3 ms·

but when somewhere like Cloudflare insists on ONLY using Authy it makes me want to look elsewhere for service. Cloudflare supports Authy and Google Authenticat

but when somewhere like Cloudflare insists on ONLY using Authy it makes me want to look elsewhere for service. Cloudflare supports Authy and Google Authenticator (or any TOTP-compliant app): https://blog.cloudflare.com/you-can-now-use-google-authenticator/ https://blog.cloudflare.com/you-can-now-use-google-authentic...

woogley 9y ago
Thank you, I didn't know this, and it was something I was judging against CF for years. It makes me a little uncomfortable though that there aren't any offline recovery codes in the event the TOTP device is lost/stolen/etc EDIT: as pointed out below, there is one briefly on the QR dialog, it's not a separate sheet you generate/download like GitHub/Google/etc
- gtirloni 9y ago
  There is a backup code. "Your second-factor backup code is 'blah'. This can be used for manual setup, and is necessary to recover your account in case your mobile phone is lost or stolen."
- kolp 9y ago
  Be careful using 2FA on CF. I got locked out of my account because I reformatted my phone and hadn't kept backup codes. That's my fault, not CF's. They wouldn't accept email verification or uploading a html file to the root of my domains to grant access. But here's the kicker: Cloudflare were happy to grant access if I could recall some previous name server history for some of my domains. Information that is in the public domain and can be purchased as a report.
  - woogley 9y ago
    Customer Support (well, humans in general) is the biggest threat to security, unfortunately .. :( This one comes to mind, I think I remember an Amazon-related story along the same lines .. https://www.macrumors.com/2012/08/05/apple-support-allowed-hacker-access-to-reporters-icloud-account/ https://www.macrumors.com/2012/08/05/apple-support-allowed-h...
  - ce4 9y ago
    You may not even need backup codes. Just save a copy of the google authenticator setup QR code. It's just email/key, when decoded.
  - deleted 9y ago
    [deleted]
  - jgrahamc 9y ago
    Thanks for writing this. I will talk to the support team about it.

woogley 9y ago

Thank you, I didn't know this, and it was something I was judging against CF for years. It makes me a little uncomfortable though that there aren't any offline recovery codes in the event the TOTP device is lost/stolen/etc EDIT: as pointed out below, there is one briefly on the QR dialog, it's not a separate sheet you generate/download like GitHub/Google/etc

gtirloni 9y ago
There is a backup code. "Your second-factor backup code is 'blah'. This can be used for manual setup, and is necessary to recover your account in case your mobile phone is lost or stolen."
kolp 9y ago
Be careful using 2FA on CF. I got locked out of my account because I reformatted my phone and hadn't kept backup codes. That's my fault, not CF's. They wouldn't accept email verification or uploading a html file to the root of my domains to grant access. But here's the kicker: Cloudflare were happy to grant access if I could recall some previous name server history for some of my domains. Information that is in the public domain and can be purchased as a report.
- woogley 9y ago
  Customer Support (well, humans in general) is the biggest threat to security, unfortunately .. :( This one comes to mind, I think I remember an Amazon-related story along the same lines .. https://www.macrumors.com/2012/08/05/apple-support-allowed-hacker-access-to-reporters-icloud-account/ https://www.macrumors.com/2012/08/05/apple-support-allowed-h...
- ce4 9y ago
  You may not even need backup codes. Just save a copy of the google authenticator setup QR code. It's just email/key, when decoded.
- deleted 9y ago
  [deleted]
- jgrahamc 9y ago
  Thanks for writing this. I will talk to the support team about it.