5 ms·

Am I the only one that thinks that 2FA actually increases the probability of losing access to an account? It's only a matter of losing the 2nd factor.

bamboozled 4y ago
Github has alternative recovery methods though too, such as 2FA over SMS.
- Fuzzwah 4y ago
  And support can help out as long as you can show that you can ssh into a github host using the private key of one of the public ssh keys assigned to your account.
  - jrochkind1 4y ago
    That makes some sense, and seems to me a nice option. Is it documented anywhere that that is an option, that they will do that?
- jwilk 4y ago
  Documented here: https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/recovering-your-account-if-you-lose-your-2fa-credentials https://docs.github.com/en/authentication/securing-your-acco...
zhfliz 4y ago
easily solved by adding multiple MFA options, e.g. multiple security keys.
johannes1234321 4y ago
For that there are the revoke code. And the backup phone number.
- Biganon 4y ago
  Or even better than the one time codes they give you, you can simply store the secret itself, on a piece of paper in a safe.
jason0597 4y ago
What people should do is have a small SD card with all of their private keys and passwords stored away safely. This SD card should be kept in cold storage (e.g. in a safe where you keep personal belongings), and never be accessed unless in absolute emergency (lost your YubiKey etc and can't get in anywhere, etc.)
- Lifelarper 4y ago
  SD cards are horrendous for long term storage. Probably the worst medium for such a task.
  - adamiscool8 4y ago
    What is the best? Cursory googling suggests SD cards last ~decades at normal usage [0], and in this context where it's barely accessed, maybe longer? [0] https://www.sdcard.org/consumers/faq https://www.sdcard.org/consumers/faq
    - 0x073 4y ago
      If you go to bluray.com you probably can read the same only for blu-ray. Better search for a neutral source.
    - _whiteCaps_ 4y ago
      I wrote some scripts to generate QR codes, then printed them to photo paper. https://github.com/alexjh/gpg-backup/blob/master/Makefile https://github.com/alexjh/gpg-backup/blob/master/Makefile Back then I thought that QR codes were a bit of a gimmick but now I'm way more confident that I'll be able to read them in the future.
    - Brian_K_White 4y ago
      laser print
    - justinclift 4y ago
      Probably depends on the quantity of data. If you're talking GB's or TB's of digital data, then maybe "archival grade" DVD's or BluRay's. https://www.verbatim.com.au/product-category/data-storage/optical-media/archival/ https://www.verbatim.com.au/product-category/data-storage/op... If it's instead just a few short strings of text (eg GH password recovery codes), then you could use physical storage. eg engrave the codes into something that'll survive extremes (granite?), and keep them in a fire proof safe. Or something along similar lines. Probably don't engrave into glass though, due to that potentially shattering in some situations.
deadbunny 4y ago
You can have multiple second factors. I have 2 YubiKeys (one on me, one in a safe place) and then I have the standard TOTP codes on my phone using Authy. If I manage to lose my phone, live and backup yubikeys then I have recovery codes. It's going to have to be something pretty drastic to cause me to loose all of that.
rstuart4133 4y ago
Well, I've lost control of accounts and I suspect a few of us have. Fortunately the one I lost wasn't important. But my response wasn't to turn off 2FA. It was the reverse - to turn on all forms of authentication made available, for all acccouts. If I lost control of it one way, I had another. By the by, if you read the spec, FIDO expects you to do this in preparation for the day you lose your token. So no you are not the only one - people think about it all the time.
IYasha 4y ago
No, we're here with you. I'm also wondering if being responsible for storing and using passwords is THAT BIG OF A DEAL??? Even mathematically, probabilities of two failing points are adding. I've been locked away from mail, banks and gods know what else just because I didn't have my phone or computer nearby, was in different country, in a place without network coverage, haven't paid for cell in time, etc. etc. etc. and absolutely positive that 2FA (at least that requiring on-line presence) is evil. The ONLY THING that can really protect and help you - is good HUMAN tech support. Where you can call, explain yourself, prove ownership and regain access to a service. Up to the point of having to go to of video-call office yourself and beyond. Yeah, I'm completely aware that some corporations don't even have humans (hello, Goolag!) employed - and trying to stay clear from them.

bamboozled 4y ago

Github has alternative recovery methods though too, such as 2FA over SMS.

Fuzzwah 4y ago
And support can help out as long as you can show that you can ssh into a github host using the private key of one of the public ssh keys assigned to your account.
- jrochkind1 4y ago
  That makes some sense, and seems to me a nice option. Is it documented anywhere that that is an option, that they will do that?
jwilk 4y ago
Documented here: https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/recovering-your-account-if-you-lose-your-2fa-credentials https://docs.github.com/en/authentication/securing-your-acco...

zhfliz 4y ago

easily solved by adding multiple MFA options, e.g. multiple security keys.

johannes1234321 4y ago

For that there are the revoke code. And the backup phone number.

Biganon 4y ago
Or even better than the one time codes they give you, you can simply store the secret itself, on a piece of paper in a safe.

jason0597 4y ago

What people should do is have a small SD card with all of their private keys and passwords stored away safely. This SD card should be kept in cold storage (e.g. in a safe where you keep personal belongings), and never be accessed unless in absolute emergency (lost your YubiKey etc and can't get in anywhere, etc.)

Lifelarper 4y ago
SD cards are horrendous for long term storage. Probably the worst medium for such a task.
- adamiscool8 4y ago
  What is the best? Cursory googling suggests SD cards last ~decades at normal usage [0], and in this context where it's barely accessed, maybe longer? [0] https://www.sdcard.org/consumers/faq https://www.sdcard.org/consumers/faq
  - 0x073 4y ago
    If you go to bluray.com you probably can read the same only for blu-ray. Better search for a neutral source.
  - _whiteCaps_ 4y ago
    I wrote some scripts to generate QR codes, then printed them to photo paper. https://github.com/alexjh/gpg-backup/blob/master/Makefile https://github.com/alexjh/gpg-backup/blob/master/Makefile Back then I thought that QR codes were a bit of a gimmick but now I'm way more confident that I'll be able to read them in the future.
  - Brian_K_White 4y ago
    laser print
  - justinclift 4y ago
    Probably depends on the quantity of data. If you're talking GB's or TB's of digital data, then maybe "archival grade" DVD's or BluRay's. https://www.verbatim.com.au/product-category/data-storage/optical-media/archival/ https://www.verbatim.com.au/product-category/data-storage/op... If it's instead just a few short strings of text (eg GH password recovery codes), then you could use physical storage. eg engrave the codes into something that'll survive extremes (granite?), and keep them in a fire proof safe. Or something along similar lines. Probably don't engrave into glass though, due to that potentially shattering in some situations.

deadbunny 4y ago

You can have multiple second factors. I have 2 YubiKeys (one on me, one in a safe place) and then I have the standard TOTP codes on my phone using Authy. If I manage to lose my phone, live and backup yubikeys then I have recovery codes. It's going to have to be something pretty drastic to cause me to loose all of that.

rstuart4133 4y ago

Well, I've lost control of accounts and I suspect a few of us have. Fortunately the one I lost wasn't important. But my response wasn't to turn off 2FA. It was the reverse - to turn on all forms of authentication made available, for all acccouts. If I lost control of it one way, I had another. By the by, if you read the spec, FIDO expects you to do this in preparation for the day you lose your token. So no you are not the only one - people think about it all the time.

IYasha 4y ago

No, we're here with you. I'm also wondering if being responsible for storing and using passwords is THAT BIG OF A DEAL??? Even mathematically, probabilities of two failing points are adding. I've been locked away from mail, banks and gods know what else just because I didn't have my phone or computer nearby, was in different country, in a place without network coverage, haven't paid for cell in time, etc. etc. etc. and absolutely positive that 2FA (at least that requiring on-line presence) is evil. The ONLY THING that can really protect and help you - is good HUMAN tech support. Where you can call, explain yourself, prove ownership and regain access to a service. Up to the point of having to go to of video-call office yourself and beyond. Yeah, I'm completely aware that some corporations don't even have humans (hello, Goolag!) employed - and trying to stay clear from them.