3 ms·

My big mistake was to use 2FA - more precisely authenticator. Around the same time my old phone broke and i had to change the password. I must have mistyped t

My big mistake was to use 2FA - more precisely authenticator. Around the same time my old phone broke and i had to change the password. I must have mistyped the password while changing it in both fields and since then have never managed to re-access the account. I have old passwords, backup email, previous contacts, phone, ... But i cant restore the password because i hadnt yet set up authenticator on my new phone. My fault? Probably. But that there's no way out, no option beyond the horrible restore wizard - that's Google's irresponsibility. How many millions must have lost access to their gmail accounts by now?

awtawtwat3aw 6y ago
They give you backup codes to write down, champ.
yumraj 6y ago
Backup codes and use of Authy (running on phone and desktop), instead of Google Authenticator, can help in such situations.
- therein 6y ago
  Authy on desktop sounds like such a terrible idea, though. Take that second factor and put it right next to the first.
  - yumraj 6y ago
    Not sure I get it. 2FA does not protect anyone from someone having your password AND having your phone or desktop. It prevents from someone, somewhere, having your password but not your 2nd factor.
    - tonyedgecombe 6y ago
      If someone manages to put software on your desktop then they have access to your password and 2nd factor.
      - Spivak 6y ago
        But that’s your phone too. The second factor, is practice, having access to an active session on your device.
      - the_snooze 6y ago
        I mean, it's game over in pretty much any situation that your endpoints are compromised. It's incorrect to take these measures as giving perfect security. They're efforts to greatly increase the cost for attackers. It's a pretty good improvement to increase effort from "having a password" to "having remote access to your computer."
        tonyedgecombe 6y ago
        I'd still rather they didn't have direct access to my second factor in that situation.
  - the_pwner224 6y ago
    How is this any different from what you have on your phone? If someone hacks your phone they have access to all your email, whether you have 2fa set up or not. If someone hacks your computer in this case then they also get access to all your email. The thing that 2fa is good at is preventing hackers from logging in if they guess or find out your password. If your device is compromised then everything you do on it is vulnerable, no matter how many factors you have.
- nullify88 6y ago
  Alternatively if you dont want your keys stored in Authys cloud, you can replace Authy with AndOTP and export your keys in to an encrypted file which can be imported later back in to your phone when needed.
  - MayeulC 6y ago
    That's wahat I did for a while, but I heard Aegis takes security more seriously than AndOTP, so I use that now (both are available on F-droid). AndOTP has some support for SteamGuard (though not everything), which I can't use since I refuse any proprietary app on my phone. I wish websites supported PAKE, Fido U2F, Webauthn, TOTP and Client certs across the board, but that's probably a pipe dream :)

awtawtwat3aw 6y ago

They give you backup codes to write down, champ.

yumraj 6y ago

Backup codes and use of Authy (running on phone and desktop), instead of Google Authenticator, can help in such situations.

therein 6y ago
Authy on desktop sounds like such a terrible idea, though. Take that second factor and put it right next to the first.
- yumraj 6y ago
  Not sure I get it. 2FA does not protect anyone from someone having your password AND having your phone or desktop. It prevents from someone, somewhere, having your password but not your 2nd factor.
  - tonyedgecombe 6y ago
    If someone manages to put software on your desktop then they have access to your password and 2nd factor.
    - Spivak 6y ago
      But that’s your phone too. The second factor, is practice, having access to an active session on your device.
    - the_snooze 6y ago
      I mean, it's game over in pretty much any situation that your endpoints are compromised. It's incorrect to take these measures as giving perfect security. They're efforts to greatly increase the cost for attackers. It's a pretty good improvement to increase effort from "having a password" to "having remote access to your computer."
      - tonyedgecombe 6y ago
        I'd still rather they didn't have direct access to my second factor in that situation.
- the_pwner224 6y ago
  How is this any different from what you have on your phone? If someone hacks your phone they have access to all your email, whether you have 2fa set up or not. If someone hacks your computer in this case then they also get access to all your email. The thing that 2fa is good at is preventing hackers from logging in if they guess or find out your password. If your device is compromised then everything you do on it is vulnerable, no matter how many factors you have.
nullify88 6y ago
Alternatively if you dont want your keys stored in Authys cloud, you can replace Authy with AndOTP and export your keys in to an encrypted file which can be imported later back in to your phone when needed.
- MayeulC 6y ago
  That's wahat I did for a while, but I heard Aegis takes security more seriously than AndOTP, so I use that now (both are available on F-droid). AndOTP has some support for SteamGuard (though not everything), which I can't use since I refuse any proprietary app on my phone. I wish websites supported PAKE, Fido U2F, Webauthn, TOTP and Client certs across the board, but that's probably a pipe dream :)