4 ms·

Yeah for sure, It was kind of my fault. It all happened very quickly, I think 2FA was relatively new at the time. I kept getting ‘recommendations’ from Google t

by 40four 7y ago

Yeah for sure, It was kind of my fault. It all happened very quickly, I think 2FA was relatively new at the time. I kept getting ‘recommendations’ from Google to enable it to be more secure. As a dutiful user I obliged, and downloaded the authenticator app. I think it gave me 10 one time recovery codes, but of course I didn’t back them up externally :) I was having some performance issues with my Samsung phone at the time, and a couple days later, did a factory reset. Then when it came back on and I tried to log into my google account, my stomach sank to the floor when I realized I could not get in without the authenticator app. That was that. Everything gone. What an idiot :) Couldn’t even get on through a computer without the stupid codes I could no longer generate. Answered all the questions, identified specific emails, personal info etc. Google was not impressed.

zozbot234 7y ago
> I kept getting ‘recommendations’ from Google to enable it to be more secure. Yes, this is problematic in itself. Hardware-based 2FA is not an unqualified win; I definitely would not want to use it without some very robust contingency plans of what to do if my authentication device gets bricked or otherwise malfunctions.
- 40four 7y ago
  Agreed. The whole app based 2FA does not seem great in retrospect. I accidentally bricked my whole account, by simple user error. That’s a good point, that it could just happen from a hardware malfunction as well. Seems like most 2FA these days is based on the service sending you the code by text or email. Sounds like a much better approach.
petee 7y ago
I think at core it is their fault for letting users pick a single software 2FA method without a second device, its a poor design choice. Asking users to print backup codes shouldn't count, it needs to be a second device. It is a bad fallback method especially because you can't force users to do it, but you still have to deal with the fallout later. While we are at it, if you're printing codes, you might as well print your passwords too. This is why hardware tokes are a world better than software based...multiple hardware keys are required, you can't choose to not back it up, although what you do with that second key is critical too but its easier to track than a slip of paper.

by 40four 7y ago

zozbot234 7y ago

> I kept getting ‘recommendations’ from Google to enable it to be more secure. Yes, this is problematic in itself. Hardware-based 2FA is not an unqualified win; I definitely would not want to use it without some very robust contingency plans of what to do if my authentication device gets bricked or otherwise malfunctions.

40four 7y ago
Agreed. The whole app based 2FA does not seem great in retrospect. I accidentally bricked my whole account, by simple user error. That’s a good point, that it could just happen from a hardware malfunction as well. Seems like most 2FA these days is based on the service sending you the code by text or email. Sounds like a much better approach.

petee 7y ago

I think at core it is their fault for letting users pick a single software 2FA method without a second device, its a poor design choice. Asking users to print backup codes shouldn't count, it needs to be a second device. It is a bad fallback method especially because you can't force users to do it, but you still have to deal with the fallout later. While we are at it, if you're printing codes, you might as well print your passwords too. This is why hardware tokes are a world better than software based...multiple hardware keys are required, you can't choose to not back it up, although what you do with that second key is critical too but its easier to track than a slip of paper.