4 ms·

I'd like to see another article showing the steps to go through if you lose your keys.

by arkh 8y ago

avn2109 8y ago
Yeah. That is the million dollar question.
fyfy18 8y ago
This is my biggest concern about 2FA. On Google I have TOTP 2FA enabled, with my phone number as a backup. But everything goes through my phone - I'm not really worried about some stealing my phone to gain access, but what happens if I break or lose my phone. A few years ago I was travelling abroad and had my suitcase stolen - which had my laptop (with FDE) and passport inside. Fortunately I had my phone and wallet on me, otherwise I really don't know what I would have done - I probably wouldn't even have remembered the name of the hotel I was staying at that night.
- andyjohnson0 8y ago
  Google allows you to print a set of codes [1] that can be used to access your account if your device is lost. I printed a set and have them stored in a secure place at home. Some people keep them in their wallet/bag/similar. [1] https://support.google.com/accounts/answer/1187538 https://support.google.com/accounts/answer/1187538
  - michaelt 8y ago
    According to [1] Advanced Protection uses a stricter implementation than Google has offered in the past: Only those physical keys—along with a password—will unlock your account. If you lose them, you can't use a printed out backup code So, no printed backup codes for Advanced Protection users!
    - andyjohnson0 8y ago
      (Presumably your [1] reference is this: https://www.wired.com/story/google-advanced-protection-locks-down-accounts/ https://www.wired.com/story/google-advanced-protection-locks... ) Good point, although I think the parent comment was about Google's existing 2FA rather than the new advanced protection setting.
    - arkh 8y ago
      That's the text making me want a follow-up article.
  - fyfy18 8y ago
    Yes I have those printed and stored securely, and also my landline set as a backup phone number, but that doesn't really help alleviate my concern of "what happens if I'm abroad and no longer have access to my phone". I guess keeping the codes with my at all times would work, but doesn't seem like that great an option (paper is easy to lose and easy to destroy). Maybe I should memorize some of them?
- greenleafjacob 8y ago
  When setting up TOTP you can copy the private key (basically the QR code) to a secure storage so you can restore it if your device gets lost or stolen.
  - michaelt 8y ago
    However, Google Advanced Protection uses only U2F, not TOTP, so that isn't an option if you're using the advanced protection.
- xrisk 8y ago
  I'm using an alternate OTP app called andOTP that lets you make AES encrypted backups. I save the backup file inside my password manager.
nickray 8y ago
You register more than one key, and use your backup. If the site lets you in without one of the keys you registered, it's a security theater :)
- rocqua 8y ago
  Google states there is a process to go through if you lose both keys that takes up to 3 days. The question is, how strict is this, and how easy is it to lock yourself out.
mimming 8y ago
You use a less convenient backup authentication. The specifics depend on the use case, but even if you fall back to something less secure like an email and TOTP, you still come out ahead overall because most authentications are done by U2F.
moduspwnens14 8y ago
I've been using U2F where possible for about a year, and I have a secondary Yubikey registered everywhere I have the primary registered. I am going to be switching to a USB-C one soon, though, and it only now occurred to me that I haven't really been keeping a "list" of all the sites where I've got them registered. Right now, not a lot of sites support it so it won't be too tough to find them. But I should probably be keeping a list so I at least can be sure when I've definitely replaced registered the new Yubikey in all places the old one was registered. That doesn't really address your question as to what happens when you lose your keys, but it's perhaps relevant that there are a few warts around replacing even keys you haven't lost.

I'd like to see another article showing the steps to go through if you lose your keys.

by arkh 8y ago

I'd like to see another article showing the steps to go through if you lose your keys.

avn2109 8y ago

Yeah. That is the million dollar question.

fyfy18 8y ago

This is my biggest concern about 2FA. On Google I have TOTP 2FA enabled, with my phone number as a backup. But everything goes through my phone - I'm not really worried about some stealing my phone to gain access, but what happens if I break or lose my phone. A few years ago I was travelling abroad and had my suitcase stolen - which had my laptop (with FDE) and passport inside. Fortunately I had my phone and wallet on me, otherwise I really don't know what I would have done - I probably wouldn't even have remembered the name of the hotel I was staying at that night.

andyjohnson0 8y ago
Google allows you to print a set of codes [1] that can be used to access your account if your device is lost. I printed a set and have them stored in a secure place at home. Some people keep them in their wallet/bag/similar. [1] https://support.google.com/accounts/answer/1187538 https://support.google.com/accounts/answer/1187538
- michaelt 8y ago
  According to [1] Advanced Protection uses a stricter implementation than Google has offered in the past: Only those physical keys—along with a password—will unlock your account. If you lose them, you can't use a printed out backup code So, no printed backup codes for Advanced Protection users!
  - andyjohnson0 8y ago
    (Presumably your [1] reference is this: https://www.wired.com/story/google-advanced-protection-locks-down-accounts/ https://www.wired.com/story/google-advanced-protection-locks... ) Good point, although I think the parent comment was about Google's existing 2FA rather than the new advanced protection setting.
  - arkh 8y ago
    That's the text making me want a follow-up article.
- fyfy18 8y ago
  Yes I have those printed and stored securely, and also my landline set as a backup phone number, but that doesn't really help alleviate my concern of "what happens if I'm abroad and no longer have access to my phone". I guess keeping the codes with my at all times would work, but doesn't seem like that great an option (paper is easy to lose and easy to destroy). Maybe I should memorize some of them?
greenleafjacob 8y ago
When setting up TOTP you can copy the private key (basically the QR code) to a secure storage so you can restore it if your device gets lost or stolen.
- michaelt 8y ago
  However, Google Advanced Protection uses only U2F, not TOTP, so that isn't an option if you're using the advanced protection.
xrisk 8y ago
I'm using an alternate OTP app called andOTP that lets you make AES encrypted backups. I save the backup file inside my password manager.

nickray 8y ago

You register more than one key, and use your backup. If the site lets you in without one of the keys you registered, it's a security theater :)

rocqua 8y ago
Google states there is a process to go through if you lose both keys that takes up to 3 days. The question is, how strict is this, and how easy is it to lock yourself out.

mimming 8y ago

You use a less convenient backup authentication. The specifics depend on the use case, but even if you fall back to something less secure like an email and TOTP, you still come out ahead overall because most authentications are done by U2F.

moduspwnens14 8y ago

I've been using U2F where possible for about a year, and I have a secondary Yubikey registered everywhere I have the primary registered. I am going to be switching to a USB-C one soon, though, and it only now occurred to me that I haven't really been keeping a "list" of all the sites where I've got them registered. Right now, not a lot of sites support it so it won't be too tough to find them. But I should probably be keeping a list so I at least can be sure when I've definitely replaced registered the new Yubikey in all places the old one was registered. That doesn't really address your question as to what happens when you lose your keys, but it's perhaps relevant that there are a few warts around replacing even keys you haven't lost.