40 ms·

This is my nightmare. This is why I refuse to use 2FA. (Except on services that require it, and I wish they didn't require it.) Am I worried about getting hack

This is my nightmare. This is why I refuse to use 2FA. (Except on services that require it, and I wish they didn't require it.) Am I worried about getting hacked? Absolutely! But when I weigh the likelihood of (1) someone else getting into my account without 2FA and (2) locking myself out of my own account with 2FA, the latter seems much more likely! I understand how backup codes work. I promise you I will loose them.

DoreenMichele 4y ago
I'm seriously medically handicapped and have terrible eyesight issues. I typed the wrong password at first. I still had 1 percent power on my phone earlier and was previously able to get a code on it and I hoped I could get one last code before it outright died, so I said "Yeah, sure, send it to my phone" since they don't really want to do it another way. So then I had to ask another way when I couldn't get to it because that is when the phone gave up the ghost for good. And then they said "We shall send you a link in 24 hours." So I moved the sim card and got text messages saying "Was this you?" and I said "Yeah, it was." and cancelled my "account recovery process" and tried to continue setting up my new phone because the old one is dead. And this is when Google decided I must be a for serious criminal and told me "We shall send you an email in 72 hours." So I'm quite upset at this point.
- shyn3 4y ago
  I think you should take your phone to a store which can fix your phone. Googles code doesn't come as an SMS it comes as a notification from the Google app. Almost lost an account to this last week. Turned off 2fa.
  - DoreenMichele 4y ago
    I'm in a small town. I have no car. I no longer drive. I don't see well enough. I work from home due to my medical situation. I have no friends locally who can drive me someplace. Etc etc etc. This is a non-starter for me. I need Google to fix this. I can't do anything about the busted phone at this point.
    - actionfromafar 4y ago
      On HN you might get access to someone at Google, or someone from here might drive TO you. Any takers? I’m on the wrong continent.
      - deleted 4y ago
        [deleted]
    - shyn3 4y ago
      Sorry to hear about your situation. We really need to host our own email or utilize a paid service, but it becomes cumbersome and expensive. I'm not sure what the solution to this is.
    - TeMPOraL 4y ago
      On the off chance it helps, because I don't see anyone else mentioning it: could it be that your charging port is stuffed with lint? If you have a thin needle, try to poke inside and see how much material can you get out of the port. Despite this being a common problem, it's not well recognized, and it's easy to forget about it too. I went through several charging cables and almost replaced my phone half a year ago, before I remembered - and sure enough, all my charging issues were caused by a layer of lint at the back of the port, that got compacted by the charging cable so well that it formed a flat "false wall". I forgot all about it, even though I've performed the exact same fix on other people's devices in the past. Hope it helps; if not, I apologize for wasting your time.
      - DoreenMichele 4y ago
        Thank you. That is not the issue.
      - prawn 4y ago
        This has happened to me at least twice and it’s taken too long to realise each time. Further, even if you think you’ve cleaned it, it can need more. I’ve had to scrape away at it before it will charge, and even then sometimes only at an angle or with a book resting on the cable/connection. Given it’s not OP’s issue, hopefully these posts help someone else.
- vineyardmike 4y ago
  I don’t know all the conditions of your devices, and your accounts, so I don’t know if this will even help. It’s probably too late for this advice and your Google account, but maybe for other accounts. If not you, hopefully someone else who reads this. Many accounts that support 2FA let you download a few (commonly 10) static codes that don’t change. If you anticipate a situation where you may lose connectivity access like this, it may make sense to download the codes and store them in a physical notebook.
ianmf 4y ago
You could print them and store them in a safe, or in your parents' collections of old embarrassing photos of you. Just an idea.
mattrighetti 4y ago
I carefully store backup codes on my Bitwarden vault so I know where to find them. Also, I use Yubikeys for 2FA, those are reliable enough and you don’t need to rely on phones that could break.
- Biganon 4y ago
  If you store the backup codes in your Bitwarden account, why not simply store the secret itself there, and use Bitwarden as your TOTP app?
  - mattrighetti 4y ago
    I find it convenient to just touch a key instead of copy/pasting a TOTP
class4behavior 4y ago
>This is why I will not use 2FA except on services where it is absolutely required Software 2FA just computes a number based on a secret string. You treat the latter the same way you take care of your passwords. That's why it's best to handle them with your password manager. 2FA over SMS is even less of an issue (except maybe with a broken eSIM chip). Physical methods are a problem, so you have to spend money for a backup.
- Wowfunhappy 4y ago
  I could store the secret in my password manager if I paid for Bitwarden Premium (and at $10 a year, price isn't really the issue), but then what is even the point? If my password and my secret are stored in the same place then that's really just a single factor, so I'm making the login process more annoying for no reason.
  - Jarwain 4y ago
    I'd see it as a single point of failure, but not necessarily a single factor. If the password is compromised due to a problem on the application side, they still can't get in to your account without the TOTP code. Of course the threat model is kinda skewed because this case is more applicable when one's reusing passwords or using weak passwords, which shouldn't be happening if you're using a password manager. Maybe a more relevant threat is password gets compromised from a MITM attack, in which case they still don't have access to your TOTP
    - Wowfunhappy 4y ago
      > If the password is compromised due to a problem on the application side, they still can't get in to your account without the TOTP code. But as you say, since I'm using a password manager, this doesn't feel like a legitimate concern. If the application's database leaks, my password is still safe, because no one will crack a randomly generated 20+ character password. > Maybe a more relevant threat is password gets compromised from a MITM attack, in which case they still don't have access to your TOTP But they'll have the code, so as long as they use it right away, they can still get into my account and download my data / spam my contacts / whatever.
jrochkind1 4y ago
I use authy (free) for 2FA TOTP and have it set up on my work laptop, my home laptop, and my phone. As long as least one of those is still good, I should still be able to get in. I honestly don't know what's going on behind the scenes to know if this is not as secure as it "should" be. But this was my reaction specifically to the non-SMS TOTP 2fa: Wait, if I lose my phone there's literally no way possible to get in? Oh there is, if I have the backup codes... yeah right, you think I can hold on to backup codes? Surely there's something I'm missing, what is everyone else doing here? Oh, everyone else is just hoping they never lose their phone? Really?
- crooked-v 4y ago
  > As long as least one of those is still good, I should still be able to get in. Google has, in some cases, started requiring auth codes sent to specific devices, even if you're already using your own configured TOTP 2FA.
  - icelancer 4y ago
    Correct. I have a fully bricked tablet because of this.
  - jrochkind1 4y ago
    They expect that none of your devices will ever die? This makes no sense.
    - crooked-v 4y ago
      It makes plenty of sense to Google: engineer for the 98% use case and the remaining 2% should just go away and stop wasting their time.
      - stubish 4y ago
        100% of devices will fail, eventually. It is kicking the can down the road.
vbezhenar 4y ago
It's simple. If you assume the real possibility of losing your digital account, then act like you'll lose it tomorrow. Adjust your life and move on. I don't care about digital accounts. I switch my main mail and phone every few years just for the sake of it. I avoid buying stuff bound to digital account. My accounts are disposable and have zero value other than nostalgic one. I didn't lose a single account yet. I have printed backup codes, I have password manager, I have passwords backup in a text file on thumb drive, two copies. I have my domain held by registrar in my country, so I can just visit their office with my ID and talk with them. So I take some reasonable measures to protect myself. But I have no fear of losing those digital assets. I actually gave a thought about protecting myself by creating a single 100% reliable email and then bind other accounts to that mail. Believe it or not: I didn't find any provider which would satisfy me. My worst case scenario: I'm going to jail for 20 years. Every free provider will delete my account after few years of inactivity. Paid providers usually are small enough so I wouldn't trust them anyway. My current plan is using my own domain with autopayment and enough balance on account. But of course that's not reliable. Registrar might just go bankrupt. And I can't really reserve my domain for 50 years no matter how much money would I pay.
- djbusby 4y ago
  Wow, wish I thought of that 24 years ago. Also, check out mxroute.com for SMTP/IMAP needs.
- thiht 4y ago
  > But of course that's not reliable. Registrar might just go bankrupt If you registered a gTLD, you're theoretically safe from registrar bankruptcy, or even from a registrar losing all their data for whatever reason. Per the ICANN agreement, the registrars have to send a copy of their database to a third party escrow agent regularly (where I worked before we sent a differential backup everyday and a full backup once a week). This way, if the registrar cannot assume its role anymore, another registrar takes over. Note that this is not true for ccTLDs (ie. every 2 character TLD). That's a reason you should prefer gTLDs if you want to prevent a worst case scenario. I usually recommend a .com or .net because Verisign is, in my opinion, the most reliable registry in the world. If you stick with .com/.net, you're safe from any registrar failure, and there's not a single chance that anything happens to the registry. ccTLDs might have an emergency plan but it will depend on the registry. So if you really want a ccTLD: - get familiar with the registry and its rules - do NOT get the ccTLD of a country other than your own. Eligibility rules can change, so you could lose your domain if the registry decides that they now want to only sell to residents. British people lose eligibility over .eu for example, not because a change in eligibility rules, but because of a change in their own status. - do NOT get the ccTLD of a small country, unless the registry delegates the technical stuff to a reliable registry backend. Small countries have crappy infrastructures, so DNS resolution could get unreliable. This famously happened to Notion.so (so -> Somalia) a little while ago.
Alex3917 4y ago
> This is why I refuse to use 2FA. That just makes it even more likely you'll lose access. If you have 2fA, Google will just ask for your 2fa. If you don't have 2fa, Google will pick some random device you signed in on once ten years ago, and tell you that you can only ever log into your account again if it's from that device.
- arc-in-space 4y ago
  It seems possible to disable this by manually logging out of all your devices in google account management, then never using them to log into your google account again. I've done that, but the fact that this is the only solution is unbelievably insane.
nyolfen 4y ago
you can set up multiple redundant mfa methods, eg i have two yubikeys in separate locations plus phone totp
ImaCake 4y ago
I understand this view. Unlike every other reply to your comment I am not going to suggest various 2FA schemes that I would invariably screw-up and just add my voice to yours. 2FA might be good for security, but it's also very ableist.
- Biganon 4y ago
  I was able to answer something snarky to you, but then I gave it more thought and realized you're right. Anything beyond a simple password is very complicated when you're dirt poor. Printing is complicated. Having a physical vault is complicated. Buying a yubikey is complicated. Paying for the premium version of a password manager is complicated. Just like with accessibility on the web, it's so easy to forget about that when you're not in the situation yourself. Thank you
  - ImaCake 4y ago
    Thanks for a lovely comment. I am privileged myself, which makes it hard for me to see what systems oppress those less fortunate. But I often "peak over the fence" when I deal with my ADHD and face the challenges of renting in a volatile market. I move often, and I forget/lose stuff constantly. I have to laugh when people suggest a physical yubikey - there is no way I am not going to lose it eventually. I don't have a lot of sympathy for big tech when it so clearly fails to enfranchise those that need it most.
  - Biganon 4y ago
    I was about*
djha-skin 4y ago
Use a password manager and your problems will all disappear.
jjav 4y ago
> Am I worried about getting hacked? Absolutely! If you set a strong, long, unique password for every account, your chances of getting the account compromised are just about zero. 2FA is a good thing in most cases, but I do hate how the industry has blindly adopted it as some sort of mantra that you can't exist without. The reality is that if you chose 128+ bit passwords generated out of /dev/random, they cannot be brute-forced within the lifetime of the universe. You might get phished, which is entirely different, but if you're careful about that you'll do fine without 2FA.
- themagician 4y ago
  Companies leak passwords constantly.
- _morgs_ 4y ago
  How will you avoid fake login pages? Those can even phish SMS and TOTP 2FA. Yubikey 2FA (and equivalents) help to solve this.
  - Wowfunhappy 4y ago
    Bitwarden will show if I'm not on the right domain. It's not perfect, but a USB key is a nonstarter for me (going back to "I'm more worried about locking myself out than someone else getting in.")
- mewpmewp2 4y ago
  Where do you store those passwords?
Abimelex 4y ago
There are redundancy systems to avoid getting locked out of 2FA. - 1st Backup Codes: Store a bunch of 2FA backup codes on a safe location, best not in YOUR home, in case it burns down. - 2nd SMS verification: some services offer you a fallback to SMS in case you don't have your 2FA device with you. But keep in mind, that SMS is also one of the least secure 2FA methods. - 3rd instead of having your auth codes only on one device, use a service for it like Authy, so you can install it on as much devices as you like, if one dies, it's easy to configure a new one.
- ridgered4 4y ago
  > - 2nd SMS verification: some services offer you a fallback to SMS in case you don't have your 2FA device with you. But keep in mind, that SMS is also one of the least secure 2FA methods. Isn't this a common complaint that SMS fallback cannot even be turned off? People say SMS is not secure enough so they switch to something better, but all the services do SMS fallback anyway so what is the point of using the more secure one?
ptman 4y ago
Not all 2FA is the same. SMS 2FA leads to these problems. But A FIDO2/WebAuthn token (yubikey or similar) would help you stay secure and independent from your phone. I agree that yubikey is a bit expensive, but there are alternatives. Token2 seems quite bit cheaper, but depends on shipping: https://www.token2.com/shop/product/token2-t2f2-fido2-and-u2f-security-key https://www.token2.com/shop/product/token2-t2f2-fido2-and-u2...
- carlmr 4y ago
  >SMS 2FA leads to these problems. I have broken my phone multiple times, but I always stick to SMS 2FA because as long as I keep paying I will get a new SIM card in 2-3 days, and not be locked out, because of a lost or broken device.
- sph 4y ago
  I would avoid a Yubikey if I were homeless and someone could steal it or I could lose it. Just stick your 2FAs in your password manager, like I do with Bitwarden. I secure it with a Yubikey, but if I lost my house, I would just remove 2FA from it. My bigger concern would be to get cut out, than people somehow guessing my master password. SMS 2FA is always a terrible idea, homeless or not. It's honestly better to just go 1FA in that case.
ajyotirmay 4y ago
I love 2FA, but only the TOTP based ones. No codes on my phone, emails or already authorized devices please
- thiht 4y ago
  Github is extremely insistant on sending me a 2FA push notification on the mobile app every time I want to connect to the desktop. I find it very annoying because I configured TOTP based 2FA and do not want to rely on any proprietary 2FA mechanism. I just can't seem to make it understand that I want to use my TOTP tokens and only that.
  - alpentmil 4y ago
    remove mobile app as a 2FA. Use U2F/FIDO.
    - thiht 4y ago
      There’s no way to remove it if you have the app installed
      - ridgered4 4y ago
        What does it do if your device is off or somewhere inaccessible? (sounds frustrating)
alpentmil 4y ago
Can say for sure if you have any of FAANG accounts next time you get a new laptop or even reinstall - you will get locked out. Get a 2FA using QR code or U2F key (not SMS or phone based).

DoreenMichele 4y ago

I'm seriously medically handicapped and have terrible eyesight issues. I typed the wrong password at first. I still had 1 percent power on my phone earlier and was previously able to get a code on it and I hoped I could get one last code before it outright died, so I said "Yeah, sure, send it to my phone" since they don't really want to do it another way. So then I had to ask another way when I couldn't get to it because that is when the phone gave up the ghost for good. And then they said "We shall send you a link in 24 hours." So I moved the sim card and got text messages saying "Was this you?" and I said "Yeah, it was." and cancelled my "account recovery process" and tried to continue setting up my new phone because the old one is dead. And this is when Google decided I must be a for serious criminal and told me "We shall send you an email in 72 hours." So I'm quite upset at this point.

shyn3 4y ago
I think you should take your phone to a store which can fix your phone. Googles code doesn't come as an SMS it comes as a notification from the Google app. Almost lost an account to this last week. Turned off 2fa.
- DoreenMichele 4y ago
  I'm in a small town. I have no car. I no longer drive. I don't see well enough. I work from home due to my medical situation. I have no friends locally who can drive me someplace. Etc etc etc. This is a non-starter for me. I need Google to fix this. I can't do anything about the busted phone at this point.
  - actionfromafar 4y ago
    On HN you might get access to someone at Google, or someone from here might drive TO you. Any takers? I’m on the wrong continent.
    - deleted 4y ago
      [deleted]
  - shyn3 4y ago
    Sorry to hear about your situation. We really need to host our own email or utilize a paid service, but it becomes cumbersome and expensive. I'm not sure what the solution to this is.
  - TeMPOraL 4y ago
    On the off chance it helps, because I don't see anyone else mentioning it: could it be that your charging port is stuffed with lint? If you have a thin needle, try to poke inside and see how much material can you get out of the port. Despite this being a common problem, it's not well recognized, and it's easy to forget about it too. I went through several charging cables and almost replaced my phone half a year ago, before I remembered - and sure enough, all my charging issues were caused by a layer of lint at the back of the port, that got compacted by the charging cable so well that it formed a flat "false wall". I forgot all about it, even though I've performed the exact same fix on other people's devices in the past. Hope it helps; if not, I apologize for wasting your time.
    - DoreenMichele 4y ago
      Thank you. That is not the issue.
    - prawn 4y ago
      This has happened to me at least twice and it’s taken too long to realise each time. Further, even if you think you’ve cleaned it, it can need more. I’ve had to scrape away at it before it will charge, and even then sometimes only at an angle or with a book resting on the cable/connection. Given it’s not OP’s issue, hopefully these posts help someone else.
vineyardmike 4y ago
I don’t know all the conditions of your devices, and your accounts, so I don’t know if this will even help. It’s probably too late for this advice and your Google account, but maybe for other accounts. If not you, hopefully someone else who reads this. Many accounts that support 2FA let you download a few (commonly 10) static codes that don’t change. If you anticipate a situation where you may lose connectivity access like this, it may make sense to download the codes and store them in a physical notebook.

ianmf 4y ago

You could print them and store them in a safe, or in your parents' collections of old embarrassing photos of you. Just an idea.

mattrighetti 4y ago

I carefully store backup codes on my Bitwarden vault so I know where to find them. Also, I use Yubikeys for 2FA, those are reliable enough and you don’t need to rely on phones that could break.

Biganon 4y ago
If you store the backup codes in your Bitwarden account, why not simply store the secret itself there, and use Bitwarden as your TOTP app?
- mattrighetti 4y ago
  I find it convenient to just touch a key instead of copy/pasting a TOTP

class4behavior 4y ago

>This is why I will not use 2FA except on services where it is absolutely required Software 2FA just computes a number based on a secret string. You treat the latter the same way you take care of your passwords. That's why it's best to handle them with your password manager. 2FA over SMS is even less of an issue (except maybe with a broken eSIM chip). Physical methods are a problem, so you have to spend money for a backup.

Wowfunhappy 4y ago
I could store the secret in my password manager if I paid for Bitwarden Premium (and at $10 a year, price isn't really the issue), but then what is even the point? If my password and my secret are stored in the same place then that's really just a single factor, so I'm making the login process more annoying for no reason.
- Jarwain 4y ago
  I'd see it as a single point of failure, but not necessarily a single factor. If the password is compromised due to a problem on the application side, they still can't get in to your account without the TOTP code. Of course the threat model is kinda skewed because this case is more applicable when one's reusing passwords or using weak passwords, which shouldn't be happening if you're using a password manager. Maybe a more relevant threat is password gets compromised from a MITM attack, in which case they still don't have access to your TOTP
  - Wowfunhappy 4y ago
    > If the password is compromised due to a problem on the application side, they still can't get in to your account without the TOTP code. But as you say, since I'm using a password manager, this doesn't feel like a legitimate concern. If the application's database leaks, my password is still safe, because no one will crack a randomly generated 20+ character password. > Maybe a more relevant threat is password gets compromised from a MITM attack, in which case they still don't have access to your TOTP But they'll have the code, so as long as they use it right away, they can still get into my account and download my data / spam my contacts / whatever.

jrochkind1 4y ago

I use authy (free) for 2FA TOTP and have it set up on my work laptop, my home laptop, and my phone. As long as least one of those is still good, I should still be able to get in. I honestly don't know what's going on behind the scenes to know if this is not as secure as it "should" be. But this was my reaction specifically to the non-SMS TOTP 2fa: Wait, if I lose my phone there's literally no way possible to get in? Oh there is, if I have the backup codes... yeah right, you think I can hold on to backup codes? Surely there's something I'm missing, what is everyone else doing here? Oh, everyone else is just hoping they never lose their phone? Really?

crooked-v 4y ago
> As long as least one of those is still good, I should still be able to get in. Google has, in some cases, started requiring auth codes sent to specific devices, even if you're already using your own configured TOTP 2FA.
- icelancer 4y ago
  Correct. I have a fully bricked tablet because of this.
- jrochkind1 4y ago
  They expect that none of your devices will ever die? This makes no sense.
  - crooked-v 4y ago
    It makes plenty of sense to Google: engineer for the 98% use case and the remaining 2% should just go away and stop wasting their time.
    - stubish 4y ago
      100% of devices will fail, eventually. It is kicking the can down the road.

vbezhenar 4y ago

It's simple. If you assume the real possibility of losing your digital account, then act like you'll lose it tomorrow. Adjust your life and move on. I don't care about digital accounts. I switch my main mail and phone every few years just for the sake of it. I avoid buying stuff bound to digital account. My accounts are disposable and have zero value other than nostalgic one. I didn't lose a single account yet. I have printed backup codes, I have password manager, I have passwords backup in a text file on thumb drive, two copies. I have my domain held by registrar in my country, so I can just visit their office with my ID and talk with them. So I take some reasonable measures to protect myself. But I have no fear of losing those digital assets. I actually gave a thought about protecting myself by creating a single 100% reliable email and then bind other accounts to that mail. Believe it or not: I didn't find any provider which would satisfy me. My worst case scenario: I'm going to jail for 20 years. Every free provider will delete my account after few years of inactivity. Paid providers usually are small enough so I wouldn't trust them anyway. My current plan is using my own domain with autopayment and enough balance on account. But of course that's not reliable. Registrar might just go bankrupt. And I can't really reserve my domain for 50 years no matter how much money would I pay.

djbusby 4y ago
Wow, wish I thought of that 24 years ago. Also, check out mxroute.com for SMTP/IMAP needs.
thiht 4y ago
> But of course that's not reliable. Registrar might just go bankrupt If you registered a gTLD, you're theoretically safe from registrar bankruptcy, or even from a registrar losing all their data for whatever reason. Per the ICANN agreement, the registrars have to send a copy of their database to a third party escrow agent regularly (where I worked before we sent a differential backup everyday and a full backup once a week). This way, if the registrar cannot assume its role anymore, another registrar takes over. Note that this is not true for ccTLDs (ie. every 2 character TLD). That's a reason you should prefer gTLDs if you want to prevent a worst case scenario. I usually recommend a .com or .net because Verisign is, in my opinion, the most reliable registry in the world. If you stick with .com/.net, you're safe from any registrar failure, and there's not a single chance that anything happens to the registry. ccTLDs might have an emergency plan but it will depend on the registry. So if you really want a ccTLD: - get familiar with the registry and its rules - do NOT get the ccTLD of a country other than your own. Eligibility rules can change, so you could lose your domain if the registry decides that they now want to only sell to residents. British people lose eligibility over .eu for example, not because a change in eligibility rules, but because of a change in their own status. - do NOT get the ccTLD of a small country, unless the registry delegates the technical stuff to a reliable registry backend. Small countries have crappy infrastructures, so DNS resolution could get unreliable. This famously happened to Notion.so (so -> Somalia) a little while ago.

Alex3917 4y ago

> This is why I refuse to use 2FA. That just makes it even more likely you'll lose access. If you have 2fA, Google will just ask for your 2fa. If you don't have 2fa, Google will pick some random device you signed in on once ten years ago, and tell you that you can only ever log into your account again if it's from that device.

arc-in-space 4y ago
It seems possible to disable this by manually logging out of all your devices in google account management, then never using them to log into your google account again. I've done that, but the fact that this is the only solution is unbelievably insane.

nyolfen 4y ago

you can set up multiple redundant mfa methods, eg i have two yubikeys in separate locations plus phone totp

ImaCake 4y ago

I understand this view. Unlike every other reply to your comment I am not going to suggest various 2FA schemes that I would invariably screw-up and just add my voice to yours. 2FA might be good for security, but it's also very ableist.

Biganon 4y ago
I was able to answer something snarky to you, but then I gave it more thought and realized you're right. Anything beyond a simple password is very complicated when you're dirt poor. Printing is complicated. Having a physical vault is complicated. Buying a yubikey is complicated. Paying for the premium version of a password manager is complicated. Just like with accessibility on the web, it's so easy to forget about that when you're not in the situation yourself. Thank you
- ImaCake 4y ago
  Thanks for a lovely comment. I am privileged myself, which makes it hard for me to see what systems oppress those less fortunate. But I often "peak over the fence" when I deal with my ADHD and face the challenges of renting in a volatile market. I move often, and I forget/lose stuff constantly. I have to laugh when people suggest a physical yubikey - there is no way I am not going to lose it eventually. I don't have a lot of sympathy for big tech when it so clearly fails to enfranchise those that need it most.
- Biganon 4y ago
  I was about*

djha-skin 4y ago

Use a password manager and your problems will all disappear.

jjav 4y ago

> Am I worried about getting hacked? Absolutely! If you set a strong, long, unique password for every account, your chances of getting the account compromised are just about zero. 2FA is a good thing in most cases, but I do hate how the industry has blindly adopted it as some sort of mantra that you can't exist without. The reality is that if you chose 128+ bit passwords generated out of /dev/random, they cannot be brute-forced within the lifetime of the universe. You might get phished, which is entirely different, but if you're careful about that you'll do fine without 2FA.

themagician 4y ago
Companies leak passwords constantly.
_morgs_ 4y ago
How will you avoid fake login pages? Those can even phish SMS and TOTP 2FA. Yubikey 2FA (and equivalents) help to solve this.
- Wowfunhappy 4y ago
  Bitwarden will show if I'm not on the right domain. It's not perfect, but a USB key is a nonstarter for me (going back to "I'm more worried about locking myself out than someone else getting in.")
mewpmewp2 4y ago
Where do you store those passwords?

Abimelex 4y ago

There are redundancy systems to avoid getting locked out of 2FA. - 1st Backup Codes: Store a bunch of 2FA backup codes on a safe location, best not in YOUR home, in case it burns down. - 2nd SMS verification: some services offer you a fallback to SMS in case you don't have your 2FA device with you. But keep in mind, that SMS is also one of the least secure 2FA methods. - 3rd instead of having your auth codes only on one device, use a service for it like Authy, so you can install it on as much devices as you like, if one dies, it's easy to configure a new one.

ridgered4 4y ago
> - 2nd SMS verification: some services offer you a fallback to SMS in case you don't have your 2FA device with you. But keep in mind, that SMS is also one of the least secure 2FA methods. Isn't this a common complaint that SMS fallback cannot even be turned off? People say SMS is not secure enough so they switch to something better, but all the services do SMS fallback anyway so what is the point of using the more secure one?

ptman 4y ago

Not all 2FA is the same. SMS 2FA leads to these problems. But A FIDO2/WebAuthn token (yubikey or similar) would help you stay secure and independent from your phone. I agree that yubikey is a bit expensive, but there are alternatives. Token2 seems quite bit cheaper, but depends on shipping: https://www.token2.com/shop/product/token2-t2f2-fido2-and-u2f-security-key https://www.token2.com/shop/product/token2-t2f2-fido2-and-u2...

carlmr 4y ago
>SMS 2FA leads to these problems. I have broken my phone multiple times, but I always stick to SMS 2FA because as long as I keep paying I will get a new SIM card in 2-3 days, and not be locked out, because of a lost or broken device.
sph 4y ago
I would avoid a Yubikey if I were homeless and someone could steal it or I could lose it. Just stick your 2FAs in your password manager, like I do with Bitwarden. I secure it with a Yubikey, but if I lost my house, I would just remove 2FA from it. My bigger concern would be to get cut out, than people somehow guessing my master password. SMS 2FA is always a terrible idea, homeless or not. It's honestly better to just go 1FA in that case.

ajyotirmay 4y ago

I love 2FA, but only the TOTP based ones. No codes on my phone, emails or already authorized devices please

thiht 4y ago
Github is extremely insistant on sending me a 2FA push notification on the mobile app every time I want to connect to the desktop. I find it very annoying because I configured TOTP based 2FA and do not want to rely on any proprietary 2FA mechanism. I just can't seem to make it understand that I want to use my TOTP tokens and only that.
- alpentmil 4y ago
  remove mobile app as a 2FA. Use U2F/FIDO.
  - thiht 4y ago
    There’s no way to remove it if you have the app installed
    - ridgered4 4y ago
      What does it do if your device is off or somewhere inaccessible? (sounds frustrating)

alpentmil 4y ago

Can say for sure if you have any of FAANG accounts next time you get a new laptop or even reinstall - you will get locked out. Get a 2FA using QR code or U2F key (not SMS or phone based).