6 ms·

Sometime back, I had 2fa set up on a phone, which eventually gave up the ghost. What this did was to lock me out of google and many other services I depended o

Sometime back, I had 2fa set up on a phone, which eventually gave up the ghost. What this did was to lock me out of google and many other services I depended on. Most painful was being locked out of email. Any suggestion on how to mitigate device/ hardware failure?

throwawayay02 6y ago
Save the security codes. I keep a small file encrypted with Veracrypt with the "top level passwords", things like email, password managers and one time recovery codes. And since this is the last recourse, the password for this file is only stored physically.
- evgen 6y ago
  It is also worth considering your threat model in this case. I am unlikely to face an attacker with nation-state resources, so I actually print out my backup codes on paper along with instructions on how to use them to bootstrap my entire password/auth chain. I then put that paper into a safety deposit box with a copy of my will and other docs my wife and family might need if I drop dead of a heart attack. No passwords to remember, or realize that I forgot at the point where I least want that to happen and secure against the threat models I consider most likely.
e40 6y ago
Save the qrcode in 1password. Makes seeing up a new phone trivial. Also, 1password can generate the top.
- williamtwild 6y ago
  I see 1password on HN frequently. I opted for bitwarden after leaving lasspass. Any comments on BW vs 1pass?
  - mewse 6y ago
    I switched from 1Password to LastPass because (at the time) 1Password’s support on Windows was rudimentary, and on Linux was basically non-existant. And then I switched from LastPass to BitWarden, because I became uncomfortable with LastPass (for reasons which I don’t recall). And then when 1Password released their 1Password X system which works via a browser extension that works really nicely across Windows/Mac/Linux/iOS/etc, I switched from BitWarden back to 1Password again. (caveat: I haven’t actually tested the chrome extension myself; only the firefox and safari ones) RE: BitWarden vs 1Password, they’re pretty similar in most respects. 1Password is arguably more polished (especially in the native OS X app), and has support for storing multiple separate vaults of data (a feature which I don’t actually use). BitWarden has the ability to self-host the server (which I’ve never done, but I very much appreciated that it was an option), and 1Password historically let you just sync your vault file however you wanted to; I had mine in a Dropbox folder to share between computers, for a while, and it worked great. But now with 1Password X, they want you to use their servers. Which obvs is less great, but.. I’m willing to put up with it, personally. (I mean, I was doing the same with LastPass and BitWarden already, anyway). For me, the big killer feature for 1Password is that it can handle “Authenticator” features; scan the QR code into 1Password and it’ll handle the TOTP code for 2FA in addition to your username/password, etc. It’s so much nicer to have it all integrated together in a single flow than to need to find my phone and launch Authy separately every time I want to log into a web site.
    - kingcan 6y ago
      Bitwarden can also handle TOTP codes, but you need premium ($10 / year).
dijksterhuis 6y ago
Services like GitHub, Gmail, Apple etc allow you to use recovery keys in place of 2FA for this exact circumstance. The keys are generated by the service and you must make a note of them ahead of time. And keep them secure obviously. You get about 10 possible keys from GitHub iirc. Also, some services (Google, apple) allow you to perform 2FA over multiple options like one of TOTP, phone call, SMS or other device interaction (in apple's case). So if the device gets bricked, find a cheap replacement and Bob's your auntie.
smichel17 6y ago
Buy a physical U2F key and add it also on accounts where you enable 2FA. Now you're only locked out if you lose both it and your phone. I use one of these https://www.yubico.com/product/security-key-by-yubico/ https://www.yubico.com/product/security-key-by-yubico/
- fmajid 6y ago
  At least 2 keys for redundancy in case of loss or theft. I have 4 Yubikeys (2 of them freebies with an Ars Technica and Wired subscription).
  - smichel17 6y ago
    Redundancy is taken care of by the TOTP app on your phone.
OJFord 6y ago
Not GP, but I use Authy, which allows multiple devices, approving each new one with one of the others. I don't recommend using its browser add-on though, so this only fixes your case if you have two (or more) devices to use that will be active at the same time, so that any one (all but one) can die. Also, have multiple forms of 2FA (as in any one may be used) such as a FIDO key or printed codes.
deleted 6y ago
[deleted]
solarkraft 6y ago
You can scan the same QR code with multiple devices or (less secure but mayve reasonable) save the code somehow. Some apps also let you export the token (but definitely not Google Authenticator, that app's data doesn't even get backed up).
croutonwagon 6y ago
Google auth works if you scan the QR code with multiple devices at setup. So I keep a spare phone at home i my safe with google auth setup. Just in case my primary is lost or stolen.

throwawayay02 6y ago

Save the security codes. I keep a small file encrypted with Veracrypt with the "top level passwords", things like email, password managers and one time recovery codes. And since this is the last recourse, the password for this file is only stored physically.

evgen 6y ago
It is also worth considering your threat model in this case. I am unlikely to face an attacker with nation-state resources, so I actually print out my backup codes on paper along with instructions on how to use them to bootstrap my entire password/auth chain. I then put that paper into a safety deposit box with a copy of my will and other docs my wife and family might need if I drop dead of a heart attack. No passwords to remember, or realize that I forgot at the point where I least want that to happen and secure against the threat models I consider most likely.

e40 6y ago

Save the qrcode in 1password. Makes seeing up a new phone trivial. Also, 1password can generate the top.

williamtwild 6y ago
I see 1password on HN frequently. I opted for bitwarden after leaving lasspass. Any comments on BW vs 1pass?
- mewse 6y ago
  I switched from 1Password to LastPass because (at the time) 1Password’s support on Windows was rudimentary, and on Linux was basically non-existant. And then I switched from LastPass to BitWarden, because I became uncomfortable with LastPass (for reasons which I don’t recall). And then when 1Password released their 1Password X system which works via a browser extension that works really nicely across Windows/Mac/Linux/iOS/etc, I switched from BitWarden back to 1Password again. (caveat: I haven’t actually tested the chrome extension myself; only the firefox and safari ones) RE: BitWarden vs 1Password, they’re pretty similar in most respects. 1Password is arguably more polished (especially in the native OS X app), and has support for storing multiple separate vaults of data (a feature which I don’t actually use). BitWarden has the ability to self-host the server (which I’ve never done, but I very much appreciated that it was an option), and 1Password historically let you just sync your vault file however you wanted to; I had mine in a Dropbox folder to share between computers, for a while, and it worked great. But now with 1Password X, they want you to use their servers. Which obvs is less great, but.. I’m willing to put up with it, personally. (I mean, I was doing the same with LastPass and BitWarden already, anyway). For me, the big killer feature for 1Password is that it can handle “Authenticator” features; scan the QR code into 1Password and it’ll handle the TOTP code for 2FA in addition to your username/password, etc. It’s so much nicer to have it all integrated together in a single flow than to need to find my phone and launch Authy separately every time I want to log into a web site.
  - kingcan 6y ago
    Bitwarden can also handle TOTP codes, but you need premium ($10 / year).

dijksterhuis 6y ago

Services like GitHub, Gmail, Apple etc allow you to use recovery keys in place of 2FA for this exact circumstance. The keys are generated by the service and you must make a note of them ahead of time. And keep them secure obviously. You get about 10 possible keys from GitHub iirc. Also, some services (Google, apple) allow you to perform 2FA over multiple options like one of TOTP, phone call, SMS or other device interaction (in apple's case). So if the device gets bricked, find a cheap replacement and Bob's your auntie.

smichel17 6y ago

Buy a physical U2F key and add it also on accounts where you enable 2FA. Now you're only locked out if you lose both it and your phone. I use one of these https://www.yubico.com/product/security-key-by-yubico/ https://www.yubico.com/product/security-key-by-yubico/

fmajid 6y ago
At least 2 keys for redundancy in case of loss or theft. I have 4 Yubikeys (2 of them freebies with an Ars Technica and Wired subscription).
- smichel17 6y ago
  Redundancy is taken care of by the TOTP app on your phone.

OJFord 6y ago

Not GP, but I use Authy, which allows multiple devices, approving each new one with one of the others. I don't recommend using its browser add-on though, so this only fixes your case if you have two (or more) devices to use that will be active at the same time, so that any one (all but one) can die. Also, have multiple forms of 2FA (as in any one may be used) such as a FIDO key or printed codes.

deleted 6y ago

[deleted]

solarkraft 6y ago

You can scan the same QR code with multiple devices or (less secure but mayve reasonable) save the code somehow. Some apps also let you export the token (but definitely not Google Authenticator, that app's data doesn't even get backed up).

croutonwagon 6y ago

Google auth works if you scan the QR code with multiple devices at setup. So I keep a spare phone at home i my safe with google auth setup. Just in case my primary is lost or stolen.