Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: It is impossible to disable Google 2FA using backup codes

news.ycombinator.com

Post reply on HN
Print view View original

261–270 of 352 posts

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#261

Post by Radim »

joeframbach wrote: post #215
taftster wrote: post #141

Earlier quoted context omitted.

Maybe when Google was an exciting place to work and a darling of the internet, possibly somebody working there would consider going out of their way to help a user out and considered themselves empowered to do so. I get the feeling that anymore people just don't care. There might even be disincentives to report or try to address such issues. It's maybe just me, but it seems the excitement over the dotcom has subsided…

Anecdotally, my wife works for a pharmaceutical company and is mandated to report possible impacts that people report about a drug, even in casual conversation. People working under this mandate simply avoid these areas entirely. We avoid watching certain Instagram and Youtube personalities with certain conditions in the chance they might say something she has to report.

Is that for real? I'd love to hear more about this mandate.

Why would someone refuse to watch celebrity Youtube videos, in private with their husband, because of some mandated self-reporting by their pharma overlords?

I'm in awe at the level of corporate control and domestication implied.

On the face of it, your anecdote reminded me of that (apocryphal?) prank that natives played on early explorers: "Will he eat this disgusting food if we tell him it is our tradition? How far can we push him into abject nonsense before his common sense revolts?"

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#262

Post by casenmgreen »

I had much the same problem with AWS.

Their 2FA login was not working - my logins were rejected.

I think I needed to resync.

The resync pages were not working.

When 2FA breaks, for whatever reason, there is a form you use to let AWS know.

You cannot send a message - only a phone number. AWS will call you back.

Where I was at the time, a phone number was not available.

That was it. End of the road. 2FA not working, could not log in, the Support I could reach could not help. Support suggested "make new account", as of course they do what they can, which means offering options from within their power, and there was nothing they could do (except suggest a new account).

Fortunately, I had no servers running. I don't know what would have happened, if I had.

With email based accounts, the email used to make the account is the email used to recover the password, so making an account also proves the recovery mechanism.

With 2FA, this is not the case.

2FA is absolutely necessary for security, but flawed implementations are I would say much more of a risk than the security issues 2FA defends against.

I am very unlikely to be hacked - I am one in a billion - but if the 2FA mechanism is flawed, it is reasonably likely to affect me.

Large companies are totally unaware of end user experiences, so when for example 2FA recovery is broken, they have no idea this is occurring.

It is dangerous for end-users to rely on large companies to implement systems which can block end-user access to critical systems.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#263

Post by melvinmelih »

lexapro wrote: post #249
melvinmelih wrote: post #108

Many years ago, I lost my phone with Google Authenticator (which doesn't have a backup option like Authy does) and got locked out from AWS. The next day there was a production issue with our website. Long story short, our website was down for more than 2 weeks while I was trying to regain access to our AWS account. #2faneveragain

Your website was down for more than 2 weeks not because 2FA is badly designed, but because you bet everything on your phone not getting lost or damaged. And now you refuse to secure your accounts.

> And now you refuse to secure your accounts.

No, the big lesson for me is to have proper backups of credentials (like the other commenter mentioned) and ensuring multiple people have access to the prod environment. Don't just turn on 2FA without having these things in place.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#264

Post by jvanderbot »

SillyUsername wrote: post #206
jvanderbot wrote: post #84

Earlier quoted context omitted.

You can do this, or you can write down the secret (Click to get the text), and use oathtool to generate codes rather than google's auth. I keep all my 2fa secrets in pass for this reason. Never lose access again!

You can do this, or you can just start using Microsoft Authenticator which will sync your Authenticator codes to your Microsoft account for when you reinstall the app elsewhere.

this is also fine. I have a personal preference to never look at my phone while working, and I'm always in terminal anyway ...

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#265

Post by notpushkin »

hunter2_ wrote: post #192
crazygringo wrote: post #170

Earlier quoted context omitted.

Yeah... I do the same thing. 2FA secrets in my password vault. I KNOW it defeats the purpose. But honestly, where the heck else am I supposed to put them? I know from experience that printouts gets lost, and also that if someone were determined to hack me, the easiest route would be to break into my home and find the printouts. So I guess I'm technically supposed to subscribe to a second password manager and store ju…

> store 2FA secrets in a different place from their passwords is just not something normal people are ever going to do Normal people, in the sense of people who do what the interface says to do instead of layering anything else on top, are told 2FA means "something you know, and something you have." "Know" means it exists only in your mind; it is not stored elsewhere. "Have" means you cannot possibly produce it with…

I think using a password manager is already 2FA.

Something you have: a password database on your PC.

Something you know: your master password.

TOTP is a nice addon, but you can store it in the same password manager. It will still help with some attacks (e. g. if a hacker manages to MITM your traffic, they only get the password + one code, which is not sufficient to log in again).

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#266

Post by jve »

eigenvalue wrote: post #60
gravitronic wrote: post #29

Earlier quoted context omitted.

I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

You can extract plaintext secret keys from google authenticator app and store them in user friendly format/password manager

https://github.com/scito/extract_otp_secrets

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#267

Post by philjohn »

tmerse wrote: post #117
jvanderbot wrote: post #84

Earlier quoted context omitted.

You can do this, or you can write down the secret (Click to get the text), and use oathtool to generate codes rather than google's auth. I keep all my 2fa secrets in pass for this reason. Never lose access again!

But be careful. If you access the passwords and 2fa secrets via the same credentials you are back to one factor authentication if secret + pass store ever get compromised. Imho it's a different story if you use a separate gpg-key/secret to access the 2fa secrets (which should also only happen in emergency cases). This can easily be done with pass.

I enrol any TOTP codes into 3 Yubikey's, and also keep the private key physically printed out.

Although, for Google, I'm using FIDO.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#268

Post by notpushkin »

jvanderbot wrote: post #260
tmerse wrote: post #117

Earlier quoted context omitted.

But be careful. If you access the passwords and 2fa secrets via the same credentials you are back to one factor authentication if secret + pass store ever get compromised. Imho it's a different story if you use a separate gpg-key/secret to access the 2fa secrets (which should also only happen in emergency cases). This can easily be done with pass.

My laptop, which contains all this secret information, is way, way more secure than my phone. There's the boot decrypt password, login password, then gpg password. My phone has ... A pin. And besides, this is fine as an archived backup in case someone loses their phone. It just so happens it's faster for me to xsel the output of oathtool than it is to unlock my phone, open app, select account, and remember code, esp…

Android phones are encrypted by default, but for encryption, they use the same PIN as your lock screen. There's some command you could run to replace it with a strong password while keeping screen lock PIN simple, but it didn't work for me last time I tried.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#269

Post by kevin_thibedeau »

SillyUsername wrote: post #206
jvanderbot wrote: post #84

Earlier quoted context omitted.

You can do this, or you can write down the secret (Click to get the text), and use oathtool to generate codes rather than google's auth. I keep all my 2fa secrets in pass for this reason. Never lose access again!

You can do this, or you can just start using Microsoft Authenticator which will sync your Authenticator codes to your Microsoft account for when you reinstall the app elsewhere.

MS Authenticator breaks if you have to do a factory reset on the phone.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#270

Post by wallfacer77 »

nicoburns wrote: post #46

This is why I use SMS as my second factor for my Google account. Much harder to lose. It could be vulnerable to sim swapping attacks, but I consider Google locking me out of my own account a more likely threat (and frankly I'm probably not a high-profile enough target for anyone to bother with that, and in any case they'd still need my password).

This should be fine: Using your phone as SMS 2 factor authentication is a separate thing as assigning the phone as "your phone" in your Google account (which works as an account recovery too).

If you don't have your phone setup as "your phone" and they clone your SIM they can use your number to get 2FA codes potentially, yes, but they still need your password to log in. Supposedly they won't have that

Post reply on HN