our team that might be able to get in touch with the team who maintains this.…

Developers at large corporations are strictly informed that they are not the public face of the company and can't do that. These aren't mom and pop developer shops.

I agree to some extent but large companies do staff roles that have public outreach as part of their job description. Suggesting that no one is able to say "there is an internal ticket for this" is not the full answer.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#202

Post by rhussmann »

crazygringo wrote: post #170
tmerse wrote: post #117

Earlier quoted context omitted.

But be careful. If you access the passwords and 2fa secrets via the same credentials you are back to one factor authentication if secret + pass store ever get compromised. Imho it's a different story if you use a separate gpg-key/secret to access the 2fa secrets (which should also only happen in emergency cases). This can easily be done with pass.

Yeah... I do the same thing. 2FA secrets in my password vault. I KNOW it defeats the purpose. But honestly, where the heck else am I supposed to put them? I know from experience that printouts gets lost, and also that if someone were determined to hack me, the easiest route would be to break into my home and find the printouts. So I guess I'm technically supposed to subscribe to a second password manager and store ju…

It's misleading to say that storing your passwords and 2FA secrets in the same place defeats the purpose. There are several vectors here, right?

Enabling 2FA on a site (regardless of how or where the 2nd factor is stored) means if a malicious party were to obtain your plaintext password, they still wouldn't be able to access your account. So, outside of the entire discussion of password managers and secrets, 2FA does require a second factor.

Keeping your 2nd factor in the password vault does make the vault a much higher-value target. But it doesn't diminish the fact that if only your plaintext password is compromised (for example through a leak or re-use) the account is still protected until the point the 2nd factor is compromised.

Security is a spectrum, and often at odds with convenience. While demonstrating that something is provably secure is important, I feel we often fall victim to the nirvana fallacy when discussing the practical everyday use of these things.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#203

Post by danuker »

My advice is only actionable for others, not OP.

You should have backups on places other than the phone.

I warmly recommend andOTP for managing your TOTPs. It's open source and available on F-Droid.

https://f-droid.org/en/packages/org.shadowice.flocke.andotp/

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#205

Post by munk-a »

phonon wrote: post #169
epicureanideal wrote: post #53

Earlier quoted context omitted.

Maybe the next million new jobs is just rebuilding a reasonable level of customer support at all tech companies, funded by modest usage fees. $5/mo, $50/yr, or $500 for lifetime guaranteed permanent access so no lockouts are possible, I would definitely pay for Gmail or an equivalent service. And there are people who I’m sure would pay much more. Another short term option: $500-1000 right now to get a couple hours of…

Buying Google One entitles you to general Google apps support. https://one.google.com/about/support

My comprehension of the actual costs of the infrastructure required to run those services leads me to believe that Google One is essentially insanely overpriced. Perhaps it's due to high service needed customers self-selecting for the service or it's just price gouging - but the pricing for that is well above what such limited cloud storage offerings normally cost.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#206

Post by SillyUsername »

jvanderbot wrote: post #84
eigenvalue wrote: post #60

Earlier quoted context omitted.

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

You can do this, or you can write down the secret (Click to get the text), and use oathtool to generate codes rather than google's auth. I keep all my 2fa secrets in pass for this reason. Never lose access again!

You can do this, or you can just start using Microsoft Authenticator which will sync your Authenticator codes to your Microsoft account for when you reinstall the app elsewhere.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#208

Post by Nextgrid »

nogridbag wrote: post #194

Related: I recently bought some Yubikey Security Keys (U2F/FIDO2/WebAuthn only) and decided to update all websites I use with those keys. The problem is virtually no website supports them. I think out of the hundreds of accounts I have only Google, Cloudflare, and 1Password support them. But also the UX is a bit of a disaster: https://blog.silverorange.com/web-authn-ux I had an old set of YubiKeys which I used as a M…

The problem with these 2FA systems is that they require access to the 2FA device during enrollment which makes it very inconvenient/impossible to maintain a backup device in off-site secure storage as you'd need access to it every time you create a new account.

There needs to be a new 2FA standard which only needs the public key of the authentication instrument during enrollment - that way the actual instrument doesn't need to be accessed when creating new accounts and can be kept in secure storage, only accessed in an actual disaster situation.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#209

Post by gzer0 »

ozim wrote: post #164
eigenvalue wrote: post #60

Earlier quoted context omitted.

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

Well I have a backup phone - where I would scan 2FA code with 2 phones. Now it is not that necessary because google authenticator allows transfer of data. But when authenticator had no such option I was quite terrified and came up with idea to get another phone just as a backup and scanning 2FA code with 2 phones always for all websites. Of course backup one is always on my desk - but I don't have offsite backup for…

And this has now just encouraged me to buy a Pixel 6A running GrapheneOS to have as a backup at all times for my important google accounts

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#210

Post by arduinomancer »

loriverkutya wrote: post #167
nicoburns wrote: post #46

This is why I use SMS as my second factor for my Google account. Much harder to lose. It could be vulnerable to sim swapping attacks, but I consider Google locking me out of my own account a more likely threat (and frankly I'm probably not a high-profile enough target for anyone to bother with that, and in any case they'd still need my password).

Instead of SMS, get a pair of yubikey recommended by some other posters, so you are not depending on your mobile provider as they own the number and it is just "rented" to you.

How does that work? Do you have to carry around a Yubikey/Dongle everywhere with your phone?
Post reply on HN