4 ms·

I made this mistake when I enabled 2FA for Uber some years ago. Same old story. Somehow forgot to grab my recovery codes for Uber even though I had for everyt

I made this mistake when I enabled 2FA for Uber some years ago. Same old story. Somehow forgot to grab my recovery codes for Uber even though I had for everything else. I got a new phone, manually transferred all my google auth codes from my old phone, somehow missed Uber. And then a few months later after I had already reset my old phone I installed the Uber app and oops, I needed a 2FA code. Couldn't get one. And because Uber is tied to your phone number I couldn't even just create a new account without getting a new phone number. So I emailed their support (which is useless), got a bunch of bot responses about how to reset your password, finally got one real person to respond after several weeks. But they had no idea what I was talking about and clearly had no ability to actually do anything about the 2FA issue. So I gave up and now I'm just permanently locked out of using Uber. Which is fine, cuz fuck 'em. Now I use Lyft exclusively. Which doesn't matter because in my experience every Uber driver is also a Lyft driver.

pmoriarty 4y ago
"they had no idea what I was talking about and clearly had no ability to actually do anything about the 2FA issue" What are they supposed to do to fix your issue without compromising their security model? What you describe sounds like 2FA working like it's supposed to.
- zackees 4y ago
  Their security model locks users out. I nearly lost all my passwords with LastPass when something similar happened to me. Is grandma supposed to file her 128 character recovery code in a safe vault when she just wants to get from the airport? Stop blaming users for them not adapting to terrible authentication experience.
  - pmoriarty 4y ago
    I'd be interested in hearing about a better model. To me they're all terrible in one way or another.
    - zackees 4y ago
      If the security is this important then recovery should involve AI facial recognition with human fallback to unlock a device. Or else submitting a passport / drivers license to force unlock. We have global identity systems. Why not use them?
- lkbm 4y ago
  Disconnect the phone number from that old account and allow him to create a new account using the phone number. If I cancel my phone service, and someone else later ends up with my phone number, does it make sense that that person can never use Uber with their new phone? Phone numbers are less transitory than street addresses, but much more so than email addresses. You should expect some amount of re-use, and need to be able to handle that situation.
- joshvm 4y ago
  Most companies offer manual processes to get round failed 2FA - for example, provide copies of ID, a video chat to confirm, security questions about account details (eg last trips you took), etc. I've had to do this for a couple of services where the process was quite onerous, but that's the point. Doesn't help if you lose the keys and you're the only one that held them. This happened to me with an SSD that I took out of an old laptop, without realising that But locker stored its key on a chip in the laptop. I didn't even know that I had bitlocker enabled. But Uber shouldn't have your trip details behind end to end encryption, so they should be able to unlock it.
  - pmoriarty 4y ago
    ID can be easily faked. Security questions are often shared between services, so someone who's hacked any of the other services could get the answers to these same security questions and then use them to bypass 2FA.
- VWWHFSfQ 4y ago
  OK, replace "Uber" with your power company. You can't log into your account to update your expired credit card. Are they going to turn off your electricity because you dumb dumb didn't save your backup codes! No of course not. They're going to help you out. Because we live in the real world where people make mistakes.

pmoriarty 4y ago

"they had no idea what I was talking about and clearly had no ability to actually do anything about the 2FA issue" What are they supposed to do to fix your issue without compromising their security model? What you describe sounds like 2FA working like it's supposed to.

zackees 4y ago
Their security model locks users out. I nearly lost all my passwords with LastPass when something similar happened to me. Is grandma supposed to file her 128 character recovery code in a safe vault when she just wants to get from the airport? Stop blaming users for them not adapting to terrible authentication experience.
- pmoriarty 4y ago
  I'd be interested in hearing about a better model. To me they're all terrible in one way or another.
  - zackees 4y ago
    If the security is this important then recovery should involve AI facial recognition with human fallback to unlock a device. Or else submitting a passport / drivers license to force unlock. We have global identity systems. Why not use them?
lkbm 4y ago
Disconnect the phone number from that old account and allow him to create a new account using the phone number. If I cancel my phone service, and someone else later ends up with my phone number, does it make sense that that person can never use Uber with their new phone? Phone numbers are less transitory than street addresses, but much more so than email addresses. You should expect some amount of re-use, and need to be able to handle that situation.
joshvm 4y ago
Most companies offer manual processes to get round failed 2FA - for example, provide copies of ID, a video chat to confirm, security questions about account details (eg last trips you took), etc. I've had to do this for a couple of services where the process was quite onerous, but that's the point. Doesn't help if you lose the keys and you're the only one that held them. This happened to me with an SSD that I took out of an old laptop, without realising that But locker stored its key on a chip in the laptop. I didn't even know that I had bitlocker enabled. But Uber shouldn't have your trip details behind end to end encryption, so they should be able to unlock it.
- pmoriarty 4y ago
  ID can be easily faked. Security questions are often shared between services, so someone who's hacked any of the other services could get the answers to these same security questions and then use them to bypass 2FA.
VWWHFSfQ 4y ago
OK, replace "Uber" with your power company. You can't log into your account to update your expired credit card. Are they going to turn off your electricity because you dumb dumb didn't save your backup codes! No of course not. They're going to help you out. Because we live in the real world where people make mistakes.