Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: It is impossible to disable Google 2FA using backup codes

news.ycombinator.com

Post reply on HN
Print view View original

251–260 of 352 posts

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#251

Post by httpz »

nicoburns wrote: post #46

This is why I use SMS as my second factor for my Google account. Much harder to lose. It could be vulnerable to sim swapping attacks, but I consider Google locking me out of my own account a more likely threat (and frankly I'm probably not a high-profile enough target for anyone to bother with that, and in any case they'd still need my password).

Instead of Google Authenticator, I use Twilio Authy. It syncs the 2FA code across my devices. I keep a backup device at home.

Sure, it's not the most secure way but I trust this over carriers securing my number.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#252

Post by hairofadog »

I'm trying to push adoption of 1Password in my workplace, and one of the things that drives me crazy about Google's sign-in process is that they obfuscate the 2FA functionality behind two confusingly-named links.

First they present 2FA via the Google Mobile app, and you have to click "Try another way", which makes it feel like something has already gone wrong.

Then they give you the option to the Google App again, to get an SMS message, to use a backup code, or to use "Google Authenticator".

So my instructions to a would-be 1Password user are: Sign in with your email address and password, click "Try another way", and then click "Use Google Authenticator", but don't actually use Google Authenticator; use 1Password.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#253

Post by Dylan16807 »

Groxx wrote: post #54
gravitronic wrote: post #25

Earlier quoted context omitted.

If you lose your U2F security key, are you sure you'll be able to remove it from your Google account? Because what I'm experiencing right now is that they support TOTP and you can't remove it if you lose it..

Specifically you need multiple registered keys, to prevent this current situation. But yeah, this is why I dislike 2FA. There are clear security benefits, but it comes with the extreme downside of "what you know is not sufficient". When it's e.g. a corporate-controlled account and your IT desk can just reset it to "password123!" to let you back in, it's quite a good trade-off. When it's your main email, i.e. your pri…

> But yeah, this is why I dislike 2FA. There are clear security benefits, but it comes with the extreme downside of "what you know is not sufficient".

But that's not even the problem here. OP has the "what you have". Just because the secondary authentication device is made of paper doesn't mean it's any less valid. But google is rejecting it and demanding the lost device.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#254

Post by tempestn »

masukomi wrote: post #226
ozim wrote: post #164

Earlier quoted context omitted.

Well I have a backup phone - where I would scan 2FA code with 2 phones. Now it is not that necessary because google authenticator allows transfer of data. But when authenticator had no such option I was quite terrified and came up with idea to get another phone just as a backup and scanning 2FA code with 2 phones always for all websites. Of course backup one is always on my desk - but I don't have offsite backup for…

i feel like I'm asking a dumb question but why not just use a password manager that syncs your stuff and handles 2FA like 1Password? Break the phone? no worries you've got the info on your desktop. House goes up in a fire, no worries, they've got it on the cloud and you can access from a friend's house / library / whatever.

You can't actually access your 1pw vault from wherever if you don't have an existing authenticated device or a copy of your secret key. That's intended to provide added security in case your master password is compromised. So to guard against the house burning down situation you need to either keep a printout of the secret key somewhere else (friend's house, bank box, etc.) or save it somewhere (secure) online where you can get it without using 1pw.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#256

Post by [deleted] »

jvanderbot wrote: post #84
eigenvalue wrote: post #60

Earlier quoted context omitted.

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

You can do this, or you can write down the secret (Click to get the text), and use oathtool to generate codes rather than google's auth. I keep all my 2fa secrets in pass for this reason. Never lose access again!

[deleted]

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#257

Post by tjoff »

eigenvalue wrote: post #60
gravitronic wrote: post #29

Earlier quoted context omitted.

I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

This assumes you are using TOTP.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#258

Post by sjf »

arduinomancer wrote: post #210
loriverkutya wrote: post #167

Earlier quoted context omitted.

Instead of SMS, get a pair of yubikey recommended by some other posters, so you are not depending on your mobile provider as they own the number and it is just "rented" to you.

How does that work? Do you have to carry around a Yubikey/Dongle everywhere with your phone?

I have a yubikey on my keyring. It's superior to sms 2fa in everyway. Its almost impossible to damage a yubikey- phones can easily be broken or stolen. You can have multiple keys linked to your account- Google only let's you have one phone. Yubikey can't be sim swapped. Never needs to be charged or have cell reception, no problems with sites not accepting international phone numbers.

The only downside is that Google is the only site I used that supports it.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#259

Post by dec0dedab0de »

loriverkutya wrote: post #167
nicoburns wrote: post #46

This is why I use SMS as my second factor for my Google account. Much harder to lose. It could be vulnerable to sim swapping attacks, but I consider Google locking me out of my own account a more likely threat (and frankly I'm probably not a high-profile enough target for anyone to bother with that, and in any case they'd still need my password).

Instead of SMS, get a pair of yubikey recommended by some other posters, so you are not depending on your mobile provider as they own the number and it is just "rented" to you.

...so you are not depending on your mobile provider as they own the number and it is just "rented" to you.

In the US, porting wireless numbers has been mandated by the FCC for almost 20 years. I'm feeling my age, as I remember being excited during the process and when it finally happened.

https://www.fcc.gov/general/wireless-local-number-portabilit...

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#260

Post by jvanderbot »

tmerse wrote: post #117
jvanderbot wrote: post #84

Earlier quoted context omitted.

You can do this, or you can write down the secret (Click to get the text), and use oathtool to generate codes rather than google's auth. I keep all my 2fa secrets in pass for this reason. Never lose access again!

But be careful. If you access the passwords and 2fa secrets via the same credentials you are back to one factor authentication if secret + pass store ever get compromised. Imho it's a different story if you use a separate gpg-key/secret to access the 2fa secrets (which should also only happen in emergency cases). This can easily be done with pass.

My laptop, which contains all this secret information, is way, way more secure than my phone. There's the boot decrypt password, login password, then gpg password. My phone has ... A pin.

And besides, this is fine as an archived backup in case someone loses their phone. It just so happens it's faster for me to xsel the output of oathtool than it is to unlock my phone, open app, select account, and remember code, esp because I live in the terminal anyway.

Post reply on HN