8 ms·

Also having problem with AWS - can't access it and they keep billing me for something there I want to shut it down (EC2?) but I can't. I recently moved from Br

Also having problem with AWS - can't access it and they keep billing me for something there I want to shut it down (EC2?) but I can't. I recently moved from Brazil to UK (new address) and changed phone + sim card (Authenticator after restore from backup lost all 2 factor auth entries). This is the moment when you realise that you're outside of predefined use cases of The Machine and you're fucked. Nobody is here to help you. I've tried, nobody gives a shit at Amazon. They have procedures, you know. I blame 2FA and I think it's great if you don't have problems but it's shit if you have, ie. you move places, change phones etc. in your life. Something there in the process is missing like "next of kin" recovery that should be mandatory when enabling 2FAs.

wnevets 9y ago
>Something there in the process is missing like "next of kin" recovery that should be mandatory when enabling 2FAs. wouldn't this just weaken the second factor? Services that have bypasses to 2FA wind up rendering it useless.
- roywiggins 9y ago
  NearlyFreeSpeech seems to have pretty comprehensive account recovery procedures, though I can't say I've ever used them. https://faq.nearlyfreespeech.net/section/login/losteverything#losteverything https://faq.nearlyfreespeech.net/section/login/losteverythin...
colemorrison 9y ago
I had 2FA activated, changed phones and lost it. I couldn't log in to my account, so I contacted support. Within about 30 min they had put me back into my account. The dude who helped me was super chill and understanding as well.
- tqkxzugoaupvwqr 9y ago
  What is the purpose of 2FA when social engineering the support team circumvents it? This should not be possible! Lost your phone? That’s what 2FA backup codes are for.
  - nyi 9y ago
    Whats your proposed resolution for the two cases on this thread?
    - bpodgursky 9y ago
      Unless you have written backup codes, there should not be a resolution possible. You either remember to changes phone #s before you change them, or you are locked out. Deal with the phone company.
      - yebyen 9y ago
        > "There should not be a resolution possible" This guy works in customer service. LOL If you're sending me a bill, you need to provide a way for me to resolve an issue such as this. "There is not a resolution possible, we will continue billing you in perpetuity thank you good day" is not acceptable. (It's AWS and they do, so maybe it is, but... try building a new service that isn't AWS with that attitude, and see how far it gets you!)
        renolc 9y ago
        I kind of see chargeback as a potential resolution for this. If you lost access to your account and can't shut down billing via the normal route, you could still stop payments from your bank or credit card. That is the ultimate source of truth anyway, in regards to payments, so you could "prove" who you are by stopping all continuing payments to the service.
        yebyen 9y ago
        So say I do this, and later my account is sent to collections. Can you think of a worse possible outcome when your phone is dropped in the toilet if you have no scheme for 2FA recovery? My cloud-hosted business gets shut down, credit score tanks, because of the combination of my butter fingers and your secure authentication scheme! Might as well not employ any CSR drones at all if you're not going to handle this case. Maybe I'm exaggerating, but this is not a great strategy for customer satisfaction or retention. To the extent that in a dispute situation, who pays the bill =/= whomever holds the keys, my preferred customer service strategy would tend to favor who is paying the bill.
BenjiWiebe 9y ago
This is why, when creating a new 2FA login, you MUST write down the one time use backup codes, and store them in a safe and secure place.
- mirekrusin 9y ago
  I don't think I've seen any backup codes when enabling 2FA on AWS - do they provide them? Support people haven't mentioned anything about those. If they show them I must have put them somewhere...
- zwily 9y ago
  Most services don't have one-time backup codes, unfortunately.
- __david__ 9y ago
  I learned this the hard way when google authenticator failed to restore my keys after a phone upgrade. Now I make sure I copy the data from those QR codes and store them in a GPG encrypted file (I store the data and the QR code itself as utf-8 art in the file).
  - sowbug 9y ago
    The way that first sentence is phrased makes it sound like it was the app's fault.
    - __david__ 9y ago
      I blame the app entirely. Not marking the private keys as something to backup is a really really sucky thing to do.
aianus 9y ago
This anecdote makes me very happy with AWS. I want loss of 2FA to completely revoke access to my account. Otherwise any smart hacker can social engineer Amazon support with some fake drivers license photo and steal all my BTC (for example).
- calcifer 9y ago
  So what is your plan in case your phone gets lost/stolen/whatever and you lose access to your TOTP app?
  - Ajedi32 9y ago
    Use the backup codes they provided you with when you set up 2FA. Or does Amazon not have those? (If not that seems really strange, every other service I've set up 2FA on has that recovery method.)
    - mirekrusin 9y ago
      They don't provide backup codes.
  - aianus 9y ago
    I have encrypted backups of all my 2FA secrets in two locations. I change phones every year and have never lost an account.
  - Corrado 9y ago
    I use Authy as my TOTP client. It has a encrypted backup feature and allows me to share tokens between my devices (computer, phone, iPad, etc.) It's saved me on more than one occasion. :)
- Sohcahtoa82 9y ago
  Yeah, that sounds good and all, but what happens if you lose your 2FA then?
cookiecaper 9y ago
Google Authenticator is a bad 2FA app. Authenticator+ costs a couple of bucks but has many features that make it much easier to use, including the ability to back up an encrypted copy of your 2FA keys (standard disclaimers about risk of compromise to this file, yadda yadda yadda). When you change phones, you just download that, decrypt, and pick up where you left off; no hassle trying to replace the 2FA generators, which is a PITA when you have one 2FA, let alone going through that process for several accounts. If you're going to use Google Authenticator anyway, at least unlock your bootloader before you initialize the identities. You can't get to the key database without being rooted, even if you're doing a full backup with adb, and unlocking/relocking the bootloader wipes the device.
- sipos 9y ago
  Mobile phone authenticator apps are not that great anyway. They rely on the security of a phone that is connected to the net to keep the keys secure. If someone can get code running on the phone and exploit a privilege escalation vulnerability to get root, they can read the keys. A hardware token like a Yubikey or similar is probably more secure. Another problem with the Google authenticator, at least for Google accounts, is that you have to add a phone number to your account to use it I think and, they then allow access by SMS, which is not so hard to circumvent.
  - sowbug 9y ago
    You can remove the phone number once you add another 2FA method, such as U2F (Security Key) or TOTP (Google Authenticator or other TOTP app).
foobarbazetc 9y ago
I store my 2FA in 4 different authenticator apps on my phone just in case. Google Authenticator has never restored these properly, ever. Encrypted backups or not.
- mirekrusin 9y ago
  I didn't know you can do that, I thought it generates device (app) hashed codes that are synced with first code or some other magic, just today I learned it's just based on this initial code (presented as qr usually) so you can do as you say, just record it in multiple places, great idea, especially that there are even command line tools for it. I'll replicate it on my desktop next time. For now I have to go to notary and send signed docs to amazon, hopefully that'll work to get back access.
- sowbug 9y ago
  It's not supposed to restore them.
- Corrado 9y ago
  You should try Authy. I switched over to it after I got burned by Google Authenticator deleting all my tokens after an upgrade. It can store your tokens in a encrypted central location and allows you to share tokens between devices (computer, phone, tablet, etc.) It kinda freaked me out at first but now I really like it.
komali2 9y ago
I like to think "thank god I have a google voice number" but then I realize if google just decides to shaft google voice, as the have to countless of their projects in the past, I am totally fucked in regards to the many things that 2fa off it.
artjumble 9y ago
I had this situation. I had an AWS account linked to some email I no longer had access to and could not get into the account. I opened a support ticket and they sent an email to the old address, after 10 days of no response they sent it to "Legal" for review. The account was then closed by them which resolved it for me.

wnevets 9y ago

>Something there in the process is missing like "next of kin" recovery that should be mandatory when enabling 2FAs. wouldn't this just weaken the second factor? Services that have bypasses to 2FA wind up rendering it useless.

roywiggins 9y ago
NearlyFreeSpeech seems to have pretty comprehensive account recovery procedures, though I can't say I've ever used them. https://faq.nearlyfreespeech.net/section/login/losteverything#losteverything https://faq.nearlyfreespeech.net/section/login/losteverythin...

colemorrison 9y ago

I had 2FA activated, changed phones and lost it. I couldn't log in to my account, so I contacted support. Within about 30 min they had put me back into my account. The dude who helped me was super chill and understanding as well.

tqkxzugoaupvwqr 9y ago
What is the purpose of 2FA when social engineering the support team circumvents it? This should not be possible! Lost your phone? That’s what 2FA backup codes are for.
- nyi 9y ago
  Whats your proposed resolution for the two cases on this thread?
  - bpodgursky 9y ago
    Unless you have written backup codes, there should not be a resolution possible. You either remember to changes phone #s before you change them, or you are locked out. Deal with the phone company.
    - yebyen 9y ago
      > "There should not be a resolution possible" This guy works in customer service. LOL If you're sending me a bill, you need to provide a way for me to resolve an issue such as this. "There is not a resolution possible, we will continue billing you in perpetuity thank you good day" is not acceptable. (It's AWS and they do, so maybe it is, but... try building a new service that isn't AWS with that attitude, and see how far it gets you!)
      - renolc 9y ago
        I kind of see chargeback as a potential resolution for this. If you lost access to your account and can't shut down billing via the normal route, you could still stop payments from your bank or credit card. That is the ultimate source of truth anyway, in regards to payments, so you could "prove" who you are by stopping all continuing payments to the service.
        yebyen 9y ago
        So say I do this, and later my account is sent to collections. Can you think of a worse possible outcome when your phone is dropped in the toilet if you have no scheme for 2FA recovery? My cloud-hosted business gets shut down, credit score tanks, because of the combination of my butter fingers and your secure authentication scheme! Might as well not employ any CSR drones at all if you're not going to handle this case. Maybe I'm exaggerating, but this is not a great strategy for customer satisfaction or retention. To the extent that in a dispute situation, who pays the bill =/= whomever holds the keys, my preferred customer service strategy would tend to favor who is paying the bill.

BenjiWiebe 9y ago

This is why, when creating a new 2FA login, you MUST write down the one time use backup codes, and store them in a safe and secure place.

mirekrusin 9y ago
I don't think I've seen any backup codes when enabling 2FA on AWS - do they provide them? Support people haven't mentioned anything about those. If they show them I must have put them somewhere...
zwily 9y ago
Most services don't have one-time backup codes, unfortunately.
__david__ 9y ago
I learned this the hard way when google authenticator failed to restore my keys after a phone upgrade. Now I make sure I copy the data from those QR codes and store them in a GPG encrypted file (I store the data and the QR code itself as utf-8 art in the file).
- sowbug 9y ago
  The way that first sentence is phrased makes it sound like it was the app's fault.
  - __david__ 9y ago
    I blame the app entirely. Not marking the private keys as something to backup is a really really sucky thing to do.

aianus 9y ago

This anecdote makes me very happy with AWS. I want loss of 2FA to completely revoke access to my account. Otherwise any smart hacker can social engineer Amazon support with some fake drivers license photo and steal all my BTC (for example).

calcifer 9y ago
So what is your plan in case your phone gets lost/stolen/whatever and you lose access to your TOTP app?
- Ajedi32 9y ago
  Use the backup codes they provided you with when you set up 2FA. Or does Amazon not have those? (If not that seems really strange, every other service I've set up 2FA on has that recovery method.)
  - mirekrusin 9y ago
    They don't provide backup codes.
- aianus 9y ago
  I have encrypted backups of all my 2FA secrets in two locations. I change phones every year and have never lost an account.
- Corrado 9y ago
  I use Authy as my TOTP client. It has a encrypted backup feature and allows me to share tokens between my devices (computer, phone, iPad, etc.) It's saved me on more than one occasion. :)
Sohcahtoa82 9y ago
Yeah, that sounds good and all, but what happens if you lose your 2FA then?

cookiecaper 9y ago

Google Authenticator is a bad 2FA app. Authenticator+ costs a couple of bucks but has many features that make it much easier to use, including the ability to back up an encrypted copy of your 2FA keys (standard disclaimers about risk of compromise to this file, yadda yadda yadda). When you change phones, you just download that, decrypt, and pick up where you left off; no hassle trying to replace the 2FA generators, which is a PITA when you have one 2FA, let alone going through that process for several accounts. If you're going to use Google Authenticator anyway, at least unlock your bootloader before you initialize the identities. You can't get to the key database without being rooted, even if you're doing a full backup with adb, and unlocking/relocking the bootloader wipes the device.

sipos 9y ago
Mobile phone authenticator apps are not that great anyway. They rely on the security of a phone that is connected to the net to keep the keys secure. If someone can get code running on the phone and exploit a privilege escalation vulnerability to get root, they can read the keys. A hardware token like a Yubikey or similar is probably more secure. Another problem with the Google authenticator, at least for Google accounts, is that you have to add a phone number to your account to use it I think and, they then allow access by SMS, which is not so hard to circumvent.
- sowbug 9y ago
  You can remove the phone number once you add another 2FA method, such as U2F (Security Key) or TOTP (Google Authenticator or other TOTP app).

foobarbazetc 9y ago

I store my 2FA in 4 different authenticator apps on my phone just in case. Google Authenticator has never restored these properly, ever. Encrypted backups or not.

mirekrusin 9y ago
I didn't know you can do that, I thought it generates device (app) hashed codes that are synced with first code or some other magic, just today I learned it's just based on this initial code (presented as qr usually) so you can do as you say, just record it in multiple places, great idea, especially that there are even command line tools for it. I'll replicate it on my desktop next time. For now I have to go to notary and send signed docs to amazon, hopefully that'll work to get back access.
sowbug 9y ago
It's not supposed to restore them.
Corrado 9y ago
You should try Authy. I switched over to it after I got burned by Google Authenticator deleting all my tokens after an upgrade. It can store your tokens in a encrypted central location and allows you to share tokens between devices (computer, phone, tablet, etc.) It kinda freaked me out at first but now I really like it.

komali2 9y ago

I like to think "thank god I have a google voice number" but then I realize if google just decides to shaft google voice, as the have to countless of their projects in the past, I am totally fucked in regards to the many things that 2fa off it.

artjumble 9y ago

I had this situation. I had an AWS account linked to some email I no longer had access to and could not get into the account. I opened a support ticket and they sent an email to the old address, after 10 days of no response they sent it to "Legal" for review. The account was then closed by them which resolved it for me.