4 ms·

That doesn't help OP now, but I found it helpful to enable 2FA with Google Authenticator, and keep emergency backup codes in a safe place. It's slightly more ha

That doesn't help OP now, but I found it helpful to enable 2FA with Google Authenticator, and keep emergency backup codes in a safe place. It's slightly more hassle, but there are less 'soft AI' barriers between you and your successful login. I'd also suggest not to rely on a phone number as 2nd factor, it's not that super safe.

anter 5y ago
I'd suggest not to rely on google for anything you wouldn't want to lose.
- ddtaylor 5y ago
  2022 me agrees with you, but 2003 me getting an invite to GMail when it was a brand new service and essentially a completely different company with a different landscape didn't know better. Now I have nearly two decades of accounts and things tied to GMail =(
  - xhkkffbf 5y ago
    Google Takeout is a pretty nice service still. It's good to back up your accounts regularly.
    - nieve 5y ago
      Unfortunately Takeout doesn't really do anything to help with purchases.
    - ddtaylor 5y ago
      I think the main problem with many people isn't so much the archive of email that they would lose from not using GMail anymore, it's the many years of accounts that are authenticated with it. There are literally hundreds of services I have that are registered to that e-mail address now.
jumelles 5y ago
I’d recommend a non-Google 2FA app. Microsoft has one, and Authy is popular. Personally I’m happy with OTP Auth. Some password managers can also handle 2FA, e.g. Strongbox.
- noicebrewery 5y ago
  I'd recommend andOTP here as it is open source and not tied to any company that's trying to sell you anything.
  - commoner 5y ago
    Seconding andOTP[1] or Aegis,[2] if you're looking for an Android app that only handles OTP authentication. Both of these apps allow file-based import/export so that you can back up your codes and restore them elsewhere, no proprietary cloud service needed. [1] https://github.com/andOTP/andOTP https://github.com/andOTP/andOTP [2] https://getaegis.app/ https://getaegis.app/ I'm not impressed with Authy's privacy policy, especially this part which mirrors the Google issues:[3] > We use the information we gather from you to monitor for unusual or suspicious activity in your account, to communicate with you about your account, and as additional information that can be used to validate who you are if you need to recover your account or your account has been or may be compromised. Authy also collects and shares more of your private information than most OTP apps:[3] > When you use our app we collect: Your phone number, device information, and email address. > We also share your information with our third party service providers as necessary for them to provide their services to us. We may also have to share your information with third parties if required to do so by law. > Your information will be transferred to the U.S. [3] https://www.twilio.com/legal/privacy/authy https://www.twilio.com/legal/privacy/authy
    - egberts1 5y ago
      FreeOTP, PIN Genie Vault are two OTP authenticator that has zero access to your phone and zero data sent back to them. my fall-back is Microsoft Authenticator.
- donalhunt 5y ago
thadk 5y ago
Would be good but on my accounts which didn't have 2FA, they seemed to have removed Authenticator as an option: only phone numbers available now.
- dannyw 5y ago
  You still can if you muck around with the dark-UX flow.
nefitty 5y ago
Easily the most straightforward recommendation possible. Thank you. HN outrage at Kafkaesque account lock-outs makes me imagine bureaucrats complaining about an approval requirement they themselves created. It is frustrating and I know data loss can be devastating. If people in the tech community individually follow basic security procedures, that helps us further discover pain points in the work toward better security. Who better to have to deal with these problems than people who focus on leveraging effort?
muixoozie 5y ago
> 2FA with Google Authenticator I just wanted to recommend Aegis as an alternative to Google Authenticator. It allows backing up codes to an encrypted (password protected) file. Plus it's FOSS.
- dhc02 5y ago
  I use 1password as an Authenticator replacement, which saves time when logging in.
  - Sacro 5y ago
    I hope you're not storing your passwords in there too
  - commoner 5y ago
    Bitwarden ($10/year Premium Bitwarden plan[1] or self-hosted Vaultwarden[2]) and KeePass[3] are also password managers that support TOTP authentication. They are open source and less expensive than 1Password. A single password manager should only be used to store TOTP secrets alongside passwords if you're comfortable with both of them being accessed from the same devices. It's possible to store your TOTP secrets in a Bitwarden account or a KeePass file, and your passwords in another account or file, hosted/stored in different locations. [1] https://bitwarden.com/pricing/business/ https://bitwarden.com/pricing/business/ [2] https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden [3] https://keepass.info/download.html https://keepass.info/download.html
FabHK 5y ago
> enable 2FA with Google Authenticator [...] also suggest not to rely on a phone number as 2nd factor Well, I have my PayPal account set up with a strong unique password and 2FA via an authenticator app. Recently installed the PayPal app on my smartphone, and it asked for CAPTCHA, password, 2FA token, and then additionally SMS to an old phone number I still had on file. How does it make sense to ask for 3 factors? At any rate, I logged in on the computer and updated the phone number. Still wouldn't let me log in on the smartphone, needed to contact customer support. Look, I understand that many people choose bad passwords and they get pawned and all, and I'm glad that the providers are a bit smarter and use other factors (cookies, IP, phone number...), but it really penalises security and privacy conscious users. If you use strong passwords and 2FA, but use VPNs, switch phone numbers, clear cookies, etc., you get flagged and locked out. Very annoying.

anter 5y ago

I'd suggest not to rely on google for anything you wouldn't want to lose.

ddtaylor 5y ago
2022 me agrees with you, but 2003 me getting an invite to GMail when it was a brand new service and essentially a completely different company with a different landscape didn't know better. Now I have nearly two decades of accounts and things tied to GMail =(
- xhkkffbf 5y ago
  Google Takeout is a pretty nice service still. It's good to back up your accounts regularly.
  - nieve 5y ago
    Unfortunately Takeout doesn't really do anything to help with purchases.
  - ddtaylor 5y ago
    I think the main problem with many people isn't so much the archive of email that they would lose from not using GMail anymore, it's the many years of accounts that are authenticated with it. There are literally hundreds of services I have that are registered to that e-mail address now.

jumelles 5y ago

I’d recommend a non-Google 2FA app. Microsoft has one, and Authy is popular. Personally I’m happy with OTP Auth. Some password managers can also handle 2FA, e.g. Strongbox.

noicebrewery 5y ago
I'd recommend andOTP here as it is open source and not tied to any company that's trying to sell you anything.
- commoner 5y ago
  Seconding andOTP[1] or Aegis,[2] if you're looking for an Android app that only handles OTP authentication. Both of these apps allow file-based import/export so that you can back up your codes and restore them elsewhere, no proprietary cloud service needed. [1] https://github.com/andOTP/andOTP https://github.com/andOTP/andOTP [2] https://getaegis.app/ https://getaegis.app/ I'm not impressed with Authy's privacy policy, especially this part which mirrors the Google issues:[3] > We use the information we gather from you to monitor for unusual or suspicious activity in your account, to communicate with you about your account, and as additional information that can be used to validate who you are if you need to recover your account or your account has been or may be compromised. Authy also collects and shares more of your private information than most OTP apps:[3] > When you use our app we collect: Your phone number, device information, and email address. > We also share your information with our third party service providers as necessary for them to provide their services to us. We may also have to share your information with third parties if required to do so by law. > Your information will be transferred to the U.S. [3] https://www.twilio.com/legal/privacy/authy https://www.twilio.com/legal/privacy/authy
  - egberts1 5y ago
    FreeOTP, PIN Genie Vault are two OTP authenticator that has zero access to your phone and zero data sent back to them. my fall-back is Microsoft Authenticator.
donalhunt 5y ago

thadk 5y ago

Would be good but on my accounts which didn't have 2FA, they seemed to have removed Authenticator as an option: only phone numbers available now.

dannyw 5y ago
You still can if you muck around with the dark-UX flow.

nefitty 5y ago

Easily the most straightforward recommendation possible. Thank you. HN outrage at Kafkaesque account lock-outs makes me imagine bureaucrats complaining about an approval requirement they themselves created. It is frustrating and I know data loss can be devastating. If people in the tech community individually follow basic security procedures, that helps us further discover pain points in the work toward better security. Who better to have to deal with these problems than people who focus on leveraging effort?

muixoozie 5y ago

> 2FA with Google Authenticator I just wanted to recommend Aegis as an alternative to Google Authenticator. It allows backing up codes to an encrypted (password protected) file. Plus it's FOSS.

dhc02 5y ago
I use 1password as an Authenticator replacement, which saves time when logging in.
- Sacro 5y ago
  I hope you're not storing your passwords in there too
- commoner 5y ago
  Bitwarden ($10/year Premium Bitwarden plan[1] or self-hosted Vaultwarden[2]) and KeePass[3] are also password managers that support TOTP authentication. They are open source and less expensive than 1Password. A single password manager should only be used to store TOTP secrets alongside passwords if you're comfortable with both of them being accessed from the same devices. It's possible to store your TOTP secrets in a Bitwarden account or a KeePass file, and your passwords in another account or file, hosted/stored in different locations. [1] https://bitwarden.com/pricing/business/ https://bitwarden.com/pricing/business/ [2] https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden [3] https://keepass.info/download.html https://keepass.info/download.html

FabHK 5y ago

> enable 2FA with Google Authenticator [...] also suggest not to rely on a phone number as 2nd factor Well, I have my PayPal account set up with a strong unique password and 2FA via an authenticator app. Recently installed the PayPal app on my smartphone, and it asked for CAPTCHA, password, 2FA token, and then additionally SMS to an old phone number I still had on file. How does it make sense to ask for 3 factors? At any rate, I logged in on the computer and updated the phone number. Still wouldn't let me log in on the smartphone, needed to contact customer support. Look, I understand that many people choose bad passwords and they get pawned and all, and I'm glad that the providers are a bit smarter and use other factors (cookies, IP, phone number...), but it really penalises security and privacy conscious users. If you use strong passwords and 2FA, but use VPNs, switch phone numbers, clear cookies, etc., you get flagged and locked out. Very annoying.