6 ms·

Can't help you sorry, but this also is such a massive downside to 2FA. It's totally possible to get locked out of your services semi-permanently due to really s

• deleted 4y ago
  [deleted]
• ashurov 4y ago
  I have this issue with Google and no way to get any support or help to get this resolved. I just have to accept i’ve lost access forever…
  • twawaaay 4y ago
    Free account? When you are paying customer you are also getting the privilege of contacting the support. I think it is fair that Google does not want to directly talk to billions of people using their services and not paying a cent for it. You get it for free? It is up to you to make sure you don't loose access.
    • ashurov 4y ago
      Yes, free account. And having lost the ability to do 2FA I probably won’t be able to upgrade it. I’m fine paying for support, but that is not even provided as far as I know (for free accounts).
      • twawaaay 4y ago
        It is a bit as with insurance. You pay insurance in case something happens. The insurance model is based on the assumption that a lot of people will be paying for it without getting the insurance back, otherwise it does not make financial sense. The cheapest paid workspace account is cheap enough that it probably costs less than processing a single support ticket. Remember, when you loose access you are probably looking at multiple touch points and multiple people on their side to get you back. You wouldn't want any single person to be able to just change whatever they want? So if they allowed it, people would just pay for the privilege once to get the problem resolved and then downgrade themselves back after one month. The issue here is that the ratio of free accounts to paid accounts is so high that if any support was allowed for unpaid accounts it would absolutely deluge the system and paid accounts would have to pay a lot more to cover the cost of support for unpaid accounts. But I do think they could provide a paid support ticket where you can pay an amount that would cover their costs (and of course then some) for a single support request. The issue with this is that somebody could do this to "recover" account that does not belong to them. Paradoxically, there is some extra security in not allowing any social hacking by just not allowing any manual work on the account.
        • ghaff 4y ago
          >The issue with this is that somebody could do this to "recover" account that does not belong to them. Paradoxically, there is some extra security in not allowing any social hacking by just not allowing any manual work on the account. That's the problem. The more flexible you are with helping a customer, especially just over a phone or computer, the more open you are to social engineering attacks. At least in the US, there are various processes involving notarized/Medallion signatures and the like. But at that point some not insignificant number of people will complain the processes are too onerous, they don't have a local bank, etc.
        • ashurov 4y ago
          I wouldn’t mind paying a premium instead of a monthly insurance fee to get this resolved. And I have time, it doesn’t need to get resolved today.
    • weberer 4y ago
      >It is up to you to make sure you don't loose access. The problem in my case was that Google changed the rules halfway through. I kept my username and password perfectly secure in my password manager. But one day they suddenly decided that I can't log in until I respond to an SMS code they sent to a phone number they somehow got from me 12 years ago that I no longer have access to. It would be fair for them to not suddenly force SMS MFA without the user's consent.
• twawaaay 4y ago
  That's not really true. It would be if it was done right, but most companies have some way of getting around it. I lost my yubikey I used for my AWS account (I know, I should have two but I really did not have anything worthwhile on this account). I also changed phone numbers in the meantime as well as email. And then proceeded to forget my root password. I have not used the account for a number of years and it really did not sink in until I needed it. See? You would think I was totally and utterly fucked. Well, not. I called them and with a procedure that took some 3 days and numerous phone calls, id photos, etc. But I finally got the access to my account back.
  • elif 4y ago
    This is my biggest fear. Even if I use 2FA completely safely, using a physical chip, for 10/10 sites I care about, someone could spoof my phone number, call tech support with the right attitude, and remove my 2FA. I'm so over the phone system and the credit card system. We have superiors but we are stuck in the past culturally.
    • Xylakant 4y ago
      Good providers have a deliberately slow and onerous process in place - send proof of identity, multiple notices to the account owner, sometimes even documents mailed to a physical address. It needs to be possible to recover high value accounts - what else would you propose as a better solution?
      • twawaaay 4y ago
        Yeah, that's exactly the point. If the process takes couple of days and they do a lot of communication, there is a good chance the real owner of the account will get notified and have time to react before the attacker gets access to the account. Also, the commenters are completely wrong on that it is enough to have the email or ID to get through the process. The AWS people who contacted me required a lot more information that only the owner of the account would know.
  • tjoff 4y ago
• themitigating 4y ago
  Print backup codes for each service
  • smt88 4y ago
    A lot of services use SMS as a second factor and offer no backup codes.
    • julianlam 4y ago
      In those cases I opt to have no 2FA at all. Only culprit that's really enforced it is the Canada Revenue Agency
      • tjbiddle 4y ago
        Some services force you to use SMS 2FA. My bank recently made a 'security' updates and now my Google Voice number no longer works with their text or call 2FA. They provide no other alternatives and I must have it. I have to now call their customer service, wait a half hour to speak to someone, verify my identity, and have them reset in order for me to login. Thankfully I rarely login to that bank as it's not used for much, but if it goes on for more than 2 months or so - I'll probably switch.
        • throwaway67743 4y ago
          I honestly find 2fa enforcement detremential and it should be entirely possible to opt out - case in point my current bank (not by choice, ridiculous country that can't manage to join the euro) are disabling SMS 2fa for online banking and suggest using their app, except the app doesn't work (they'll still send 3ds via SMS though!!) and they've basically stopped bothering to reply - anyway the point really is that people who are not morons should be able to opt out, because the onus and damage on the end user often outweighs any possible risk of stealing funds etc (there's literally nothing in the account, standing order sends all of my income to a useful bank abroad the day after it arrives). As an aside, open banking is also a joke as it doesn't allow the end user access to their own account, only 3rd parties - simple API access would make this problem moot, as where I hold my funds grants me API access and I can do things like trigger transfers on webhooks etc, very simple and infinitely useful.
• rr808 4y ago
  Its also a big problem for me because I want a super cheap phone plan, I dont need a good or fast service, I dont really need a phone number, but I need reliable and secure account for stuff like this. Can't wait for SMS 2FA to disappear.
  • davewritescode 4y ago
    The problem with ALL MFA factors including SMS is that they can disappear. One of the reasons we like SMS in my company is because in our experience the support costs of MFA are astronomical for other factors because the rate at which users seem to lose them. In practice, a lot of the non-sms factors end up requiring reset every couple of years on average. It means our support orgs end up treating MFA resets as routine and that in itself can lead to situations where you open your customers up to social engineering attacks on support and support tooling. There's really no easy answer here, my only hope is that eventually we move to government issued, strong, digital identities as second factors.
    • chungy 4y ago
      TOTP with proper diligence (backing up your codes) is just about the best of everything. You aren't dependent on any third parties for an MFA factor; your email and phone providers may disappear, but your TOTP code is as secure as you've made it.
      • mort96 4y ago
        We're literally talking about people losing their codes. What makes you think most people even have a system to securely archive TOTP codes long term, much less actually think to do it? What if an iPhone user uses Apple Notes to store their TOTP keys (probably one of the most reasonable ways accessible to a non-technical user), but then 5 years down the line switches to Android, 5 more years pass and they've entirely forgotten that they even used to put TOTP codes in Apple Notes 10 years ago, and then they need their TOTP codes? Securely archiving things which are rarely if ever needed across many decades is an incredibly hard problem, and I would trust approximately 0% of users to do it correctly.
• DocTomoe 4y ago
  I am currently in the process of switching banks because the old one makes it difficult for me to change the number (and device) associated with my account (to the point where I have to send in a signed letter, which they then refuse because my signature 20 years ago does not match my signature today). Security is important. Security that is implemented badly costs you business.
  • davewritescode 4y ago
    I wouldn't say it's badly implemented, I would say that the implementation clearly errs on the side of preventing social engineering than giving customers who can't match their signature a good experience. I've been a part of designing these types of processes and this is all argued about forever. The alternative is the e*trade approach where I can call in, give my DOB, Address and last 4 digits of my social social and I get a new MFA token immediately. No PIN, no signature nothing.
    • CamperBob2 4y ago
      So your model is dictated by the potential behavior of criminals rather than the actual needs of customers... and you don't consider this to be "badly implemented." What company did you say you were designing security policies/processes for...?
      • davewritescode 4y ago
        The processes are dictated by what legal, compliance and the business at large are willing to let you use to recover MFA and that doesn't always match with UX. If the legal/compliance team says signatures have to match, what are you, as an engineer supposed to do? The process we use now is automated but customers don't like having to find recovery pins, billing information so a lot of them still call if they get a new phone and their TOTP isn't there. It will also fail for various other reasons related to browser fingerprinting and reputation that I won't go into details about. MFA recovery is very tricky, most websites don't even let you do it in an automated way for security reasons. If it goes wrong, you've basically broken MFA for your whole site. Banks are the types of places that are going to err way on the side of caution.
• LocalPCGuy 4y ago
  This is why you always (always) have backup codes. If a site doesn't provide them (and only allows 2FA via SMS rather than also via Time-based one-time password), that's a huge red flag to me (and yes, I'm aware some very large sites fall into that bucket).
  • tjoff 4y ago
    So U2F is a red flag? Maybe 2FA should be considered a red flag at this point.
    • LocalPCGuy 4y ago
      2FA by itself isn't a flag to me, only offering 2FA via SMS is. It means to me they did the bare minimum in order to say they offer 2FA.