4 ms·
It doesn't even take a lightning strike to get into this type of situation. September rolls around and everyone gets a new iPhone. Many forget to migrate their
by dcow 4y ago
It doesn't even take a lightning strike to get into this type of situation. September rolls around and everyone gets a new iPhone. Many forget to migrate their password manager over before sending their old phone back. Unlike the author who clearly thinks a lot about disaster scenarios and redundancy and recovery, more casual users do not. Some get lucky and are logged in to their password manager on their desktop. Some not so much and are even locked out of their AppleID credentials. Even if you remembered to migrate your password manager, you might not have remembered to bring your MFA code app.
This is the entire impetus behind Uno's productized Shamirs Secret Sharing recovery scheme: https://www.uno.app/blog/replacing-passwords-with-people https://www.uno.app/blog/replacing-passwords-with-people. Our bet is that, like the author questions in the OP, for most people with a trusted network of friends and family, the main threat vector is not hackers and nation states trying to take over their digital lives, but rather nature, age, and accidents, etc. And that social redundancy is an acceptable risk in order to mitigate the tendency we have to want to be our own single point of failure.
- shakes_mcjunkie 4y agoThis happened to me but because I broke my phone. My broken phone had Google Authenticator on it and I don't have my backup codes since I've had authenticator for years and never thought to redownload them. Anyways, now I can't login to my Facebook or Twitter anymore. Facebook doesn't seem to have any kind of account recovery and the methods they say I can use (e.g. log in from another device and you'll get a notification) don't work. I even have my phone number logged with them but apparently not as part of 2 factor, so I can't recover my account that way either. TBH this experience has really made me question using an authenticator app every again.
- hn2017 4y agoYep, I've seen this as well with a friend. This is one huge reason why SMS is not a bad option. (convenience vs security)
- spixy 4y agoTry Microsoft Authenticator, it can backup to cloud.
- dicknuckle 4y agoAuthy is great. I've started duplicating my MFA codes to KeepassXC so the OTP can be generated from my desktop or mobile in two different ways. I do love how KeePass will just start generating codes by pasting the secret into this format: otpauth://totp/Chrome:USER?secret=XXXXXX&period=30&digits=6
- teej 4y agoIt's interesting to note that Facebook just decided to sunset its trusted contacts feature.
- dcow 4y agoHave they talked at all about why? An interesting point about our implementation is that, unlike Facebook, Uno is not a custodial emergency contact recovery service. So we’re not in the business of trying to KYC all your friends and accept a “multi-sig” credential access request. We’re shamirs all the way down so we don’t have what I imagine would be a pretty large admin overhead for something that isn't really FB’s product.
- spixy 4y ago> sending their old phone back What does it mean? Where back? Why do you need to log into a password manager on other device (desktop)?
- dcow 4y agoApple will send you the new iPhone and a box for your old one if you're in the iPhone upgrade program. Similar story with other carrier trade-in programs. Generally you can view your master secret on other installs of your password manager which is enough to get you bootstrapped back in on a new phone if you lose yours.
- password4321 4y agoTrade-in/up perhaps?