4 ms·
I switched jobs last month and decided to audit all my personal stuff while the old place was auditing all the work accounts I left behind. We'd been using goog
by digitalsushi 11y ago
I switched jobs last month and decided to audit all my personal stuff while the old place was auditing all the work accounts I left behind. We'd been using google/gmail 2 factor authentication.
There's a few layers to it, most everyone has seen. Ok, 1st factor is your password, so you log in with your password.
2nd factor can vary - a list of codes you print and keep in your wallet, or they can send a txt message to your phone. Or you can get an authenticator app, which you configure with some magical seed value, and then you have what's effectively a software RSA token device on your phone.
Even easier? I just found out about these FIDO usb hardware keys. 9 bucks, wait for it in the mail... go to your gmail account settings, click the link, put the hardware key in, press the button... and that's it, from then on you can plug that key into a web browser (chrome, actually) and it will pass the second factor. Anyways, it's been out for a while, but I just found out about it, and it's so easy to do I wanted to jot a note down here.
- gefh 11y agoI second a usb authenticator. It's also an effective defence against phishing attacks - unlike OTPs.
- mrec 11y agoWhat's the procedure if you break or lose the FIDO hardware key? (Not a rhetorical question; I'd never heard of them before either.) This is the sort of the thing I always worry about when discussing or considering strengthening security. At some point the risk of accidentally locking yourself out outweighs the risk of someone else getting in. Particularly so for something like gmail, where there's no customer service as a last resort.
- granos 11y agoI'm not 100% certain, but when I setup 2FA for many services they give you ~10 single use emergency codes that you can use to get into the system in the event that your second factor is unavailable for whatever reason (phone stolen, you are out of the country, fido broke, etc.)
- Mandatum 11y agoContacting your domain admin, using your backup codes, if none of those work you'll need to fill an account recovery form with the service provider, ie: https://support.google.com/accounts/answer/185834?hl=en#phone https://support.google.com/accounts/answer/185834?hl=en#phon...