Tell HN: It is impossible to disable Google 2FA using backup codes

Post by notpushkin » Tue, Jan 24, 2023, 7:33 AM UTC

mr_mitm wrote: post #334

notpushkin wrote: post #268

Earlier quoted context omitted.

Android phones are encrypted by default, but for encryption, they use the same PIN as your lock screen. There's some command you could run to replace it with a strong password while keeping screen lock PIN simple, but it didn't work for me last time I tried.

Surely the data is encrypted using a 128 bit key or better, and the key is stored on some secure enclave which rate limits PIN entries, is it not?

> Surely the data is encrypted using a 128 bit key or better

I think so, yeah.

> and the key is stored on some secure enclave which rate limits PIN entries, is it not?

That – I'm not so sure about. I didn't really think about it too much before you pointed it out, but it would make sense for the Android floks to have implemented it. I'll look into it a bit later!

Post by Eric_WVGG » Fri, Jan 27, 2023, 1:41 AM UTC

ranger_danger wrote: post #337

Eric_WVGG wrote: post #223

Earlier quoted context omitted.

I gave a big long speech on security to my company, mentioned that SMS 2FA was junk and to use authentication apps instead, then made 2FA mandatory on our Google accounts… only to find out that you can’t even enable good authentication without enabling SMS 2FA first. Absolute madness.

Actually there is a way, but instead of enabling SMS you have to enable U2F first, then it will allow you to turn on TOTP. If you don't have a U2F-capable device then you can use a program like softu2f that emulates one on your computer, even if it's just temporary in order to get TOTP turned on.

Good to know, but wow, that's wretched.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

Re: Tell HN: It is impossible to disable Google 2FA using backup codes