6 ms·

I recently lost access to my two factor authenticator. I had saved most but not all of my recovery codes. I was surprised that a couple of websites I didn't hav

I recently lost access to my two factor authenticator. I had saved most but not all of my recovery codes. I was surprised that a couple of websites I didn't have recovery codes for allowed me to disable 2FA after login but before authentication. It saved me from having to contact support, but it seemed to defeat the purpose of 2FA.

Thriptic 8y ago
This happened to me as well with Uber. They use SMS 2FA and didn't provide any backups. I left my phone in an Uber and I couldn't log into my account to notify the driver because 2FA was in place. I also couldn't contact Uber about the issue because they try as hard as possible not to provide customer service mechanisms for people to leverage. At the end of the day I had to use another friend's Uber account to contact Uber and explain the situation. They disabled 2FA and let me back into my account. I suppose Uber could validate the GPS position of the driver and my phone and use that to validate my story, but I doubt they went through all that trouble :(
- reymus 8y ago
  >I suppose Uber could validate the GPS position of the driver and my phone and use that to validate my story, but I doubt they went through all that trouble :( For that, I assume they would need to have tools built for that specific purpose, with security/audit in place. I doubt any support guy could just randomly query for GPS data for drivers/users.
  - SmellyGeekBoy 8y ago
    > I doubt any support guy could just randomly query for GPS data for drivers/users. There was a very widely publicised case a few years back when their support people were doing just this to stalk celebrities and exes. How quickly the world moves on, I guess.
- achompas 8y ago
  This was not my recent experience with Uber's 2FA at all. I had purchased a new phone, but lost cellular service and couldn't authenticate into Uber. I found contact info and they asked me to verify my recent ride history (including fares, times, and destinations) before disabling 2FA for me.
  - Thriptic 8y ago
    This happened to me about a year ago
em-bee 8y ago
how did you loose your 2FA device? this is what scares me the most about using 2FA. github for example says if 2FA is lost there is not way to recover. i have lost a phone number before... and although github also supports other 2FA devices, such as a rotating key app which can be on multiple devices, you have to set up all devices at once. so i can put it on my laptop and my phone, but not my home and my work computer unless i carry one to the other place. phone and laptop is not enough. if i use my bag, both are gone. and i'd have to reset all devices if i ever want to add a new one. at that point i am more afraid to loose access through stupidity than through theft. no thanks. greetings, eMBee.
- expiredtofu 8y ago
  That's what the backup codes 2FA provides are for, no?
  - guywhocodes 8y ago
    I've lost those in the same theft as I lost my 2fa device for github. Not going to store them outside of my password manager for github again. So why do I use 2fa for github? Because organizations require it.
    - Buge 8y ago
      There are still benefits of 2fa even if codes are stored in your password manager. It protects against most keyloggers. It probably makes phishing a little less likely (because most websites cache 2fa, so you'll be a little more suspicious when asked for it by a phishing site). It protects people who use weak or reused passwords. Sometimes it causes support staff to be more careful with regard to social engineering.
- dharmab 8y ago
  A very valid concern- I was in a serious vehicle accident this year and it took weeks for all of my keys and possessions to make it back to me. Luckily I didn't need 2FA for my email or insurance.
- 8y ago
Buge 8y ago
2FA is usually to protect you against your password being stolen. If that's the only threat model, then it's fine to allow 2FA to be disabled without a new 2FA code, as long as it's from a device that has entered a 2FA code at some point in the past. There are other potential threat models though that would require a re-enter of the 2FA code to be safe, such as cookie theft, or temporary computer compromise. Both of these though seem less likely of attacks.
fragmede 8y ago
> It saved me from having to contact support This is not an insignificant consideration. Companies track support calls (call volume - and their reported reason, is monitored closely) as a matter of business. I have heard companies going back on enabling two/multi-factor auth, once realizing support volume goes up. (Which is silly, because of course it goes up compared to not if you didn't allow it before.)

Thriptic 8y ago

This happened to me as well with Uber. They use SMS 2FA and didn't provide any backups. I left my phone in an Uber and I couldn't log into my account to notify the driver because 2FA was in place. I also couldn't contact Uber about the issue because they try as hard as possible not to provide customer service mechanisms for people to leverage. At the end of the day I had to use another friend's Uber account to contact Uber and explain the situation. They disabled 2FA and let me back into my account. I suppose Uber could validate the GPS position of the driver and my phone and use that to validate my story, but I doubt they went through all that trouble :(

reymus 8y ago
>I suppose Uber could validate the GPS position of the driver and my phone and use that to validate my story, but I doubt they went through all that trouble :( For that, I assume they would need to have tools built for that specific purpose, with security/audit in place. I doubt any support guy could just randomly query for GPS data for drivers/users.
- SmellyGeekBoy 8y ago
  > I doubt any support guy could just randomly query for GPS data for drivers/users. There was a very widely publicised case a few years back when their support people were doing just this to stalk celebrities and exes. How quickly the world moves on, I guess.
achompas 8y ago
This was not my recent experience with Uber's 2FA at all. I had purchased a new phone, but lost cellular service and couldn't authenticate into Uber. I found contact info and they asked me to verify my recent ride history (including fares, times, and destinations) before disabling 2FA for me.
- Thriptic 8y ago
  This happened to me about a year ago

em-bee 8y ago

how did you loose your 2FA device? this is what scares me the most about using 2FA. github for example says if 2FA is lost there is not way to recover. i have lost a phone number before... and although github also supports other 2FA devices, such as a rotating key app which can be on multiple devices, you have to set up all devices at once. so i can put it on my laptop and my phone, but not my home and my work computer unless i carry one to the other place. phone and laptop is not enough. if i use my bag, both are gone. and i'd have to reset all devices if i ever want to add a new one. at that point i am more afraid to loose access through stupidity than through theft. no thanks. greetings, eMBee.

expiredtofu 8y ago
That's what the backup codes 2FA provides are for, no?
- guywhocodes 8y ago
  I've lost those in the same theft as I lost my 2fa device for github. Not going to store them outside of my password manager for github again. So why do I use 2fa for github? Because organizations require it.
  - Buge 8y ago
    There are still benefits of 2fa even if codes are stored in your password manager. It protects against most keyloggers. It probably makes phishing a little less likely (because most websites cache 2fa, so you'll be a little more suspicious when asked for it by a phishing site). It protects people who use weak or reused passwords. Sometimes it causes support staff to be more careful with regard to social engineering.
dharmab 8y ago
A very valid concern- I was in a serious vehicle accident this year and it took weeks for all of my keys and possessions to make it back to me. Luckily I didn't need 2FA for my email or insurance.
8y ago

Buge 8y ago

2FA is usually to protect you against your password being stolen. If that's the only threat model, then it's fine to allow 2FA to be disabled without a new 2FA code, as long as it's from a device that has entered a 2FA code at some point in the past. There are other potential threat models though that would require a re-enter of the 2FA code to be safe, such as cookie theft, or temporary computer compromise. Both of these though seem less likely of attacks.

fragmede 8y ago

> It saved me from having to contact support This is not an insignificant consideration. Companies track support calls (call volume - and their reported reason, is monitored closely) as a matter of business. I have heard companies going back on enabling two/multi-factor auth, once realizing support volume goes up. (Which is silly, because of course it goes up compared to not if you didn't allow it before.)