Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: It is impossible to disable Google 2FA using backup codes

news.ycombinator.com

Post reply on HN
Print view View original

291–300 of 352 posts

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#291

Post by htrp »

arriu wrote: post #280
phendrenad2 wrote: post #245

Earlier quoted context omitted.

Really? I've never seen anyone at Google or Apple who's in a "staff role with public outreach as part of their job". I don't think any big tech companies have those.

They do, and Google does. Job descriptions are usually something like: "As a Technical Evangelist, you will be the face of the platform and often the first contact our customers have with us, both online and in person." https://en.wikipedia.org/wiki/Technology_evangelist

Do tech evangelist roles really have the power to send things back to the product teams? They always seemed more like platform adoption/marketing people.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#293

Post by mcherm »

arriu wrote: post #124

Whenever one of these threads about Google (or Apple) come up, I am shocked at the lack of response from people working at those companies. It seems reasonable that this site would be where you'd find someone from a team that interacted with logic that OP is having trouble with. I'd expect to see something like a "hey, yeah, I know a guy on our team that might be able to get in touch with the team who maintains this.…

> I'm hoping OP got a private message.

I'm not. I have the same problem -- or I will if I ever lose my 2 factor identification keys, which are held by Authy NOT by myself. I always assumed that my one-time-codes (which I have carefully secured and protected) would be usable to regain control over my account. If that's not the case, then I want Google to fix it for EVERYONE.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#294

Post by snowwrestler »

phonon wrote: post #169
epicureanideal wrote: post #53

Earlier quoted context omitted.

Maybe the next million new jobs is just rebuilding a reasonable level of customer support at all tech companies, funded by modest usage fees. $5/mo, $50/yr, or $500 for lifetime guaranteed permanent access so no lockouts are possible, I would definitely pay for Gmail or an equivalent service. And there are people who I’m sure would pay much more. Another short term option: $500-1000 right now to get a couple hours of…

Buying Google One entitles you to general Google apps support. https://one.google.com/about/support

Does this really grant access to tech support for weird access issues like the OP?

Because if so, it’s cheap insurance at $20/year.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#295

Post by tempestn »

httpz wrote: post #251
nicoburns wrote: post #46

This is why I use SMS as my second factor for my Google account. Much harder to lose. It could be vulnerable to sim swapping attacks, but I consider Google locking me out of my own account a more likely threat (and frankly I'm probably not a high-profile enough target for anyone to bother with that, and in any case they'd still need my password).

Instead of Google Authenticator, I use Twilio Authy. It syncs the 2FA code across my devices. I keep a backup device at home. Sure, it's not the most secure way but I trust this over carriers securing my number.

Me too. Although this thread is making me wonder if I'd be screwed if I somehow lost access to both of my authenticated devices. (The 'house burns down' scenario.)

Edit: looks like you can fall back to SMS (along with backups password) to add a new device.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#296

Post by rhussmann »

hunter2_ wrote: post #248
rhussmann wrote: post #202

Earlier quoted context omitted.

It's misleading to say that storing your passwords and 2FA secrets in the same place defeats the purpose. There are several vectors here, right? Enabling 2FA on a site (regardless of how or where the 2nd factor is stored) means if a malicious party were to obtain your plaintext password, they still wouldn't be able to access your account. So, outside of the entire discussion of password managers and secrets, 2FA does…

Off topic: remarkable that you've made your first comment from a near-decade-old account!

Long-time lurker, first-time caller.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#297

Post by johncessna »

lexapro wrote: post #229
halkony wrote: post #131

Earlier quoted context omitted.

Developers at large corporations are strictly informed that they are not the public face of the company and can't do that. These aren't mom and pop developer shops.

They can't send a link to a colleague?

These places are large complex organizations. Event at small places it's difficult to find the right person the feedback would go to. That also assumes that the person who takes in feedback can actually change anything.

My guess is that they want to implement the feature but the security burden is so high that it's not worth it. When everyone's ${stereotypical_computer_illiterate_user_of_choice} starts using MFA and losing their 2FA solutions, it may be worth tackling, but until then, I imagine the number of impacted users is relatively low.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#298

Post by ChrisArchitect »

gravitronic wrote: post #79
alxndr13 wrote: post #65

Earlier quoted context omitted.

Just tested it. - Private Browser Window - Log in using backup code - can change auth app without another login.

So weird, because I cannot! Maybe it's because I haven't used a 2FA code on this account in the past year? I typically stay logged out of my Google account and just have the email forwarded to another provider.

Errr... so now the story comes out that this is more of a weirder case than everyday use.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#299

Post by jvanderbot »

jvanderbot wrote: post #84
eigenvalue wrote: post #60

Earlier quoted context omitted.

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

You can do this, or you can write down the secret (Click to get the text), and use oathtool to generate codes rather than google's auth. I keep all my 2fa secrets in pass for this reason. Never lose access again!

for the curious:

function 2fa(){

          local sec=$(pass show $1.secret)

          local code=$(oathtool -b --totp "$sec")

          echo $code | xsel -ib

          echo "Copied $code"
}

then call it as `2fa `, and make sure you store each 's secret as `pass insert .secret -e`.

refs: https://www.cyberciti.biz/faq/use-oathtool-linux-command-lin...

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#300

Post by pieter_mj »

httpz wrote: post #251
nicoburns wrote: post #46

This is why I use SMS as my second factor for my Google account. Much harder to lose. It could be vulnerable to sim swapping attacks, but I consider Google locking me out of my own account a more likely threat (and frankly I'm probably not a high-profile enough target for anyone to bother with that, and in any case they'd still need my password).

Instead of Google Authenticator, I use Twilio Authy. It syncs the 2FA code across my devices. I keep a backup device at home. Sure, it's not the most secure way but I trust this over carriers securing my number.

Don't use Twilio Authy. From https://raw.githubusercontent.com/blues-lab/totp-app-analysi... : "the Twilio Authy app and Zoho OneAuth app each store backups on their own servers. This means that any user of Twilio Authy or Zoho OneAuth who enables cloud backups is unknowingly sending those companies the names of the websites/services they use and the usernames for their accounts on those platforms."

And

"By default, each of Twilio Authy, Yandex.Key, and Salesforce Authenticator also relied solely on SMS OTP to authenticate users during recovery, but did encrypt TOTP backups using a key derived from a password before uploading them to the cloud. To compromise the backup, an attacker who hijacks the phone number will still need to conduct an offline attack to guess the backup password.

Post reply on HN