Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: It is impossible to disable Google 2FA using backup codes

news.ycombinator.com

Post reply on HN
Print view View original

211–220 of 352 posts

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#211

Post by bee_rider »

munk-a wrote: post #89
epicureanideal wrote: post #53

Earlier quoted context omitted.

Maybe the next million new jobs is just rebuilding a reasonable level of customer support at all tech companies, funded by modest usage fees. $5/mo, $50/yr, or $500 for lifetime guaranteed permanent access so no lockouts are possible, I would definitely pay for Gmail or an equivalent service. And there are people who I’m sure would pay much more. Another short term option: $500-1000 right now to get a couple hours of…

Maybe, alternatively, this is just an indicator that ad-based "free" services aren't really realistically economical and we should all be paying google 50c/mo for our email addresses. Also, I think it's unreasonable to accept "support just sucks now" as a norm - consumer protections exist to shield us from BS like this and the US has been far too lax in flexing those muscles lately.

Gmail is the ultimate root of way too many services for me, but I don’t really see any alternative. For example there are lots of nice paid services out there that look great, but eventually I’m going to forget to pay, or the company will go under, or whatever.

IMO we need USPS email addresses for the same reason we have mailboxes. The ability to be contacted digitally is just table stakes nowadays.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#212

Post by gravitronic »

freedomben wrote: post #149
jeroenhd wrote: post #91

Earlier quoted context omitted.

I remember Google not letting me log in with my TOTP code when it insisted on me clicking a prompt I hadn't received. Only after two timeouts did it add the option to use a TOTP code. If I recall correctly, I had to let the thing fail and then click "let me try another way" or something similar. This leads me to believe that maybe Google hides certain options by default. However, I also think that Google keeps track…

Yep it absolutely ratchets up "suspicion" on your account, and failed attempts will quickly get your account in some sort of state where you're locked out. It's absolutely maddening.

Definitely - and I think now that I've gone to that 2FA page and let it time out (since I only have backup codes), I think it's racheted up suspicion higher as these login attempts count as "an attacker has the password but not the 2FA code!"

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#213

Post by phendrenad2 »

arriu wrote: post #124

Whenever one of these threads about Google (or Apple) come up, I am shocked at the lack of response from people working at those companies. It seems reasonable that this site would be where you'd find someone from a team that interacted with logic that OP is having trouble with. I'd expect to see something like a "hey, yeah, I know a guy on our team that might be able to get in touch with the team who maintains this.…

[flagged]

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#215

Post by joeframbach »

taftster wrote: post #141
arriu wrote: post #124

Whenever one of these threads about Google (or Apple) come up, I am shocked at the lack of response from people working at those companies. It seems reasonable that this site would be where you'd find someone from a team that interacted with logic that OP is having trouble with. I'd expect to see something like a "hey, yeah, I know a guy on our team that might be able to get in touch with the team who maintains this.…

Maybe when Google was an exciting place to work and a darling of the internet, possibly somebody working there would consider going out of their way to help a user out and considered themselves empowered to do so. I get the feeling that anymore people just don't care. There might even be disincentives to report or try to address such issues. It's maybe just me, but it seems the excitement over the dotcom has subsided…

Anecdotally, my wife works for a pharmaceutical company and is mandated to report possible impacts that people report about a drug, even in casual conversation. People working under this mandate simply avoid these areas entirely. We avoid watching certain Instagram and Youtube personalities with certain conditions in the chance they might say something she has to report.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#216

Post by simcop2387 »

ozim wrote: post #164
eigenvalue wrote: post #60

Earlier quoted context omitted.

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

Well I have a backup phone - where I would scan 2FA code with 2 phones. Now it is not that necessary because google authenticator allows transfer of data. But when authenticator had no such option I was quite terrified and came up with idea to get another phone just as a backup and scanning 2FA code with 2 phones always for all websites. Of course backup one is always on my desk - but I don't have offsite backup for…

I store them in a keepassxc database for syncing and alsomprotect it with a yubikey. Lets me back it up to other places while also allowing them to stay secure. Most other password manager solutions should also be able to be used to keep them secure and backed up.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#217

Post by lexapro »

b112 wrote: post #139
tmerse wrote: post #117

Earlier quoted context omitted.

But be careful. If you access the passwords and 2fa secrets via the same credentials you are back to one factor authentication if secret + pass store ever get compromised. Imho it's a different story if you use a separate gpg-key/secret to access the 2fa secrets (which should also only happen in emergency cases). This can easily be done with pass.

I'm sure all of this will make sense to grandma, too. (Gmail's main target is not devs, or even computer literate people. And owning a smart phone =! literate.)

Grandmas usually don't set up two-factor authentication in the first place.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#218

Post by hot_gril »

jetpackjoe wrote: post #17
ReptileMan wrote: post #11

And that is why I utilize the "very secure" flow of also keep the original qr codes ... in a keepass vault, but still. Most of the security is theater. On the other hand I think that every tech savvy person should at least try to keep the TOTP seeds.

Doesn't keeping the seed remove the whole point of one time passwords? If an attacker steals at TOTP, its only good for (I think) less than a minute. If they steal the seed, its good forever.

Yes. A lot of the common solutions to making TOTP more user-friendly defeat it. You might as well just use single-factor auth with a strong random password stored in your manager, which is what I do.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#219

Post by epicureanideal »

bee_rider wrote: post #211
munk-a wrote: post #89

Earlier quoted context omitted.

Maybe, alternatively, this is just an indicator that ad-based "free" services aren't really realistically economical and we should all be paying google 50c/mo for our email addresses. Also, I think it's unreasonable to accept "support just sucks now" as a norm - consumer protections exist to shield us from BS like this and the US has been far too lax in flexing those muscles lately.

Gmail is the ultimate root of way too many services for me, but I don’t really see any alternative. For example there are lots of nice paid services out there that look great, but eventually I’m going to forget to pay, or the company will go under, or whatever. IMO we need USPS email addresses for the same reason we have mailboxes. The ability to be contacted digitally is just table stakes nowadays.

> For example there are lots of nice paid services out there that look great, but eventually I’m going to forget to pay, or the company will go under, or whatever.

Right, that's why I think there should be an option for a $500 permanent email address, or maybe $50 one-time payment that doesn't guarantee permanent access but does guarantee that the email address will sit there as long as it takes for you to be able to pay to restore your account, without being deleted or reassigned.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#220

Post by Nextgrid »

londons_explore wrote: post #90
rhacker wrote: post #16

> What am I supposed to do in this situation? This. Support systems in the world post computers eating everything is basically HN posts.

Allowing customer service to bypass customer auth requirements is just weakening your system. There will always be a CS agent who is bribed, makes a mistake, etc. And besides, the agent following a flow chart has no better info to make the decision on than a computer. Instead the auth requirements should be sane from the start, well publicised, and make a good tradeoff between letting bad guys in vs locking the real…

> Allowing customer service to bypass customer auth requirements is just weakening your system

I disagree, in regulated industries such as banking this is a solved problem. A combination of onshore staff, good career prospects, pay and working conditions and audit logs means I haven't heard stories of bank insiders breaching into accounts to steal. I'm sure it happened but nowhere near as frequently as fraudulent SIM swaps for example.

TLDR: don't outsource your customer service to the third world and you're already 80% of the way there.

Post reply on HN