4 ms·
It is the very rare site or service that actually refuses to let you back in with an email confirmation or something. Sites with SMS 2FA / mobile app 2FA will
by philsnow 4y ago
It is the very rare site or service that actually refuses to let you back in with an email confirmation or something. Sites with SMS 2FA / mobile app 2FA will nearly 100% of the time let you fall back to email.
And why not? It's a huge support burden to do otherwise. You can say "we told you that you'd be locked out" and not even confirm to the user that an account exists with that user ID, but then half of the users who get locked out will complain about it on social media.
You can only really enforce 2FA if your site has to do with money or similar.
- knaik94 4y agoFor major sites, FAMG having access to email is not enough in my experience. I was recently locked out of my Instagram account and lost my 2FA. Instagram required me to contact support from a known previously associated email, but on top of that I had to upload a picture of myself holding a piece of paper with a handwritten nonce and they checked against my previously uploaded pictures. I also had to wait a period of time before they would telling me what nonce to use and starting the verification process. I have heard stories of people not being let in and having to contact friends who work at Facebook and have access to the internal support queue. I know my friend had to do something similar at Google and have a friend make a internal support ticket when they were locked out of a gmail account. That experience with Instagram is the reason I moved away from using DUO for everything to Aegis where I can copy a password encrypted backup of my 2FA secret keys like I would any file. I am grateful I learned that lesson by losing 2FA to a single account.