4 ms·

Let's just remind ourselves that we're not born with attached cellphones. These things get broken, lost, stolen, etc. Besides, some people do not own one. How w

Let's just remind ourselves that we're not born with attached cellphones. These things get broken, lost, stolen, etc. Besides, some people do not own one. How will they solve the problem of folks getting locked out? And if anyone says there is a workaround for cases like this, then what problem is it solving?

jedberg 4y ago
Authy synchronizes across devices and works on a computer. If you're using Github then you at least have a computer. And using 2FA on your own computer at least guarantees that the access is from your computer. Sure, someone could hack your computer and get access to your GitHub, but if they're already on your computer, they can just change the code and do a git push too.
fs111 4y ago
github will give you backup codes you can print out and use in case somthing bad happens. I personally have 2 yubikeys registered as the second factor and it works great. They last years w/o any problem.
- protomyth 4y ago
  We had to buy yubikeys for various things since the whole cellphone thing wasn't going to work. You do have to buy multiple because of breakage or loss.
- cesarb 4y ago
  > github will give you backup codes you can print out and use in case somthing bad happens. The backup codes have a "nearly never used" issue: since they're nearly never used, it's easy to forget where you put that piece of paper (I vaguely know where mine might be located, but I'd have to lose some time searching for it if I ever needed it). And there's also the risk that the "something bad" affects both the TOTP device and the backup codes. If your home is flooded, for instance, you might lose to water damage both the piece of paper where the backup codes are and your mobile phone.
mfer 4y ago
I think you bring up a great point. How can people do 2FA well for their situations? This is a practical question and people make many assumptions. A lot of what I know isn't clearly documented. Clearly communicating a bunch of different options would be helpful for people. Personally, I have 2 yubikeys, Authy synced to multiple devices, and the backup codes. There a bunch of options with different tradeoffs.
dotnet00 4y ago
They provide a set of single use recovery codes for that purpose. I keep an encrypted copy of them in cloud storage and in several physical backups, so in the event that I lose or don't have access to neither my main nor backup yubikey, I can very likely still dig up a recovery code (eg by calling up a relative and asking them to read me the code).
banana_giraffe 4y ago
The provide 16 single use codes for the "my TOPT device blew up" case, enough to get you in and reset things. And for people that are unable or refuse to use a secondary device, there's no technical reason you can't run a TOPT app on your desktop.
WhyNotHugo 4y ago
You can buy a couple of Yubikeys, and use one as backup. Probably feasible for most users of HN, but prohibitively expensive for millions around the world. Using a phone for 2FA is not great: 1. You can lose it. 2. If you're backing up 2FA to the cloud, then it's not 2FA any more. 3. If you use a password manager on your phone, then both factors are the same, it's not really 2FA.
- mattacular 4y ago
  If you backup 2FA to the cloud (eg. authy) how does that not count as a second factor still even if security is diminished for other reasons?
- kayodelycaon 4y ago
  This does not solve the problem of losing or breaking the device containing the key. And it significantly degrades the user experience by requiring you have both devices available when you create an account to have any kind of backup.
em-bee 4y ago
i am only using github infrequently. the risk of getting locked out scares me. the likelihood of me forgetting which device i used to enable 2FA and maybe breaking/loosing/reinstalling said device (while forgetting to back up the 2FA to another device, and never mind remembering where i put the backup codes that were created 10 years ago) is much greater than anyone breaking into my account. the end result will be that i won't be contributing code on github anymore but rather copy the project elsewhere and tell the developers where to pull my patches from.
_Algernon_ 4y ago
Worst case you'd have to download new one time codes every tenth login or something like that.
- throwntoday 4y ago
  Yeah I can't see how it could be any worse than that.
  - _Algernon_ 4y ago
    Writing down a single new one time code after each login?
kmlx 4y ago
> Let's just remind ourselves that we're not born with attached cellphones. 2FA doesn't mean only SMS or smartphone app.

jedberg 4y ago

Authy synchronizes across devices and works on a computer. If you're using Github then you at least have a computer. And using 2FA on your own computer at least guarantees that the access is from your computer. Sure, someone could hack your computer and get access to your GitHub, but if they're already on your computer, they can just change the code and do a git push too.

fs111 4y ago

github will give you backup codes you can print out and use in case somthing bad happens. I personally have 2 yubikeys registered as the second factor and it works great. They last years w/o any problem.

protomyth 4y ago
We had to buy yubikeys for various things since the whole cellphone thing wasn't going to work. You do have to buy multiple because of breakage or loss.
cesarb 4y ago
> github will give you backup codes you can print out and use in case somthing bad happens. The backup codes have a "nearly never used" issue: since they're nearly never used, it's easy to forget where you put that piece of paper (I vaguely know where mine might be located, but I'd have to lose some time searching for it if I ever needed it). And there's also the risk that the "something bad" affects both the TOTP device and the backup codes. If your home is flooded, for instance, you might lose to water damage both the piece of paper where the backup codes are and your mobile phone.

mfer 4y ago

I think you bring up a great point. How can people do 2FA well for their situations? This is a practical question and people make many assumptions. A lot of what I know isn't clearly documented. Clearly communicating a bunch of different options would be helpful for people. Personally, I have 2 yubikeys, Authy synced to multiple devices, and the backup codes. There a bunch of options with different tradeoffs.

dotnet00 4y ago

They provide a set of single use recovery codes for that purpose. I keep an encrypted copy of them in cloud storage and in several physical backups, so in the event that I lose or don't have access to neither my main nor backup yubikey, I can very likely still dig up a recovery code (eg by calling up a relative and asking them to read me the code).

banana_giraffe 4y ago

The provide 16 single use codes for the "my TOPT device blew up" case, enough to get you in and reset things. And for people that are unable or refuse to use a secondary device, there's no technical reason you can't run a TOPT app on your desktop.

WhyNotHugo 4y ago

You can buy a couple of Yubikeys, and use one as backup. Probably feasible for most users of HN, but prohibitively expensive for millions around the world. Using a phone for 2FA is not great: 1. You can lose it. 2. If you're backing up 2FA to the cloud, then it's not 2FA any more. 3. If you use a password manager on your phone, then both factors are the same, it's not really 2FA.

mattacular 4y ago
If you backup 2FA to the cloud (eg. authy) how does that not count as a second factor still even if security is diminished for other reasons?
kayodelycaon 4y ago
This does not solve the problem of losing or breaking the device containing the key. And it significantly degrades the user experience by requiring you have both devices available when you create an account to have any kind of backup.

em-bee 4y ago

i am only using github infrequently. the risk of getting locked out scares me. the likelihood of me forgetting which device i used to enable 2FA and maybe breaking/loosing/reinstalling said device (while forgetting to back up the 2FA to another device, and never mind remembering where i put the backup codes that were created 10 years ago) is much greater than anyone breaking into my account. the end result will be that i won't be contributing code on github anymore but rather copy the project elsewhere and tell the developers where to pull my patches from.

_Algernon_ 4y ago

Worst case you'd have to download new one time codes every tenth login or something like that.

throwntoday 4y ago
Yeah I can't see how it could be any worse than that.
- _Algernon_ 4y ago
  Writing down a single new one time code after each login?

kmlx 4y ago

> Let's just remind ourselves that we're not born with attached cellphones. 2FA doesn't mean only SMS or smartphone app.