7 ms·

Which makes the system essentially moot. That seems like a substantial screw-up.

fragsworth 15y ago
Maybe now that it has been pointed out, they will fix it.
enneff 15y ago
Not really. When the guy had regained control of the account he could have signed out all other sessions, requiring all sessions to do 2-factor auth again. But if the person re-authenticating has a trojan on their computer (as may have been the case here) there is _nothing_ that can be done to prevent a third party from accessing their stuff.
- mattmanser 15y ago
  The point was that the 2-factor would have already been turned off by the hacker at that point.
pmjordan 15y ago
What if you lose your phone, though?
- singular 15y ago
  They have you print out a bunch of one-time passwords which can be used to access the account should you lose your phone.
- panacea 15y ago
  I'm going to look into it when I get the time, but I hope you can add a second device. One of the not-inconsequential benefits to being married is the additional redundancy. If I can't remember a password, my wife might. Hopefully I can set this up with her phone as a fallback.
- stef25 15y ago
  When you're setting up 2 factor auth, they ask you for a back up phone number.
- darklajid 15y ago
  The setup forces you to go through two backup steps. First it gives you a list of 10 codes that you should print and keep save. Looks like a TAN list. You can only move on if you check 'I printed these items and will protect them like my first born' or something like that. After clicking next you are able to set up a phone number that is used as another fallback. Testing if you entered the number correctly is optional here, but worked like a charm.
- Mavrik 15y ago
  You get 10 one-time use backup access codes for that case (which YOU need to keep secure).
- nebbsen 15y ago
  Google gives you backup codes that you have to write down or print out and you have to give them your telephone number so they can text you other codes or call you with an automated message.

Maybe now that it has been pointed out, they will fix it.

Not really. When the guy had regained control of the account he could have signed out all other sessions, requiring all sessions to do 2-factor auth again. But if the person re-authenticating has a trojan on their computer (as may have been the case here) there is _nothing_ that can be done to prevent a third party from accessing their stuff.

mattmanser 15y ago
The point was that the 2-factor would have already been turned off by the hacker at that point.

pmjordan 15y ago

What if you lose your phone, though?

singular 15y ago
They have you print out a bunch of one-time passwords which can be used to access the account should you lose your phone.
panacea 15y ago
I'm going to look into it when I get the time, but I hope you can add a second device. One of the not-inconsequential benefits to being married is the additional redundancy. If I can't remember a password, my wife might. Hopefully I can set this up with her phone as a fallback.
stef25 15y ago
When you're setting up 2 factor auth, they ask you for a back up phone number.
darklajid 15y ago
The setup forces you to go through two backup steps. First it gives you a list of 10 codes that you should print and keep save. Looks like a TAN list. You can only move on if you check 'I printed these items and will protect them like my first born' or something like that. After clicking next you are able to set up a phone number that is used as another fallback. Testing if you entered the number correctly is optional here, but worked like a charm.
Mavrik 15y ago
You get 10 one-time use backup access codes for that case (which YOU need to keep secure).
nebbsen 15y ago
Google gives you backup codes that you have to write down or print out and you have to give them your telephone number so they can text you other codes or call you with an automated message.