4 ms·

same here. Lost 2fa due to water damage on phone. and all the data was irrecoverable. Now even if i give every data their customer service don't care. From tha

same here. Lost 2fa due to water damage on phone. and all the data was irrecoverable. Now even if i give every data their customer service don't care. From that day i haven't used any 2fa and just use password manager with additional backup.

xrisk 6y ago
Use a 2FA that lets you take backups?
- kevingadd 6y ago
  Authy seems great for this.
- criddell 6y ago
  Or print out the QR codes and keep them in a safe place.
vmception 6y ago
password managers let you store the one time password key. this removes the "two factor" nature of two factor, but retains the one time password nature of one time password. I honestly can't relate to people losing their access because something happened to their phone. The QR code is just a string of letters and numbers and you can save the QR code and the string of letters and numbers. I've been doing this for like a decade.
- katsura 6y ago
  Do they have the that though? When I turned the 2FA on it was only SMS option, so if your phone number is lost you are out of luck.
  - vmception 6y ago
    I don't know about paypal.
  - resoluteteeth 6y ago
    I thought they had added support normal TOTP now but if not you can probably still use the old method of generating a Symantec VIP style ID which has allowed you to use any TOTP app with paypal for years.
  - Tsiklon 6y ago
    PayPal 2FA via OTP has apparently been available for at least 6 months
    - dingaling 6y ago
      It had, but when they forced me through the 2FA enrolment flow recently the only option was SMS. To use OTP I had to break out of that flow and start from a different part of the site.
- gregoriol 6y ago
  Storing the second factor in the same password manager as the password is a lot like having a post-it with the password on your desk: it's practical, but defeats the purpose. But to add to this, I wouldn't ever set up a 2FA on a service that doesn't allow multiple second factors, and mostly static backup codes. Having only one (ie. device) is a much higher risk, of being locked out, than having the password stolen.
  - vmception 6y ago
    If your password manager is compromised you are screwed. When looking at the actual attack vectors though it is vastly improved: Mitigated - Online attacks on your account at any service Mitigated - In person attacks on your account due to post-it notes Mitigated - Losing your phone which was the only way you could generate a one time password All this drama is mitigated, turning a disaster into a 5 second recovery.
  - TT3351 6y ago
    At least I know whoever is using my password is siting at my desk looking at the post-it (provided of course they didn't photograph it). Point being: it doesn't entirely defeat the purpose, in a similar way to how TSA locks don't defeat thieves, but delay them/lead them to find a different target.
- justinclift 6y ago
  Just to point out... mobile phone's aren't 100% universal, though a lot of places pretend they are. Up until about 18 months ago I used to live in a part of the UK without any mobile phone coverage. So, any mobile number I had (with Vodafone) always expired after 3 months. That does not make for any kind of fondness of places trying to blindly force SMS based 2FA on everyone. ;)
numpad0 6y ago
I keep a separate phone next to home PC and enroll that for 2FA as well. That’s as secure as a sticky note on monitor, that is to say it’s airgapped.
- jasonjayr 6y ago
  Screenshot the QRCode, print it out, and keep it in a safe. I have an encrypted backup of all my TOTP QRCodes and this has been tremendously useful. I loathe sites that only do SMS 2FA, and I assume by default they just want my cell # for marketing or other privacy invasive purposes. Too many sites using SMS 2FA have poisoned the well.
  - smichel17 6y ago
    That's a good idea. I've been only enabling 2fa when I can use two forms of it (totp + u2f token), but that's still vulnerable since I often carry both of those on my person at the same time.
bserge 6y ago
Make sure you test the recovery system. I forgot how Paypal's works, but Google's for example, will simply bypass your 12288-bit strong password and give your account to anyone. Lost a Google account that way. 2FA would've saved it (in theory).

xrisk 6y ago

Use a 2FA that lets you take backups?

kevingadd 6y ago
Authy seems great for this.
criddell 6y ago
Or print out the QR codes and keep them in a safe place.

vmception 6y ago

password managers let you store the one time password key. this removes the "two factor" nature of two factor, but retains the one time password nature of one time password. I honestly can't relate to people losing their access because something happened to their phone. The QR code is just a string of letters and numbers and you can save the QR code and the string of letters and numbers. I've been doing this for like a decade.

katsura 6y ago
Do they have the that though? When I turned the 2FA on it was only SMS option, so if your phone number is lost you are out of luck.
- vmception 6y ago
  I don't know about paypal.
- resoluteteeth 6y ago
  I thought they had added support normal TOTP now but if not you can probably still use the old method of generating a Symantec VIP style ID which has allowed you to use any TOTP app with paypal for years.
- Tsiklon 6y ago
  PayPal 2FA via OTP has apparently been available for at least 6 months
  - dingaling 6y ago
    It had, but when they forced me through the 2FA enrolment flow recently the only option was SMS. To use OTP I had to break out of that flow and start from a different part of the site.
gregoriol 6y ago
Storing the second factor in the same password manager as the password is a lot like having a post-it with the password on your desk: it's practical, but defeats the purpose. But to add to this, I wouldn't ever set up a 2FA on a service that doesn't allow multiple second factors, and mostly static backup codes. Having only one (ie. device) is a much higher risk, of being locked out, than having the password stolen.
- vmception 6y ago
  If your password manager is compromised you are screwed. When looking at the actual attack vectors though it is vastly improved: Mitigated - Online attacks on your account at any service Mitigated - In person attacks on your account due to post-it notes Mitigated - Losing your phone which was the only way you could generate a one time password All this drama is mitigated, turning a disaster into a 5 second recovery.
- TT3351 6y ago
  At least I know whoever is using my password is siting at my desk looking at the post-it (provided of course they didn't photograph it). Point being: it doesn't entirely defeat the purpose, in a similar way to how TSA locks don't defeat thieves, but delay them/lead them to find a different target.
justinclift 6y ago
Just to point out... mobile phone's aren't 100% universal, though a lot of places pretend they are. Up until about 18 months ago I used to live in a part of the UK without any mobile phone coverage. So, any mobile number I had (with Vodafone) always expired after 3 months. That does not make for any kind of fondness of places trying to blindly force SMS based 2FA on everyone. ;)

numpad0 6y ago

I keep a separate phone next to home PC and enroll that for 2FA as well. That’s as secure as a sticky note on monitor, that is to say it’s airgapped.

jasonjayr 6y ago
Screenshot the QRCode, print it out, and keep it in a safe. I have an encrypted backup of all my TOTP QRCodes and this has been tremendously useful. I loathe sites that only do SMS 2FA, and I assume by default they just want my cell # for marketing or other privacy invasive purposes. Too many sites using SMS 2FA have poisoned the well.
- smichel17 6y ago
  That's a good idea. I've been only enabling 2fa when I can use two forms of it (totp + u2f token), but that's still vulnerable since I often carry both of those on my person at the same time.

bserge 6y ago

Make sure you test the recovery system. I forgot how Paypal's works, but Google's for example, will simply bypass your 12288-bit strong password and give your account to anyone. Lost a Google account that way. 2FA would've saved it (in theory).