6 ms·

Ask HN: What's your backup plan for 2Factor authentication if you lose your phone

20 points by dsinecos 10y ago

Gmail allows for code backups. What do you do for all the other services? What do you suggest for a small business team that uses multiple services with 2-factor authentication? ---------- EDIT - What do you do for services (For instance Namecheap) that do not provide backup codes or where Google Authenticator is not applicable?

iyn 10y ago
I use Google Authenticator as my 2FA solution. I manually downloaded Authenticator database from the phone and backed up on my external disk.
- emilburzo 10y ago
  Same here, but with FreeOTP[1] instead. Because apparently Math.pow doesn't work correctly on my device for some reason[2], and at that time there was no fix. Although this method does require a rooted device, as I was unable to get adb backup to work. [1] - https://play.google.com/store/apps/details?id=org.fedorahosted.freeotp https://play.google.com/store/apps/details?id=org.fedorahost... [2] - https://github.com/google/google-authenticator-android/pull/4 https://github.com/google/google-authenticator-android/pull/...
AznHisoka 10y ago
I store backup keys in my wallet and my safe.
atmosx 10y ago
Backup keys in 1Passwd for all 2FA enabled accounts except Amazon. However, I will disable 2FA from AMZ's main user and use an extremely long password instead to avoid having to deal with Amazon support, since they don't give backup codes...
kohanz 10y ago
My wife's phone is my "backup phone", so both of us would have to lose our phones at the same time for there to be a problem.
dsinecos 10y ago
Edit - What do you do for services (For instance Namecheap) that do not provide backup codes or where Google Authenticator is not applicable?
- fallenhitokiri 10y ago
  I store a printed version of the QR code in a safe place.
stevekemp 10y ago
Every time I add a 2FA to my phone I also add it to an encrypted password store on my SSH-server. That way I can run `oathtool --totp -b $token` via SSH if I need to use it.
ianleeclark 10y ago
I've noticed a lot of paper keys being used for backup keys. The three, off the top of my head, are github, keybase, and google, which offer paper keys which can be used to retrieve your password--even if your phone is lost.
SkyRocknRoll 10y ago
Authy
kennell 10y ago
Authy, painless 2FA.
vangale 10y ago
I keep paper keys for google and use authy. I also use pass (https://www.passwordstore.org https://www.passwordstore.org) and so I might start using this very new app https://github.com/felipelerena/passotp/ https://github.com/felipelerena/passotp/
- pigpigs 10y ago
  pass looks really awesome. How do you backup your GPG keys for pass though?
  - pietroalbini 10y ago
    You can store them on an external device you use for backups, or you can print them on the good old paper :)
senjindarashiva 10y ago
After loosing the key's once... I got a bit paranoid and set up a backup phone that stays at home. However lately i've started using enpass which allows me to sync the 2fa key's as well as the passwords.

20 points by dsinecos 10y ago

iyn 10y ago

I use Google Authenticator as my 2FA solution. I manually downloaded Authenticator database from the phone and backed up on my external disk.

emilburzo 10y ago
Same here, but with FreeOTP[1] instead. Because apparently Math.pow doesn't work correctly on my device for some reason[2], and at that time there was no fix. Although this method does require a rooted device, as I was unable to get adb backup to work. [1] - https://play.google.com/store/apps/details?id=org.fedorahosted.freeotp https://play.google.com/store/apps/details?id=org.fedorahost... [2] - https://github.com/google/google-authenticator-android/pull/4 https://github.com/google/google-authenticator-android/pull/...

AznHisoka 10y ago

I store backup keys in my wallet and my safe.

atmosx 10y ago

Backup keys in 1Passwd for all 2FA enabled accounts except Amazon. However, I will disable 2FA from AMZ's main user and use an extremely long password instead to avoid having to deal with Amazon support, since they don't give backup codes...

kohanz 10y ago

My wife's phone is my "backup phone", so both of us would have to lose our phones at the same time for there to be a problem.

dsinecos 10y ago

Edit - What do you do for services (For instance Namecheap) that do not provide backup codes or where Google Authenticator is not applicable?

fallenhitokiri 10y ago
I store a printed version of the QR code in a safe place.

stevekemp 10y ago

Every time I add a 2FA to my phone I also add it to an encrypted password store on my SSH-server. That way I can run `oathtool --totp -b $token` via SSH if I need to use it.

ianleeclark 10y ago

I've noticed a lot of paper keys being used for backup keys. The three, off the top of my head, are github, keybase, and google, which offer paper keys which can be used to retrieve your password--even if your phone is lost.

SkyRocknRoll 10y ago

Authy

kennell 10y ago

Authy, painless 2FA.

vangale 10y ago

I keep paper keys for google and use authy. I also use pass (https://www.passwordstore.org https://www.passwordstore.org) and so I might start using this very new app https://github.com/felipelerena/passotp/ https://github.com/felipelerena/passotp/

pigpigs 10y ago
pass looks really awesome. How do you backup your GPG keys for pass though?
- pietroalbini 10y ago
  You can store them on an external device you use for backups, or you can print them on the good old paper :)

senjindarashiva 10y ago

After loosing the key's once... I got a bit paranoid and set up a backup phone that stays at home. However lately i've started using enpass which allows me to sync the 2fa key's as well as the passwords.