To avoid a situation like this, I keep backup screenshots of the 2FA QR codes stored off-line on an encrypted USB drive.
Or just use Aegis - you can export all your codes as an encrypted backup.
What’s that?
Tell HN: It is impossible to disable Google 2FA using backup codes
61–70 of 352 posts
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#62Oh my god. 2-Step verification on your Google Account is actually less secure than not using it at all. I just posted about something similar maybe 3 months ago?[1] > I kid you not. Google's actual official answer to this is... create another account![1][2][3] > Edit: Now that I have your attention: > PSA: Go create "Backup codes" for your Google Account in your 2-Step Verification settings. > [1]: https://support.go…
I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.
Can't you add a security key like a Yubikey? Do they let you do that without requiring your Google Authenticator / TOTP secret?
What about adding someone who can get access to your email after six months of inactivity? Maybe they let you add that without your lost google authenticator? It'd be better than nothing.
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#63> What am I supposed to do in this situation? This. Support systems in the world post computers eating everything is basically HN posts.
When I had a self-inflicted issue with my non-Google email service I context support and has the issue resolved within a couple hours.
How does one contact support? Every path I've tried leads to a support community forum. I haven't tried posting there yet as I assumed it was a black hole. Are you saying that that works?
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#64> What am I supposed to do in this situation? This. Support systems in the world post computers eating everything is basically HN posts.
Maybe the next million new jobs is just rebuilding a reasonable level of customer support at all tech companies, funded by modest usage fees. $5/mo, $50/yr, or $500 for lifetime guaranteed permanent access so no lockouts are possible, I would definitely pay for Gmail or an equivalent service. And there are people who I’m sure would pay much more. Another short term option: $500-1000 right now to get a couple hours of…
High fees mean that most people even in places like the USA cannot afford it. Would be nice to have modest customer service options for everyone.
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#65I just tested this. You should not disable 2FA. - Just click on the Authenticator app - Change Authenticator app - https://ibb.co/dPCMpdN Just works.
Hey, thank you so much for trying to help me. On what page do you see the Authenticator app listed? I suspect it's on the "Two Factor Auth" page. My problem is that I cannot even load that page. I click on "Security" in the menu, and it's when I click on "Two factor auth" to do any 2fa-related task, that's when I'm forced to log in and provide a 2fa code (which I do not have)
Just tested it.
- Private Browser Window - Log in using backup code - can change auth app without another login.
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#66Earlier quoted context omitted.
I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.
The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).
And for authenticators that do not allow to export the secret, while your authenticator is not lost yet, add another authenticator: and during registration, save the QR code.
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#67Earlier quoted context omitted.
I would love to save the QR codes, but Google bans screenshots in the Authenticator app.
Auhenticator has an option to generate back up codes. it creates one or two QR codes that you can scan in a new Authenticator app and it will clone all of your accounts.
Good luck trying to save those QR codes, though. I had to resort to pulling out my DSLR to take a photo of my phone with them.
All screenshot/print/save functionality is disabled when you have the codes up on your phone.
You need an actual camera on a second device to save them in most cases.
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#68Earlier quoted context omitted.
The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).
And for authenticators that do not allow to export the secret, while your authenticator is not lost yet, add another authenticator: and during registration, save the QR code.
[deleted]
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#69Earlier quoted context omitted.
Thanks for the followup. I'm also on desktop. When I click the second link, I'm forced to reauthenticate. During that reauthentication my only option for 2-factor auth is... a valid 2FA code. Backup codes are not allowed. I suspect since you originally logged in with a 2FA code (I'm guessing), your session is marked as "recently two factor verified", and when I logged in with a backup code, I was not marked the same…
since you told me I am using a I tried without 2FA code but with backup-code > When I click the second link, I'm forced to reauthenticate. Here, I am being asked my password. Then get that page.
Probably the difference, like parent says, is that you recently used 2FA, from the same OP address etc etc, so even though you have signed in with backup code now Google still trust your sign in more than OP.
Re: Tell HN: It is impossible to disable Google 2FA using backup codes
#70To avoid a situation like this, I keep backup screenshots of the 2FA QR codes stored off-line on an encrypted USB drive.
I do something similar but sillier. I scan the QR code in a basic QR reader app, then regenerate it using a script I got years ago that renders a QR code using Unicode, then store that in a plaintext file (gpg encrypted) with all my other non-password-manager secrets. I started doing this after I had a bad experience with Google Authenticator not surviving the restore to a new phone.