Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: It is impossible to disable Google 2FA using backup codes

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 352 posts

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#41

Post by bikeformind »

ClassyJacket wrote: post #14
ReptileMan wrote: post #11

And that is why I utilize the "very secure" flow of also keep the original qr codes ... in a keepass vault, but still. Most of the security is theater. On the other hand I think that every tech savvy person should at least try to keep the TOTP seeds.

I would love to save the QR codes, but Google bans screenshots in the Authenticator app.

Auhenticator has an option to generate back up codes. it creates one or two QR codes that you can scan in a new Authenticator app and it will clone all of your accounts.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#42

Post by gravitronic »

proactivesvcs wrote: post #39
gravitronic wrote: post #9

It would be useful if people went to their Google Account page, clicked the Security tab, then tried to access the Two Factor Auth page and reported back what options they had to authenticate. Do you have options other than "enter a two factor auth code"? Can you authenticate on that page with SMS or a backup code?

Using the Google app on my Android phone (stock, unrooted, GPlay enabled), the Security, 2FA link launches a WebView screen. It has my username prefilled. When I click Next, I'm given a failure page saying "This browser or app may not be secure". The Web View app is up to date, version 108.

Wow, that's.. even worse than my experience.

It would probably work if you used the official browser, it's not a bad idea for the website to block webviews. But pretty funny that their app uses a webview which the service then blocks.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#43

Post by ironmagma »

gravitronic wrote: post #29
andrewmcwatters wrote: post #26

Oh my god. 2-Step verification on your Google Account is actually less secure than not using it at all. I just posted about something similar maybe 3 months ago?[1] > I kid you not. Google's actual official answer to this is... create another account![1][2][3] > Edit: Now that I have your attention: > PSA: Go create "Backup codes" for your Google Account in your 2-Step Verification settings. > [1]: https://support.go…

I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.

Time to repeal 2FA. I can't believe it's required for SOC2 type 2 compliance.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#44

Post by gravitronic »

random2021 wrote: post #40
gravitronic wrote: post #35

Earlier quoted context omitted.

Hey, thank you so much for trying to help me. On what page do you see the Authenticator app listed? I suspect it's on the "Two Factor Auth" page. My problem is that I cannot even load that page. I click on "Security" in the menu, and it's when I click on "Two factor auth" to do any 2fa-related task, that's when I'm forced to log in and provide a 2fa code (which I do not have)

go to https://myaccount.google.com/security?hl=en Then, https://myaccount.google.com/signinoptions/two-step-verifica... There you can see Authenticator app. (I am doing this on desktop. Not sure about phone)

Thanks for the followup. I'm also on desktop.

When I click the second link, I'm forced to reauthenticate. During that reauthentication my only option for 2-factor auth is... a valid 2FA code. Backup codes are not allowed.

I suspect since you originally logged in with a 2FA code (I'm guessing), your session is marked as "recently two factor verified", and when I logged in with a backup code, I was not marked the same level of "secure".

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#46

Post by nicoburns »

This is why I use SMS as my second factor for my Google account. Much harder to lose. It could be vulnerable to sim swapping attacks, but I consider Google locking me out of my own account a more likely threat (and frankly I'm probably not a high-profile enough target for anyone to bother with that, and in any case they'd still need my password).

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#47

Post by torstenvl »

Spivak wrote: post #13
torstenvl wrote: post #6

I hate current popular implementations 2FA and similar IT fads for this exact reason. They are inherently insecure, and any security professional who pushes them without serious thought through all the failure modes should be blacklisted from the industry.

Competently administering 2FA essentially requires human intervention to handle the "I lost all my credentials" case because it will happen with probability 1 eventually. Workplaces can do this because you can call IT and have an already established identity based in the real world.

100%. I've never had any issues with IRL 2FA. If I lose or damage my CAC card I can go to the ID card office with a different photo ID and get a new one with new certificates and set a new PIN. My old certificates will be revoked.

But that's not what's currently popular. What's currently popular is just to check a box with some poorly thought-out system and screw anyone who ever loses their phone number or 2FA device. That's dangerous and unprofessional.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#48

Post by qzw »

bikeformind wrote: post #34

To avoid a situation like this, I keep backup screenshots of the 2FA QR codes stored off-line on an encrypted USB drive.

No need for screenshots even, right click and Save Image almost always works. I save them all and encrypt them in a separate archive with a different password. No, your probably shouldn’t save them to your password vault (unless you know what you’re doing).

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#49

Post by Sebb767 »

jetpackjoe wrote: post #17
ReptileMan wrote: post #11

And that is why I utilize the "very secure" flow of also keep the original qr codes ... in a keepass vault, but still. Most of the security is theater. On the other hand I think that every tech savvy person should at least try to keep the TOTP seeds.

Doesn't keeping the seed remove the whole point of one time passwords? If an attacker steals at TOTP, its only good for (I think) less than a minute. If they steal the seed, its good forever.

> Doesn't keeping the seed remove the whole point of one time passwords?

You need to keep the seeds anyway to generate OTP codes. They are just keeping them in their vault in addition to keeping them in their OTP app.

As long as those storage methods are sufficiently secure, it's not a problem.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#50

Post by jchw »

gravitronic wrote: post #38
jchw wrote: post #33

Try enrolling another 2FA method while you're in there.

I cannot access the Two Factor authentication page at all - it is when attempting to access that page that I'm forced to log in again and provide a 2FA code.

Weird, this used to work... I guess they changed it at some point.
Post reply on HN