5 ms·
Won't using e.g. Authy with Gmail for 2FA alleviate the need for a phone number after the initial setup (i.e. requiring a number only once, to initially enable
by virtualritz 4y ago
Won't using e.g. Authy with Gmail for 2FA alleviate the need for a phone number after the initial setup (i.e. requiring a number only once, to initially enable 2FA)?
https://authy.com/guides/googleandgmail/ https://authy.com/guides/googleandgmail/
- Taek 4y agoYes, but that's a highly technical solution. I've been trying to get my girlfriend to use Authy for 6 months now, and the solution we landed on is that my Authy app has all of her 2FA codes, and she just calls me if she needs one. To you and me 2FA doesn't seem that complicated. But to less technical people it's just overwhelming and they don't want to bother with the learning curve.
- kioleanu 4y agoWhat learning curve? Setting up the account in the first place? Sure, that’s a tad complicated, but I really don’t understand why your girlfriend finds it easier to call you when she just has to open the app and the code is simply there.
- abraham 4y agoHow do you use Authy if you lose all of your possessions every few months?
- deleted 4y ago[deleted]
- saghm 4y agoFrom what I remember when I used Authy briefly (Google Authenticator finally added the ability to mass import/export codes shortly after I ended up trying Authy), you create a login and set a master password, and then you have access to your codes on any device when you log into the app. Of course, this means that you have to trust Authy with your codes being stored externally, but this might be one of the sets of circumstances where that's preferable.
- faller_slive 4y agoAuthy recovery requires you to have access to the same phone number when you want to restore to a new device.
- saghm 4y agoOh, interesting, I didn't even realize that when I used it! I guess that goes to show how easy it is to take something like that for granted
- faller_slive 4y agoI did some more research. It looks like there is a way to recover if you don't have the phone number or the old device. They have an online form you fill out with your old phone number and new phone number. Then they have some process to verify ownership of the phone numbers which they say will take several days for security purposes. https://support.authy.com/hc/en-us/articles/115001953247-Phone-change-process-for-Authy-and-how-long-it-takes#new_noapp https://support.authy.com/hc/en-us/articles/115001953247-Pho...
- dexterdog 4y agoAuthy doesn't store your codes. They store encrypted copies. They are encrypted on your device and only decrypted with your password which does not leave your device. As long as their encryption is not broken your codes are secure.
- jffry 4y agoThe issue is described further in the Tweet chain: Physical property retention is more or less impossible; these people typically end up getting their phones stolen every month to 4 months. The same would be true of IDs or other paperwork that could be used to prove their identity. They get phones from a government program. Each new phone has a new number, and due to the above challenges, it'd be challenging to port numbers and keep a consistent number. Authy accounts are keyed to your phone number, and to set one up on a new phone you have to receive a verification call/text.
- deleted 4y ago[deleted]
- macspoofing 4y agoThere are various approaches to 2FA, from backup codes, to SMS, to external physical keys - none of them workable for the specific use-case OP defined: person is homeless and losses their stuff every few weeks. For that situation no 2FA solution is going to work.
- valenterry 4y agoOf course there is. For instance a printed paper tan list. Yes, this is not as safe a proper 2FA device. But it's easy to access, cheap (just go to a copyshop and 10 cents to print it, then put in a plastic bag) and it's so small that it's easy to put it somewhere where you don't lose it and is hard to get stolen.
- macspoofing 4y agoYou're not arguing with me, you're arguing with the author of the twitter thread. "Any solution requiring long-term retention of a physical 2FA key or high-entropy secret will not work."
- valenterry 4y agoNo, I'm certainly arguing with you. :) Maybe, on top of that, I'm also arguing with the author. But I assume he implicitly talked about Google (which doesn't provide that option).
- macspoofing 4y ago>But I assume he implicitly talked about Google (which doesn't provide that option). Google provides backup codes. You can print them on any kind of paper you want. Regardless, OP argued that printed backup codes don't work because everything is lost every few weeks.
- valenterry 4y agoOh really? I didn't see that option. Maybe it's new? If so, that's good!