Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: It is impossible to disable Google 2FA using backup codes

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 352 posts

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#91

Post by jeroenhd »

gravitronic wrote: post #29
andrewmcwatters wrote: post #26

Oh my god. 2-Step verification on your Google Account is actually less secure than not using it at all. I just posted about something similar maybe 3 months ago?[1] > I kid you not. Google's actual official answer to this is... create another account![1][2][3] > Edit: Now that I have your attention: > PSA: Go create "Backup codes" for your Google Account in your 2-Step Verification settings. > [1]: https://support.go…

I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.

I remember Google not letting me log in with my TOTP code when it insisted on me clicking a prompt I hadn't received. Only after two timeouts did it add the option to use a TOTP code. If I recall correctly, I had to let the thing fail and then click "let me try another way" or something similar. This leads me to believe that maybe Google hides certain options by default.

However, I also think that Google keeps track of a "security rating" for your session; when I don't log in for a while, Google asks me for my password but when I use that same session token on another physical address I also need to authenticate with 2FA.

This may imply that failed login attempts may flag your session as even worse than before. I have no idea if this is actually how it works or if this is purely coincidental, but it may be worth keeping in mind given that you have limited backup codes available to you.

My recommendation would be to first get a Google Takeout backup stored somewhere safe, then see if you can get another 2FA method that you have control over connected to your account.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#92

Post by random2021 »

gravitronic wrote: post #79
alxndr13 wrote: post #65

Earlier quoted context omitted.

Just tested it. - Private Browser Window - Log in using backup code - can change auth app without another login.

So weird, because I cannot! Maybe it's because I haven't used a 2FA code on this account in the past year? I typically stay logged out of my Google account and just have the email forwarded to another provider.

I guess could be that.

I too create a new chrome profile (and restarted my router) to get a different IP. (i.e) clean.

- Does this mean you are able to access emails but not change 2FA?

- If yes, do a take out ASAP.

- May be the backup codes are incorrect?

(Unless the machine learning folks on hn did some programming to prevent it!!!). For every one that complains about Google, I wonder how hn crowd pleasingly accepts pay check in the software industry.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#93

Post by lcnPylGDnU4H9OF »

Xylakant wrote: post #78
j1elo wrote: post #74

Earlier quoted context omitted.

The QR that you mention, is just an encoding of an actual string key (edit: I'm reading now that it's called seed ). If possible, it is better to get the string directly, instead of its QR encoded counterpart. This is needed for example to store the TOTP in a device that has no camera. Or in your Bitwarden Pro account. Obviously you wouldn't be able to scan a QR with such an application, so the actual string is neede…

You are correct about the QR code just representing a (fairly short) string, but applications can handle QR code just fine - 1password can read it directly from the screen.

There may be a plugin for it but the KeePass clients I've used don't support this by default. Generally, it would be best to look for the string (and keep both the string and the image secret!).

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#94

Post by gravitronic »

random2021 wrote: post #92
gravitronic wrote: post #79

Earlier quoted context omitted.

So weird, because I cannot! Maybe it's because I haven't used a 2FA code on this account in the past year? I typically stay logged out of my Google account and just have the email forwarded to another provider.

I guess could be that. I too create a new chrome profile (and restarted my router) to get a different IP. (i.e) clean. - Does this mean you are able to access emails but not change 2FA? - If yes, do a take out ASAP. - May be the backup codes are incorrect? (Unless the machine learning folks on hn did some programming to prevent it!!!). For every one that complains about Google, I wonder how hn crowd pleasingly accept…

The backup codes are what enabled me to log in, thankfully, so I know they work.

Thanks for the takeout advice.. onto that now!

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#95

Post by password4321 »

j1elo wrote: post #74
eigenvalue wrote: post #60

Earlier quoted context omitted.

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

The QR that you mention, is just an encoding of an actual string key (edit: I'm reading now that it's called seed ). If possible, it is better to get the string directly, instead of its QR encoded counterpart. This is needed for example to store the TOTP in a device that has no camera. Or in your Bitwarden Pro account. Obviously you wouldn't be able to scan a QR with such an application, so the actual string is neede…

Why not both? Thanks for the clarification.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#96

Post by nszceta »

ses1984 wrote: post #61
laurent123456 wrote: post #57

Earlier quoted context omitted.

Or just use Aegis - you can export all your codes as an encrypted backup.

What’s that?

It's an Android app. Its easier to manage OTP codes inside your password manager. Do everything with KeepassXC and KeepassDX. How to sync a file between computers and your phone is left as an exercise to the reader. However I recommend using Syncthing.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#97

Post by tcoff91 »

gravitronic wrote: post #63
TheSpiceIsLife wrote: post #51

Earlier quoted context omitted.

When I had a self-inflicted issue with my non-Google email service I context support and has the issue resolved within a couple hours.

How does one contact support? Every path I've tried leads to a support community forum. I haven't tried posting there yet as I assumed it was a black hole. Are you saying that that works?

He said non-google. There is no decent support from google.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#98

Post by sureglymop »

ironmagma wrote: post #43
gravitronic wrote: post #29

Earlier quoted context omitted.

I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.

Time to repeal 2FA. I can't believe it's required for SOC2 type 2 compliance.

2FA is okay. But the practice of backup code sucks. Instead, save the TOTP hash and make extra sure to back it up. Then you can just reconfigure your 2FA app.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#99

Post by sureglymop »

eigenvalue wrote: post #60
gravitronic wrote: post #29

Earlier quoted context omitted.

I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

Or save the TOTP hash directly.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#100

Post by y04nn »

bikeformind wrote: post #34

To avoid a situation like this, I keep backup screenshots of the 2FA QR codes stored off-line on an encrypted USB drive.

I did the same, but I had not updated it since 2020, now I can't remember the passphrase I used back then, I probably should have kept a separate paper copy of the passphrase. Or I should have use my GPG private key to do the encryption. It is also possible that my keyboard was not in the right language or I made a typo, I have tested hundred of combinations with no luck so far.
Post reply on HN