4 ms·

There has to be a mechanism where you can get your account back if you provide some form of identification. I know that you get into other issues that way, but

There has to be a mechanism where you can get your account back if you provide some form of identification. I know that you get into other issues that way, but 2fa without a mechanism to restore account in case of phone/code loss (or inability to access, which is somewhat likely if you don't keep multiple copies of your codes) is pretty stupid.

fnky 7y ago
I'd love to hear of any solutions on this. The solution should, however, be insusceptible to remote attacks, that could put a user's account at risk. 2FA with SMS has the problem that companies offer support by human and don't have a tight system for changing numbers to another phone, as proven again and again, resulting in accounts being compromised. While the current solution of MFA aren't perfect, it's hard to come up with other solution that would be as safe or safer and prevent most to all mechanisms used to compromise accounts, like phishing, social engineering and other possible remote attacks. Giving you the possibility to save the codes somewhere physical has its downsides, but an important upside is that it allows _you_ to keep in charge your own security in most cases.
xondono 7y ago
The one I've had to use (and find reasonable) is to have "trusted devices". That's how it works, at least with 1Password: - You log with your 2FA into a device. - You set this device as trusted. - In case you lose your phone or 2FA device, log onto the trusted device and disable 2FA. - Then set up 2FA again with new phone or device. It's not perfect, but it's workable. For instance, while I won't enable trusted device on my laptop, having my desktop stolen is a way rarer occasion, so I enable the "trust this device" options. It's just a matter of thinking on the threat model and where you can place spots for recovery while loosing as little security as possible.
- ProZsolt 7y ago
  But that fine because the trusted device is the second factor (what you have). You can have multiple second factors with Github. I currently have two Yubikeys and one authenticator app enabled. If I lose one I can still log in with another.

fnky 7y ago

I'd love to hear of any solutions on this. The solution should, however, be insusceptible to remote attacks, that could put a user's account at risk. 2FA with SMS has the problem that companies offer support by human and don't have a tight system for changing numbers to another phone, as proven again and again, resulting in accounts being compromised. While the current solution of MFA aren't perfect, it's hard to come up with other solution that would be as safe or safer and prevent most to all mechanisms used to compromise accounts, like phishing, social engineering and other possible remote attacks. Giving you the possibility to save the codes somewhere physical has its downsides, but an important upside is that it allows _you_ to keep in charge your own security in most cases.

xondono 7y ago

The one I've had to use (and find reasonable) is to have "trusted devices". That's how it works, at least with 1Password: - You log with your 2FA into a device. - You set this device as trusted. - In case you lose your phone or 2FA device, log onto the trusted device and disable 2FA. - Then set up 2FA again with new phone or device. It's not perfect, but it's workable. For instance, while I won't enable trusted device on my laptop, having my desktop stolen is a way rarer occasion, so I enable the "trust this device" options. It's just a matter of thinking on the threat model and where you can place spots for recovery while loosing as little security as possible.

ProZsolt 7y ago
But that fine because the trusted device is the second factor (what you have). You can have multiple second factors with Github. I currently have two Yubikeys and one authenticator app enabled. If I lose one I can still log in with another.