Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: It is impossible to disable Google 2FA using backup codes

news.ycombinator.com

Post reply on HN
Print view View original

301–310 of 352 posts

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#301

Post by MilaM »

melvinmelih wrote: post #108

Many years ago, I lost my phone with Google Authenticator (which doesn't have a backup option like Authy does) and got locked out from AWS. The next day there was a production issue with our website. Long story short, our website was down for more than 2 weeks while I was trying to regain access to our AWS account. #2faneveragain

What is also very frustrating with AWS is that you can only set up one 2FA method. You have to choose between TOTP OR security key and can't have both at the same time. I wanted to add a yubikey to my account a couple of weeks ago, but had to switch back to TOTP. A lost Yubikey means you're looked out, TOTP secrets can be backed up at least.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#302

Post by kobalsky »

renonce wrote: post #126

Maybe too late to give you any helpful advice, but setting up Advanced Protection may make sense. You need to buy at least two (preferably three) YubiKeys and the password plus any of these keys allow you to login to your account. Nothing more, nothing less. Costs a few bucks, but at least the auth flow is very clear. Another thing you can do is to wait for a week and see if anything changes. Having the session last…

I did this but I'm concerned about the recovery process.

Google says at https://landing.google.com/advancedprotection/faq that: >>> If you lose your key and are still signed in on one of your devices, visit account.google.com to add or replace a key. Otherwise, submit a request to recover your account. Google may take a few days to verify it’s you and restore your access.

I've assumed the risk of temporarily losing access to my account if I happen to lose all my hardware keys and devices for some reason while they confirm my identity, but from these posts I think that Google may not be of help at all and I could permanently lose access.

I'm starting to wonder if I shouldn't go back to regular 2FA since I can safely backup those codes.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#303

Post by aborsy »

It’s worth mentioning that, although Google Authenticator allows one to export two factor authentication codes, it’s only in the format of a QR code that can be scanned by another phone. It doesn’t provide the option of exporting 2FA codes in an encrypted file that one could store in a safe place.

So it seems that the backup is intended that the user purchases a second phone!

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#304

Post by b112 »

lexapro wrote: post #217
b112 wrote: post #139

Earlier quoted context omitted.

I'm sure all of this will make sense to grandma, too. (Gmail's main target is not devs, or even computer literate people. And owning a smart phone =! literate.)

Grandmas usually don't set up two-factor authentication in the first place.

Google will leave grandmas no choice.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#305

Post by hot_gril »

hot_gril wrote: post #221
gonehome wrote: post #32

Earlier quoted context omitted.

It doesn’t. The threat model is someone gets your password, not somebody gets access to your password manager. If the latter is your threat model then yes having your 2F in there is worse, but really the former is the more common thing to protect against and the tradeoff of not having 2F in your 1Password and getting locked out because your phone breaks is worse than the risk of having it in there. It’s similar to th…

If you're using a password manager, you probably have one-time secure passwords, so the only probable way someone gets it is by stealing your password manager.

Er, not one-time use passwords, I mean the password is only used on one website.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#306

Post by gonehome »

hot_gril wrote: post #221
gonehome wrote: post #32

Earlier quoted context omitted.

It doesn’t. The threat model is someone gets your password, not somebody gets access to your password manager. If the latter is your threat model then yes having your 2F in there is worse, but really the former is the more common thing to protect against and the tradeoff of not having 2F in your 1Password and getting locked out because your phone breaks is worse than the risk of having it in there. It’s similar to th…

If you're using a password manager, you probably have one-time secure passwords, so the only probable way someone gets it is by stealing your password manager.

This isn't accurate - they don't get access to multiple stuff.

- Site0 leaks your password because they store it poorly.

- It's just one password, but it's still leaked.

- You have 2F in 1Password so even though it's picked up in an account list the attacker can't login.

- Weeks later you learn there was a breach.

This is the common case for most accounts and breaches. Though the sites most likely to leak are also ones unlikely to have 2F so it's not perfect.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#307

Post by jve »

judge2020 wrote: post #272
jve wrote: post #266

Earlier quoted context omitted.

You can extract plaintext secret keys from google authenticator app and store them in user friendly format/password manager https://github.com/scito/extract_otp_secrets

If you're using Authy: https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d... (be sure to read the comments if you see "appManager is not defined")

Warning: Samsung browser on Galaxy S10 hangs when opening this URL.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#308

Post by tpmx »

tpmx wrote: post #121
TacticalCoder wrote: post #66

Earlier quoted context omitted.

And for authenticators that do not allow to export the secret, while your authenticator is not lost yet, add another authenticator: and during registration, save the QR code.

There is no option to add another authenticator app at https://myaccount.google.com/security (desktop UI). I think the only feasible option is to first remove Google Authenticator and then re-enable it. Seriously, Google? Might be micro, but this is not a sign of a healthy company on an upwards trajectory.

It's time to de-google. Seriously. Now it's from a self-preservation POV, not a political POV.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#309

Post by vel0city »

rndmize wrote: post #127

I was recently trying to log into Slack on a new computer. It required a login and password, and then emailed a 2FA code to my login email. Then it _also_ wanted 2FA code from my mobile app, which it seems wasn't configured correctly on my new phone. The experience left me with multiple questions - what needed to be transferred from my 2FA app on my old phone to my new phone that didn't make it? Why wasn't the email…

> Why wasn't the email code good enough (as that is literally already two factors?)

Can a password reset be done with control of the email? If so, email isn't really a second factor.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#310

Post by [deleted] »

wingmanjd wrote: post #122
lcnPylGDnU4H9OF wrote: post #93

Earlier quoted context omitted.

There may be a plugin for it but the KeePass clients I've used don't support this by default. Generally, it would be best to look for the string (and keep both the string and the image secret!).

KeepassXC lets you store the TOTP seed value associated with an entry by right-clicking on that key and selecting "Setting up TOTP". Also, other TOTP generators like Authy and Aegis let you backup your tokens to restore to another device.

[deleted]
Post reply on HN