Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: It is impossible to disable Google 2FA using backup codes

news.ycombinator.com

Post reply on HN
Print view View original

241–250 of 352 posts

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#241

Post by hocuspocus »

loriverkutya wrote: post #167
nicoburns wrote: post #46

This is why I use SMS as my second factor for my Google account. Much harder to lose. It could be vulnerable to sim swapping attacks, but I consider Google locking me out of my own account a more likely threat (and frankly I'm probably not a high-profile enough target for anyone to bother with that, and in any case they'd still need my password).

Instead of SMS, get a pair of yubikey recommended by some other posters, so you are not depending on your mobile provider as they own the number and it is just "rented" to you.

And if you have an Android phone you don't even need a pair of hardware keys, one is enough as backup, just use your phone as the main key: https://www.youtube.com/watch?v=Nhz4YLay0zc

I think you can also do that with an iPhone and the Google Smart Lock app.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#243

Post by 3np »

ozim wrote: post #164
eigenvalue wrote: post #60

Earlier quoted context omitted.

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

Well I have a backup phone - where I would scan 2FA code with 2 phones. Now it is not that necessary because google authenticator allows transfer of data. But when authenticator had no such option I was quite terrified and came up with idea to get another phone just as a backup and scanning 2FA code with 2 phones always for all websites. Of course backup one is always on my desk - but I don't have offsite backup for…

There are a lot of options, including free software and no-cloud alternatives, to get backups without doing that manually in such a cumbersome or fearful way your are now.

For example:

> "Password Store" ('pass' compatible) for Android also supports TOTP to tokens and Gpg encryption.

> With Syncthing, 'gopass' and 'Android Password Store', I have a fully open source, very easy to reason about fully in my control, password and totp storage, accessible on all my devices. All of which can only be accessed with my Yubikey that I keep in my pocket and my GPG PIN.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#244

Post by ok_dad »

arduinomancer wrote: post #210
loriverkutya wrote: post #167

Earlier quoted context omitted.

Instead of SMS, get a pair of yubikey recommended by some other posters, so you are not depending on your mobile provider as they own the number and it is just "rented" to you.

How does that work? Do you have to carry around a Yubikey/Dongle everywhere with your phone?

I keep one on my keychain in my pocket and one at home in a fireproof box, plus a backup one that I haven't even opened next to the backup so if I lose the keychain one I have another ready to go as my "new backup".

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#245

Post by phendrenad2 »

arriu wrote: post #201
halkony wrote: post #131

Earlier quoted context omitted.

Developers at large corporations are strictly informed that they are not the public face of the company and can't do that. These aren't mom and pop developer shops.

I agree to some extent but large companies do staff roles that have public outreach as part of their job description. Suggesting that no one is able to say "there is an internal ticket for this" is not the full answer.

Really? I've never seen anyone at Google or Apple who's in a "staff role with public outreach as part of their job". I don't think any big tech companies have those.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#246

Post by vel0city »

gravitronic wrote: post #148
londons_explore wrote: post #90

Earlier quoted context omitted.

Allowing customer service to bypass customer auth requirements is just weakening your system. There will always be a CS agent who is bribed, makes a mistake, etc. And besides, the agent following a flow chart has no better info to make the decision on than a computer. Instead the auth requirements should be sane from the start, well publicised, and make a good tradeoff between letting bad guys in vs locking the real…

In this particular case I feel like it's a bug that backup codes are not treated as secure as 2fa codes, and that I need explicitly a 2fa code to disable 2fa is just broken (in my specific case)

Right? Backup codes should be considered the most secure overrides for the other resources. What's the point of them being "backup" codes if you'll need something other than the backup for a break-glass event?

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#247

Post by ironmagma »

jay-barronville wrote: post #80
ironmagma wrote: post #43

Earlier quoted context omitted.

Time to repeal 2FA. I can't believe it's required for SOC2 type 2 compliance.

2FA/MFA isn’t the problem. Google is just a pain to deal with when their products don’t work as expected. On one hand, security-wise, it’s good that they tend to design their algorithms to err on the side of being restrictive, but on the other hand, they have no legit support, so if you or their algorithms mess up and you’re locked out of your account, you’re basically on your own. For a company so many of us rely on…

Nobody should be forced into this terrible scheme if even Google can’t get it working. It’s a case of “this idea isn’t bad, people just implement it wrong”. If nobody can implement it right, it’s not right. Complexity kills.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#248

Post by hunter2_ »

rhussmann wrote: post #202
crazygringo wrote: post #170

Earlier quoted context omitted.

Yeah... I do the same thing. 2FA secrets in my password vault. I KNOW it defeats the purpose. But honestly, where the heck else am I supposed to put them? I know from experience that printouts gets lost, and also that if someone were determined to hack me, the easiest route would be to break into my home and find the printouts. So I guess I'm technically supposed to subscribe to a second password manager and store ju…

It's misleading to say that storing your passwords and 2FA secrets in the same place defeats the purpose. There are several vectors here, right? Enabling 2FA on a site (regardless of how or where the 2nd factor is stored) means if a malicious party were to obtain your plaintext password, they still wouldn't be able to access your account. So, outside of the entire discussion of password managers and secrets, 2FA does…

Off topic: remarkable that you've made your first comment from a near-decade-old account!

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#249

Post by lexapro »

melvinmelih wrote: post #108

Many years ago, I lost my phone with Google Authenticator (which doesn't have a backup option like Authy does) and got locked out from AWS. The next day there was a production issue with our website. Long story short, our website was down for more than 2 weeks while I was trying to regain access to our AWS account. #2faneveragain

Your website was down for more than 2 weeks not because 2FA is badly designed, but because you bet everything on your phone not getting lost or damaged. And now you refuse to secure your accounts.
Post reply on HN