3 ms·

Suppose we take Coinbase (I don't use it, but I've heard SIM swapping is done regularly with Coinbase): Suppose you lose all your physical keys: I don't think

by sdan 7y ago

Suppose we take Coinbase (I don't use it, but I've heard SIM swapping is done regularly with Coinbase): Suppose you lose all your physical keys: I don't think you can social engineer hack Coinbase (pretty sure most companies won't allow people to just give away your password/send a reset email to some other email). Or suppose you get them to send me an email to reset my password. But my email also has FIDO u2f! And I know as a fact you can't social hack my email provider.

tinus_hn 7y ago
Try it. Most companies don’t mind. The Google Authenticator app on iOS doesn’t backup its keys so it’s pretty common for people to lose access to that kind of keys.
- bipson 7y ago
  I don't think you completely understand the concept behind the Google Authenticator App, i.e. the standard it implements. Which keys is it supposed to backup? Everything else you said is sadly true.
  - tinus_hn 7y ago
    You would expect that if you restore the full backup of your iOS device to a new one, because you lost it for instance, that on the new device you could open the Authenticator app and see the same keys as you had on your old device. That is not the case though. Under the hood Google Authenticator uses keys to generate the codes you see on screen and these keys are not backed up. It’s a difficult decision of course. If you back them up in iCloud Apple and people who hack your Apple account have access. If you don’t the keys are lost if the device breaks or is lost and you need a workaround.
    - dev_dull 7y ago
      I think they do backup if you do an offline (e.g. iTunes) full backup and restore on the same device, which of course is never what people do.
      - tinus_hn 7y ago
        No, I know because that’s what I do and I had this fail on me when I migrated to a new phone. I switched to a different app that does backup keys when you use an encrypted iTunes backup. Edit: oh you wanted to restore on the same device. Well that might work but it doesn’t help when migrating or if your phone is not available.
        deleted 7y ago
        [deleted]
- sdan 7y ago
  That's why I use Authy (able to have backup keys).

by sdan 7y ago

tinus_hn 7y ago

Try it. Most companies don’t mind. The Google Authenticator app on iOS doesn’t backup its keys so it’s pretty common for people to lose access to that kind of keys.

bipson 7y ago
I don't think you completely understand the concept behind the Google Authenticator App, i.e. the standard it implements. Which keys is it supposed to backup? Everything else you said is sadly true.
- tinus_hn 7y ago
  You would expect that if you restore the full backup of your iOS device to a new one, because you lost it for instance, that on the new device you could open the Authenticator app and see the same keys as you had on your old device. That is not the case though. Under the hood Google Authenticator uses keys to generate the codes you see on screen and these keys are not backed up. It’s a difficult decision of course. If you back them up in iCloud Apple and people who hack your Apple account have access. If you don’t the keys are lost if the device breaks or is lost and you need a workaround.
  - dev_dull 7y ago
    I think they do backup if you do an offline (e.g. iTunes) full backup and restore on the same device, which of course is never what people do.
    - tinus_hn 7y ago
      No, I know because that’s what I do and I had this fail on me when I migrated to a new phone. I switched to a different app that does backup keys when you use an encrypted iTunes backup. Edit: oh you wanted to restore on the same device. Well that might work but it doesn’t help when migrating or if your phone is not available.
      - deleted 7y ago
        [deleted]
sdan 7y ago
That's why I use Authy (able to have backup keys).