Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: It is impossible to disable Google 2FA using backup codes

news.ycombinator.com

Post reply on HN
Print view View original

341–350 of 352 posts

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#341

Post by torstenvl »

jeroenhd wrote: post #76
torstenvl wrote: post #6

I hate current popular implementations 2FA and similar IT fads for this exact reason. They are inherently insecure, and any security professional who pushes them without serious thought through all the failure modes should be blacklisted from the industry.

This isn't a security flaw, this is incompetency. Google not allowing disabling or altering 2FA after resorting to a backup code is simply bad design. They could've done the same with any method of authentication. Using a password isn't even enough for Google any more these days, look at Gmail+IMAP. This is pure incompetency, not a flaw in 2FA. Whatever device this person is on has been flagged insecure enough to nee…

I'm sorry, but when you lose control of and access to your data, but someone else has control and access, that is a security flaw. There is no meaningful difference between broken 2FA and ransomware.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#342

Post by joshAg »

adamors wrote: post #236
joshAg wrote: post #155

Hey, so this is admittedly monday morning quarterbacking, but in the future, you can definitely consider moving from Google Auth to Twillio's authy [1]. It lets you move devices and all your secrets come with you (it's also got other cool features, but the one that is killer IMO is the ability to migrate from device to device). https://authy.com/

I can’t recommend Authy enough. It’s multi device from the start and has cloud backup. I once broke my phone with Google Authenticator on it and I spent 2 days locked out from my work accounts. Never risking that again.

One important note, though, is that the backup and multidevice requires their cloud servers* so the threat model is a little different. They've got a blog on how they do the cloud backup**, but since you need a password it either needs to be something you can remember or be stored in a password vault that doesn't rely on getting a 2fa code from authy for access.

* for the paranoid, there's a mode where it doesn't backup to the cloud, which makes it function the same as google auth, but that does defeat a lot of authy's benefits.

** https://authy.com/blog/how-the-authy-two-factor-backups-work...

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#343

Post by efreak »

mcherm wrote: post #293
arriu wrote: post #124

Whenever one of these threads about Google (or Apple) come up, I am shocked at the lack of response from people working at those companies. It seems reasonable that this site would be where you'd find someone from a team that interacted with logic that OP is having trouble with. I'd expect to see something like a "hey, yeah, I know a guy on our team that might be able to get in touch with the team who maintains this.…

> I'm hoping OP got a private message. I'm not. I have the same problem -- or I will if I ever lose my 2 factor identification keys, which are held by Authy NOT by myself. I always assumed that my one-time-codes (which I have carefully secured and protected) would be usable to regain control over my account. If that's not the case, then I want Google to fix it for EVERYONE.

Not sure if this is still accurate or not, but you used to be able to use the element inspector to export your keys from the Authy chrome extension (I can't find the original script I used, but I did find this one for developer mode [1]). This is how I migrated to WinAuth (dead project, but still works. Theoretically secured by windows itself, so shouldn't matter I think?). I've since migrated my mobile devices to Aegis[2], which I'm trusting sandboxing to secure; new otp are still added to Authy solely as backup.

Aegis supports importing from a bunch of apps, as does android-otp-extractor, both need root to do so. Aegis can also import backups from a bunch of different apps.

[1] https://gbatemp.net/threads/extract-your-totp-keys-from-auth... [2] https://github.com/beemdevelopment/Aegis [3] https://github.com/puddly/android-otp-extractor

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#344

Post by efreak »

branon wrote: post #239
epicureanideal wrote: post #219

Earlier quoted context omitted.

> For example there are lots of nice paid services out there that look great, but eventually I’m going to forget to pay, or the company will go under, or whatever. Right, that's why I think there should be an option for a $500 permanent email address, or maybe $50 one-time payment that doesn't guarantee permanent access but does guarantee that the email address will sit there as long as it takes for you to be able to…

Purchase a domain and use your registrar's SMTP and IMAP servers. I have been doing this for about 5 years now and it feels great. I get to pay annually for a bundle of related services (domain, DNS, email, ...) instead of freeloading in a place where I'm the product and there is no support. You could also purchase a domain and point MX records anywhere, preferably at some known-good mail service which you pay for.

You don't need to use your registrar. I'm grandfathered in with free G Suite, but there's other services that can do this on the cheap or free.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#345

Post by branon »

efreak wrote: post #344
branon wrote: post #239

Earlier quoted context omitted.

Purchase a domain and use your registrar's SMTP and IMAP servers. I have been doing this for about 5 years now and it feels great. I get to pay annually for a bundle of related services (domain, DNS, email, ...) instead of freeloading in a place where I'm the product and there is no support. You could also purchase a domain and point MX records anywhere, preferably at some known-good mail service which you pay for.

You don't need to use your registrar. I'm grandfathered in with free G Suite, but there's other services that can do this on the cheap or free.

How grandfathered? I had a customer recently whose small business was "grandfathered" into G Suite's free plan... until Google started choking back hard on what features were available.. The free plan still exists but they were essentially forced into buying a subscription.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#346

Post by ranger_danger »

gbraad wrote: post #321

Google's 2FA is terrible for Google workspace when you add a phone number. In that case, you are up to the whim of the country to allow your SMS to be received (serious consideration in some parts of the world). When a phone is added, you will not be able to use a device for 2fa, but always defaults to SMS!

Are you sure you didn't overlook the "try another way" button?

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#348

Post by beej71 »

At the recommendation of some of those here, and with the help of a webcam to capture my Authenticator QR code, I successfully moved everything over to Aegis. I set up a strong password, stored in my password vault. Aegis lets you do biometric login.

Took a screenshot of Authenticator's export QR code via the webcam, then added it with Aegis. Then went to Aegis's Settings->Backup and exported a JSON backup, which is encrypted with the password.

That's a bit more peace of mind.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#349

Post by beej71 »

gravitronic wrote: post #148
londons_explore wrote: post #90

Earlier quoted context omitted.

Allowing customer service to bypass customer auth requirements is just weakening your system. There will always be a CS agent who is bribed, makes a mistake, etc. And besides, the agent following a flow chart has no better info to make the decision on than a computer. Instead the auth requirements should be sane from the start, well publicised, and make a good tradeoff between letting bad guys in vs locking the real…

In this particular case I feel like it's a bug that backup codes are not treated as secure as 2fa codes, and that I need explicitly a 2fa code to disable 2fa is just broken (in my specific case)

It definitely seems like a 1FA backup instead of a 2FA backup in your case. :(

I used this horror story to move to Aegis from Authenticator and make an encrypted backup copy of the OTP vault, so thank you for posting. FWIW.

Post reply on HN