Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: It is impossible to disable Google 2FA using backup codes

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 352 posts

Tell HN: It is impossible to disable Google 2FA using backup codes

#1

Post by gravitronic »

I would like to inform the HN community, if your plan to recover your Google account in the event of losing your phone is to use a 2FA backup code, or SMS recovery, to remove the old 2FA setup and set up a new 2FA code, that that may not be possible.

My situation:

I had 2FA set up with my Google Account through Google Authenticator.

I lost my Google Authenticator settings when I broke my phone.

I have 2FA backup codes. These successfully log me into my Google Account.

In order to disable 2FA, or generate new 2FA backup codes, I need to access the 2FA settings page under the Security tab. When I try to load the Two-factor authentication page, I am forced to re-authenticate with Google.

When re-authenticating to access the 2FA page, there is no option to enter a 2FA backup code or SMS verification to pass the 2FA challenge. The only option under "Choose a way to verify" is to enter a 2FA code. Entering a backup code instead of a 2FA code returns an error.

What am I supposed to do in this situation?

Yes this is a classic "maybe I can get support through public shaming" attempt. Thanks in advance.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#3

Post by gravitronic »

przeor wrote: post #2

I do recommend toget 2fas.com asap and export your codes to iCloud/G Drive. If you lose the phone its easier to recover.

Yeah, apparently that 2FA handshake is crucial with some providers. I was not expecting this, I thought careful management of my 2FA backup codes would suffice!

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#4

Post by gravitronic »

Side-comment: is there a type of shadowban with HN where my posts do not make it into the frontpage, even 2 or 3 or more pages deep?

I've seen this with a few of my posts recently where they appear in the 'new' and 'show' or 'ask' tabs, but not the frontpage.. even 300 posts deep while similarly aged and upvoted posts are on second page.

edit: now it's on the frontpage! Guess it just had to hit a vote threshold.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#5

Post by darepublic »

gravitronic wrote: post #4

Side-comment: is there a type of shadowban with HN where my posts do not make it into the frontpage, even 2 or 3 or more pages deep? I've seen this with a few of my posts recently where they appear in the 'new' and 'show' or 'ask' tabs, but not the frontpage.. even 300 posts deep while similarly aged and upvoted posts are on second page. edit: now it's on the frontpage! Guess it just had to hit a vote threshold.

I clicked into this off the front page.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#6

Post by torstenvl »

I hate current popular implementations 2FA and similar IT fads for this exact reason. They are inherently insecure, and any security professional who pushes them without serious thought through all the failure modes should be blacklisted from the industry.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#7

Post by gravitronic »

darepublic wrote: post #5
gravitronic wrote: post #4

Side-comment: is there a type of shadowban with HN where my posts do not make it into the frontpage, even 2 or 3 or more pages deep? I've seen this with a few of my posts recently where they appear in the 'new' and 'show' or 'ask' tabs, but not the frontpage.. even 300 posts deep while similarly aged and upvoted posts are on second page. edit: now it's on the frontpage! Guess it just had to hit a vote threshold.

I clicked into this off the front page.

Just updated my comment, I guess there's some other criteria or age to hit before it gets ranked.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#8

Post by TheFreim »

gravitronic wrote: post #4

Side-comment: is there a type of shadowban with HN where my posts do not make it into the frontpage, even 2 or 3 or more pages deep? I've seen this with a few of my posts recently where they appear in the 'new' and 'show' or 'ask' tabs, but not the frontpage.. even 300 posts deep while similarly aged and upvoted posts are on second page. edit: now it's on the frontpage! Guess it just had to hit a vote threshold.

I believe that text posts are ranked lower than links.

Re: Tell HN: It is impossible to disable Google 2FA using backup codes

#9

Post by gravitronic »

It would be useful if people went to their Google Account page, clicked the Security tab, then tried to access the Two Factor Auth page and reported back what options they had to authenticate. Do you have options other than "enter a two factor auth code"? Can you authenticate on that page with SMS or a backup code?
Post reply on HN