3 ms·

Not just a 2FA bypass, it bypasses all of the FA's. Then again, somehow losing all 2FA methods is my nightmare reason for being hesitant to turn on 2FA for my

Not just a 2FA bypass, it bypasses all of the FA's. Then again, somehow losing all 2FA methods is my nightmare reason for being hesitant to turn on 2FA for my Google account because their customer service is so completely awful. Like if my house burned down with my keys, phone, and previously authenticated PC stuck inside. I know, extremely unlikely, but without customer service that is willing to verify my identity without relying on an automated/AI algorithm, I feel safer with a strong unique password along with the other account recovery options. Am I being unreasonable and missing some method of last resort with Google's 2FA?

filoleg 5y ago
I switched away from Google Authenticator app to Microsoft Authenticator app for that reason (it is a generic 2FA, so you can use it as a 2FA for google logins and any other services just fine). One important difference is that Microsoft Authenticator supports recovery from iCloud (in cause you are on iOS; there is probably something similar for Android too), which is something that Google Authenticator does not. So in case my phone explodes, the only thing i need to recover all my 2FA stuff is a recovery key for iCloud (which i can print out and put in a few places, like a bank storage cell and my parents’ house), because my Apple stuff is behind 2FA as well. So essentially, i just pick up my recovery code, buy a new iphone, authenticate using the recovery code, it restores all my data from iCloud backup, and my Microsoft Authenticator app has all my 2FAs for all services i use it for there. It is a fairly recent feature for Microsoft Authenticator on iOS iirc, they added it less than a year ago. A few other 2FA apps, like Authy, support that type of 2FA recovery too (and Authy specifically had that feature for much longer).
- physicles 5y ago
  I was also using Google Authenticator before I bought a new iPhone a few years ago, when I noticed to my surprise that those 2FA codes were the only thing that didn't automatically populate on my new phone. I immediately switched to Authy. In my threat model, losing my phone is at least 1,000x more likely than the targeted attack it would take to compromise both auth factors for my most important accounts. Besides, as others pointed out in another similar thread: after SMS hijacking and social engineering, the next weakest link is cookie theft.

filoleg 5y ago

I switched away from Google Authenticator app to Microsoft Authenticator app for that reason (it is a generic 2FA, so you can use it as a 2FA for google logins and any other services just fine). One important difference is that Microsoft Authenticator supports recovery from iCloud (in cause you are on iOS; there is probably something similar for Android too), which is something that Google Authenticator does not. So in case my phone explodes, the only thing i need to recover all my 2FA stuff is a recovery key for iCloud (which i can print out and put in a few places, like a bank storage cell and my parents’ house), because my Apple stuff is behind 2FA as well. So essentially, i just pick up my recovery code, buy a new iphone, authenticate using the recovery code, it restores all my data from iCloud backup, and my Microsoft Authenticator app has all my 2FAs for all services i use it for there. It is a fairly recent feature for Microsoft Authenticator on iOS iirc, they added it less than a year ago. A few other 2FA apps, like Authy, support that type of 2FA recovery too (and Authy specifically had that feature for much longer).

physicles 5y ago
I was also using Google Authenticator before I bought a new iPhone a few years ago, when I noticed to my surprise that those 2FA codes were the only thing that didn't automatically populate on my new phone. I immediately switched to Authy. In my threat model, losing my phone is at least 1,000x more likely than the targeted attack it would take to compromise both auth factors for my most important accounts. Besides, as others pointed out in another similar thread: after SMS hijacking and social engineering, the next weakest link is cookie theft.