Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: It is impossible to disable Google 2FA using backup codes

news.ycombinator.com

Post reply on HN
Print view View original

271–280 of 352 posts

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#271

Post by notpushkin »

j1elo wrote: post #74
eigenvalue wrote: post #60

Earlier quoted context omitted.

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

The QR that you mention, is just an encoding of an actual string key (edit: I'm reading now that it's called seed ). If possible, it is better to get the string directly, instead of its QR encoded counterpart. This is needed for example to store the TOTP in a device that has no camera. Or in your Bitwarden Pro account. Obviously you wouldn't be able to scan a QR with such an application, so the actual string is neede…

Linux:

    xclip -sel clip -t image/png -o | zbarimg -
macOS:

    pngpaste - | zbarimg -

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#272

Post by judge2020 »

jve wrote: post #266
eigenvalue wrote: post #60

Earlier quoted context omitted.

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

You can extract plaintext secret keys from google authenticator app and store them in user friendly format/password manager https://github.com/scito/extract_otp_secrets

If you're using Authy: https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d... (be sure to read the comments if you see "appManager is not defined")

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#273

Post by my123 »

GordonS wrote: post #228
SillyUsername wrote: post #206

Earlier quoted context omitted.

You can do this, or you can just start using Microsoft Authenticator which will sync your Authenticator codes to your Microsoft account for when you reinstall the app elsewhere.

I just checked, and my MS Authenticator is backing up to... my Google account. So, I thought I'd better change that... but it looks like you can't change your recovery account. Why are 2FA apps so obtuse !

on iOS, MS Authenticator backups to iCloud. No way to retain the codes on an iOS->android migration (or the opposite).

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#274

Post by sh4rks »

rndmize wrote: post #127

I was recently trying to log into Slack on a new computer. It required a login and password, and then emailed a 2FA code to my login email. Then it _also_ wanted 2FA code from my mobile app, which it seems wasn't configured correctly on my new phone. The experience left me with multiple questions - what needed to be transferred from my 2FA app on my old phone to my new phone that didn't make it? Why wasn't the email…

> I've largely stuck with strong passwords for most of my accounts

The problem is, it's virtually impossible for the average human to remember their password if they have a unique, strong password for every site.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#275

Post by ploxiln »

gravitronic wrote: post #35
random2021 wrote: post #27

I just tested this. You should not disable 2FA. - Just click on the Authenticator app - Change Authenticator app - https://ibb.co/dPCMpdN Just works.

Hey, thank you so much for trying to help me. On what page do you see the Authenticator app listed? I suspect it's on the "Two Factor Auth" page. My problem is that I cannot even load that page. I click on "Security" in the menu, and it's when I click on "Two factor auth" to do any 2fa-related task, that's when I'm forced to log in and provide a 2fa code (which I do not have)

There's probably a vague/inconsistent (possibly "AI") threat-score / heuristic. I've heard of extra security requirements being imposed for like 30 days or so when you haven't accessed for a long time (or on a new machine?) and it's just ironic how they currently put you in a catch-22

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#276

Post by glmdev »

eigenvalue wrote: post #60
gravitronic wrote: post #29

Earlier quoted context omitted.

I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

I use VaultWarden to store my 2FA info which (aside from being very handy) replicates the codes offline on each device I sync my vault to.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#278

Post by Ikatza »

This is exactly my current situation, exacerbated by the fact that I cannot contact support as I am a user of legacy Gsuite.

To get support I would need to upgrade. To upgrade I need to enter my authenticator code. To enter my authenticator code I need to contact support...

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#280

Post by arriu »

phendrenad2 wrote: post #245
arriu wrote: post #201

Earlier quoted context omitted.

I agree to some extent but large companies do staff roles that have public outreach as part of their job description. Suggesting that no one is able to say "there is an internal ticket for this" is not the full answer.

Really? I've never seen anyone at Google or Apple who's in a "staff role with public outreach as part of their job". I don't think any big tech companies have those.

They do, and Google does.

Job descriptions are usually something like: "As a Technical Evangelist, you will be the face of the platform and often the first contact our customers have with us, both online and in person."

https://en.wikipedia.org/wiki/Technology_evangelist

Post reply on HN