Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: It is impossible to disable Google 2FA using backup codes

news.ycombinator.com

Post reply on HN
Print view View original

221–230 of 352 posts

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#221

Post by hot_gril »

gonehome wrote: post #32
blibble wrote: post #20

Earlier quoted context omitted.

the point is to have a second factor which isn't really destroyed by having a printout of what you entered onto your phone somewhere secure (now if you store both in your password manager: that completely defeats the point)

It doesn’t. The threat model is someone gets your password, not somebody gets access to your password manager. If the latter is your threat model then yes having your 2F in there is worse, but really the former is the more common thing to protect against and the tradeoff of not having 2F in your 1Password and getting locked out because your phone breaks is worse than the risk of having it in there. It’s similar to th…

If you're using a password manager, you probably have one-time secure passwords, so the only probable way someone gets it is by stealing your password manager.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#223

Post by Eric_WVGG »

arikr wrote: post #195

Google's 2FA is an absolute embarrassment. Super annoying that Google hasn't yet done more to improve it. See also: https://news.ycombinator.com/item?id=33895836

I gave a big long speech on security to my company, mentioned that SMS 2FA was junk and to use authentication apps instead, then made 2FA mandatory on our Google accounts… only to find out that you can’t even enable good authentication without enabling SMS 2FA first.

Absolute madness.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#224

Post by cypherpunks01 »

Any possible way to upgrade to a paid account, personal or business, that would grant access to the proper level of support to fix this?

I realize it's paying the people holding the account hostage, just thinking of practical solutions to get in touch with the right support level who could assist.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#225

Post by shadowgovt »

gravitronic wrote: post #79
alxndr13 wrote: post #65

Earlier quoted context omitted.

Just tested it. - Private Browser Window - Log in using backup code - can change auth app without another login.

So weird, because I cannot! Maybe it's because I haven't used a 2FA code on this account in the past year? I typically stay logged out of my Google account and just have the email forwarded to another provider.

> Maybe it's because I haven't used a 2FA code on this account in the past year?

Oh dear. You're almost certainly off the critical path of integration and end-to-end testing and may have hit a legit bug.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#226

Post by masukomi »

ozim wrote: post #164
eigenvalue wrote: post #60

Earlier quoted context omitted.

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

Well I have a backup phone - where I would scan 2FA code with 2 phones. Now it is not that necessary because google authenticator allows transfer of data. But when authenticator had no such option I was quite terrified and came up with idea to get another phone just as a backup and scanning 2FA code with 2 phones always for all websites. Of course backup one is always on my desk - but I don't have offsite backup for…

i feel like I'm asking a dumb question but why not just use a password manager that syncs your stuff and handles 2FA like 1Password? Break the phone? no worries you've got the info on your desktop. House goes up in a fire, no worries, they've got it on the cloud and you can access from a friend's house / library / whatever.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#227

Post by tinfever »

phonon wrote: post #169
epicureanideal wrote: post #53

Earlier quoted context omitted.

Maybe the next million new jobs is just rebuilding a reasonable level of customer support at all tech companies, funded by modest usage fees. $5/mo, $50/yr, or $500 for lifetime guaranteed permanent access so no lockouts are possible, I would definitely pay for Gmail or an equivalent service. And there are people who I’m sure would pay much more. Another short term option: $500-1000 right now to get a couple hours of…

Buying Google One entitles you to general Google apps support. https://one.google.com/about/support

I have Google One and tried their support once or twice but wasn't impressed. I strongly doubt their ability to help with any somewhat technical question.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#228

Post by GordonS »

SillyUsername wrote: post #206
jvanderbot wrote: post #84

Earlier quoted context omitted.

You can do this, or you can write down the secret (Click to get the text), and use oathtool to generate codes rather than google's auth. I keep all my 2fa secrets in pass for this reason. Never lose access again!

You can do this, or you can just start using Microsoft Authenticator which will sync your Authenticator codes to your Microsoft account for when you reinstall the app elsewhere.

I just checked, and my MS Authenticator is backing up to... my Google account.

So, I thought I'd better change that... but it looks like you can't change your recovery account.

Why are 2FA apps so obtuse!

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#229

Post by lexapro »

halkony wrote: post #131
arriu wrote: post #124

Whenever one of these threads about Google (or Apple) come up, I am shocked at the lack of response from people working at those companies. It seems reasonable that this site would be where you'd find someone from a team that interacted with logic that OP is having trouble with. I'd expect to see something like a "hey, yeah, I know a guy on our team that might be able to get in touch with the team who maintains this.…

Developers at large corporations are strictly informed that they are not the public face of the company and can't do that. These aren't mom and pop developer shops.

They can't send a link to a colleague?

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#230

Post by throwaway4759 »

Don’t trust any apps to handle backup and syncing TOTP keys for you. Gliches happen.

I encrypt and back up all TOTP secret key, which are used to generate six digit codes, to my local offline password store (usb key and paper). In fact, I mostly used my laptop as the second factor because it is more convenient. My phone also has the TOTP key and in case it is lost, I can just regenerate the QR code.

Post reply on HN