Google's 2FA is terrible for Google workspace when you add a phone number. In that case, you are up to the whim of the country to allow your SMS to be received (serious consideration in some parts of the world). When a phone is added, you will not be able to use a device for 2fa, but always defaults to SMS!
Tell HN: It is impossible to disable Google 2FA using backup codes
321–330 of 352 posts
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#322Earlier quoted context omitted.
I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.
The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).
Best bet is to save those QR codes (or text codes) in a different vault. I use passwords in LastPass and QR codes in KeePass.
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#323Earlier quoted context omitted.
I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.
The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).
[deleted]
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#324Side-comment: is there a type of shadowban with HN where my posts do not make it into the frontpage, even 2 or 3 or more pages deep? I've seen this with a few of my posts recently where they appear in the 'new' and 'show' or 'ask' tabs, but not the frontpage.. even 300 posts deep while similarly aged and upvoted posts are on second page. edit: now it's on the frontpage! Guess it just had to hit a vote threshold.
Among other weighting factors, HN-as-customer-support-of-last-resort posts have recently started being downweighted.
See: https://news.ycombinator.com/item?id=34444459>
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#325Earlier quoted context omitted.
Specifically you need multiple registered keys, to prevent this current situation. But yeah, this is why I dislike 2FA. There are clear security benefits, but it comes with the extreme downside of "what you know is not sufficient". When it's e.g. a corporate-controlled account and your IT desk can just reset it to "password123!" to let you back in, it's quite a good trade-off. When it's your main email, i.e. your pri…
> But yeah, this is why I dislike 2FA. There are clear security benefits, but it comes with the extreme downside of "what you know is not sufficient". But that's not even the problem here. OP has the "what you have". Just because the secondary authentication device is made of paper doesn't mean it's any less valid. But google is rejecting it and demanding the lost device.
More moving parts means more failures (as demonstrated), and in this case what they have has a (possibly very short, depending on their upcoming needs and how Google decides to re-verify them) time limit until they no longer have it.
So... sorta yes, sorta no. What they have is a ticking time bomb which goes off at the whim of a company that clearly does not care about them. That's not really "an authentication device" that anyone would willingly choose.
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#326The problem I had while my company phone got remote wiped: Google Authenticator uses a protobuf based export qr code, which any other 2FA app doesn't support.
I wrote a small cli tool that can export all data inside it, and that tries to generate qrcode images for each entry for re-import into another 2fa app.
I hope this can help someone with the same problem, I got stuck with a camera photo of this seemingly useless qrcode for a couple hours until I built my tool.
Always remember to backup google authenticator, and always make a physical backup of your encrypted passwords database!
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#327OP: Do you still have adb running on the phone?
If yes, then you might be able to backup google authenticator's data using adb.
Alternatively maybe a tool like scrcpy [1] might be able to help when the screen is broken.
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#328Oh my god. 2-Step verification on your Google Account is actually less secure than not using it at all. I just posted about something similar maybe 3 months ago?[1] > I kid you not. Google's actual official answer to this is... create another account![1][2][3] > Edit: Now that I have your attention: > PSA: Go create "Backup codes" for your Google Account in your 2-Step Verification settings. > [1]: https://support.go…
Without 2FA enabled, google can and will lock you out of your own account for no good reason with zero recourse, stating they "cannot identify you" or that "your browser is insecure". We lost several paid business gapps accounts due to this.
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#329Earlier quoted context omitted.
But be careful. If you access the passwords and 2fa secrets via the same credentials you are back to one factor authentication if secret + pass store ever get compromised. Imho it's a different story if you use a separate gpg-key/secret to access the 2fa secrets (which should also only happen in emergency cases). This can easily be done with pass.
Yeah... I do the same thing. 2FA secrets in my password vault. I KNOW it defeats the purpose. But honestly, where the heck else am I supposed to put them? I know from experience that printouts gets lost, and also that if someone were determined to hack me, the easiest route would be to break into my home and find the printouts. So I guess I'm technically supposed to subscribe to a second password manager and store ju…
> I KNOW it defeats the purpose. But honestly, where the heck else am I supposed to put them?
Backing up my 2FA codes is one of the reasons that led me to create PortableSecret: https://news.ycombinator.com/item?id=34083366
Some people took issue with my comment regarding ‘not all secrets belong in your password manager’ but your comment is exactly what I meant.
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#330Here is an anecdote. I had my iPhone replaced last year due to a battery issue and I forgot to migrate my authenticator codes to the new phone (I did not realize they did not restore if you changed phones). I was able to log in via a known authenticated web browser and reset my 2FA TOTP. I am a little hazy on if it used my mobile gmail app as a second factor though (with content restored from backup). I did not need my backup code. Perhaps it would be good to get an additional hardware security key for the account just in case.