4 ms·

I'm not defending this, but this could be seen as a way to increase usability — if you lose your 2FA token but you're still logged into a session, you can still

I'm not defending this, but this could be seen as a way to increase usability — if you lose your 2FA token but you're still logged into a session, you can still disable 2FA and potentially re-add the token. Obviously though, that excuse becomes an exploit the moment you change your tone of voice, so there's that.

ocdtrekkie 6y ago
That's what backup codes are for, or backing up your 2FA app. Enabling 2FA is an acknowledgement that you expect to be responsible for maintaining access to your second factor: It's reasonable to require you still have it when you shut that off. That being said, Google is far from being unique in this issue.
- Wowfunhappy 6y ago
  > Enabling 2FA is an acknowledgement that you expect to be responsible for maintaining access to your second factor. On the other hand, articles all over the place increasingly recommend it to everyone.
- loktarogar 6y ago
  > Enabling 2FA is an acknowledgement that you expect to be responsible for maintaining access to your second factor Maybe to you and me, but to everyone else it's just a recommended (and in many cases forced) method to gain access to your own account. My mum isn't making a pledge to always have her phone with her, she just doesn't want her email stolen
- Koenvh 6y ago
  In theory, yes, and I think most people here would store their backup codes properly. However, there are many people who don't store them properly, and don't think about it until it's too late. They lose their token, break their phone, or lose access in one of the many other ways. Sure, you can say "tough luck", but then people will complain, reasonable or not, and Google probably doesn't want that to happen. I think this is a reasonable compromise when it comes to security and usability.
  - sceutre 6y ago
    If I have 15 sites in google authenticator is it such a win that 1/15th of them will allow me to reset without needing the second factor? Backing up the app or backup codes seems needed to scale to widespread 2FA use.
  - kkarakk 6y ago
    i know my life was flashing before my eyes when i logged out of my old phone and then my new phone asked for 2FA coz like a dumbo i stored the 8 codes in google drive...
mtgx 6y ago
Then why even bother with 2FA? Just for the "safety feels"? The point of 2FA is that someone that gets access to your account, such as by saying "they broke their phone and need access again", shouldn't be able to do it without the 2FA code. I'm not sure if it's still the case now, but it must have been like at least a 4-5 years period in which auth codes/tokens were basically useless because Google would automatically fallback to SMS codes. Same issue - why offer with other "stronger" 2FA methods, if all of them will fallback to SMS?

ocdtrekkie 6y ago

That's what backup codes are for, or backing up your 2FA app. Enabling 2FA is an acknowledgement that you expect to be responsible for maintaining access to your second factor: It's reasonable to require you still have it when you shut that off. That being said, Google is far from being unique in this issue.

Wowfunhappy 6y ago
> Enabling 2FA is an acknowledgement that you expect to be responsible for maintaining access to your second factor. On the other hand, articles all over the place increasingly recommend it to everyone.
loktarogar 6y ago
> Enabling 2FA is an acknowledgement that you expect to be responsible for maintaining access to your second factor Maybe to you and me, but to everyone else it's just a recommended (and in many cases forced) method to gain access to your own account. My mum isn't making a pledge to always have her phone with her, she just doesn't want her email stolen
Koenvh 6y ago
In theory, yes, and I think most people here would store their backup codes properly. However, there are many people who don't store them properly, and don't think about it until it's too late. They lose their token, break their phone, or lose access in one of the many other ways. Sure, you can say "tough luck", but then people will complain, reasonable or not, and Google probably doesn't want that to happen. I think this is a reasonable compromise when it comes to security and usability.
- sceutre 6y ago
  If I have 15 sites in google authenticator is it such a win that 1/15th of them will allow me to reset without needing the second factor? Backing up the app or backup codes seems needed to scale to widespread 2FA use.
- kkarakk 6y ago
  i know my life was flashing before my eyes when i logged out of my old phone and then my new phone asked for 2FA coz like a dumbo i stored the 8 codes in google drive...

mtgx 6y ago

Then why even bother with 2FA? Just for the "safety feels"? The point of 2FA is that someone that gets access to your account, such as by saying "they broke their phone and need access again", shouldn't be able to do it without the 2FA code. I'm not sure if it's still the case now, but it must have been like at least a 4-5 years period in which auth codes/tokens were basically useless because Google would automatically fallback to SMS codes. Same issue - why offer with other "stronger" 2FA methods, if all of them will fallback to SMS?