4 ms·
>> More and more services are moving towards 2FA/MFA. The 2nd factor is in a phone app. What happens if I lose my phone? Without my old phone I cannot log into
by ValentineC 4y ago
>> More and more services are moving towards 2FA/MFA. The 2nd factor is in a phone app. What happens if I lose my phone? Without my old phone I cannot log into the services. How do I get access to my accounts again? How do I move the 2FA setup to new phone again? Do I have to do this one by one for all 50 2FAed services I use?
> Many services seem to offer one-time codes for storage offline in case this happens.
Adding on: even password managers like 1Password [1] and Bitwarden [2] offer support for TOTP 2FA now.
[1] https://support.1password.com/one-time-passwords/ https://support.1password.com/one-time-passwords/
[2]https://bitwarden.com/help/authenticator-keys/ https://bitwarden.com/help/authenticator-keys/
- nisegami 4y agoThe irony is of course that you're now back to a single factor if you store your TOTP secrets in your password manager. But a good single factor is probably fine.
- giaour 4y agoIt's only a single factor if your password manager login is compromised. If you're instead the victim of a phishing attack or you somehow spill the password + an MFA token for a single service, then you still get some of the protections you would expect from MFA (e.g., the leaked login will be time-boxed and non-renewable).
- worble 4y agoTo be honest, the most likely surface of attack for a user are database leaks. So long as your password manager is uncompromised, even if someone does manage to get ahold of your username/password for a specific site they won't get anywhere.