3 ms·
not only lost phone, but damaged phone is enough, as you can easily swap sim card but authenticator need to be set up again. BUT there are also one time recover
by Szpadel 4y ago
not only lost phone, but damaged phone is enough, as you can easily swap sim card but authenticator need to be set up again.
BUT there are also one time recovery codes, they could add you option to use those to recover after clicking through few screens of warnings to make sure that you know what consequences does it have
- eternityforest 4y agoThat's one reason I definitely prefer SMS auth to any other method at the moment. What if your phone is damaged while traveling and you are away from where you stored your recovery keys?
- lxgr 4y agoYou can always bring a paper recovery code or FIDO authenticator (both of which are safe against SIM swapping attacks).
- FrenchDevRemote 4y agowe've been told for decades to "not write passwords on postits" and we're really back to square one...
- charcircuit 4y agoideally the paper would be in a safety deposit box / safe and not stuck to your monitor.
- FrenchDevRemote 4y agoIf it fits your need to have it a fixed location, then yes. But he talked about traveling. IDK about you but I don't travel with a safe in my backpack
- lxgr 4y agoJust put it in your wallet and/or luggage. Without your account name and password, it's useless to any potential thief.
- justinclift 4y agoLots of people's luggage include enough info to work out their name and likely home location, which is commonly enough to work out their username for a lot of popular services. That makes the whole "stolen luggage" thing even far riskier. :/
- lxgr 4y agoBut hopefully your luggage does not contain your Google account password. Again, the recovery code is one factor.
- lxgr 4y agoIt's not a password, it is a secondary, single-use recovery second factor. Carrying that around in a wallet doesn't make you any more vulnerable to physical attackers than carrying your Yubikey on a keyring, and it's much more secure against remote attacks than SMS-2FA (where you can fall victim to SIM swapping, number porting attacks etc).
- rtsil 4y agoWhenever I add a new 2FA token, I always add it to my phone and a TOTP app (Authy) on my computers. Same thing for recovery keys.