3 ms·
This is my biggest concern about 2FA. On Google I have TOTP 2FA enabled, with my phone number as a backup. But everything goes through my phone - I'm not really
by fyfy18 8y ago
This is my biggest concern about 2FA. On Google I have TOTP 2FA enabled, with my phone number as a backup. But everything goes through my phone - I'm not really worried about some stealing my phone to gain access, but what happens if I break or lose my phone.
A few years ago I was travelling abroad and had my suitcase stolen - which had my laptop (with FDE) and passport inside. Fortunately I had my phone and wallet on me, otherwise I really don't know what I would have done - I probably wouldn't even have remembered the name of the hotel I was staying at that night.
- andyjohnson0 8y agoGoogle allows you to print a set of codes [1] that can be used to access your account if your device is lost. I printed a set and have them stored in a secure place at home. Some people keep them in their wallet/bag/similar. [1] https://support.google.com/accounts/answer/1187538 https://support.google.com/accounts/answer/1187538
- michaelt 8y agoAccording to [1] Advanced Protection uses a stricter implementation than Google has offered in the past: Only those physical keys—along with a password—will unlock your account. If you lose them, you can't use a printed out backup code So, no printed backup codes for Advanced Protection users!
- andyjohnson0 8y ago(Presumably your [1] reference is this: https://www.wired.com/story/google-advanced-protection-locks-down-accounts/ https://www.wired.com/story/google-advanced-protection-locks... ) Good point, although I think the parent comment was about Google's existing 2FA rather than the new advanced protection setting.
- arkh 8y agoThat's the text making me want a follow-up article.
- fyfy18 8y agoYes I have those printed and stored securely, and also my landline set as a backup phone number, but that doesn't really help alleviate my concern of "what happens if I'm abroad and no longer have access to my phone". I guess keeping the codes with my at all times would work, but doesn't seem like that great an option (paper is easy to lose and easy to destroy). Maybe I should memorize some of them?
- greenleafjacob 8y agoWhen setting up TOTP you can copy the private key (basically the QR code) to a secure storage so you can restore it if your device gets lost or stolen.
- michaelt 8y agoHowever, Google Advanced Protection uses only U2F, not TOTP, so that isn't an option if you're using the advanced protection.
- xrisk 8y agoI'm using an alternate OTP app called andOTP that lets you make AES encrypted backups. I save the backup file inside my password manager.