4 ms·

I use authy (free) for 2FA TOTP and have it set up on my work laptop, my home laptop, and my phone. As long as least one of those is still good, I should still

I use authy (free) for 2FA TOTP and have it set up on my work laptop, my home laptop, and my phone. As long as least one of those is still good, I should still be able to get in. I honestly don't know what's going on behind the scenes to know if this is not as secure as it "should" be. But this was my reaction specifically to the non-SMS TOTP 2fa: Wait, if I lose my phone there's literally no way possible to get in? Oh there is, if I have the backup codes... yeah right, you think I can hold on to backup codes? Surely there's something I'm missing, what is everyone else doing here? Oh, everyone else is just hoping they never lose their phone? Really?

crooked-v 4y ago
> As long as least one of those is still good, I should still be able to get in. Google has, in some cases, started requiring auth codes sent to specific devices, even if you're already using your own configured TOTP 2FA.
- icelancer 4y ago
  Correct. I have a fully bricked tablet because of this.
- jrochkind1 4y ago
  They expect that none of your devices will ever die? This makes no sense.
  - crooked-v 4y ago
    It makes plenty of sense to Google: engineer for the 98% use case and the remaining 2% should just go away and stop wasting their time.
    - stubish 4y ago
      100% of devices will fail, eventually. It is kicking the can down the road.
      - NaturalPhallacy 4y ago
        Hey it worked for the UNIX epoch, till those guys retired.
      - TeMPOraL 4y ago
        They're banking on you upgrading your device before it dies, as opposed to e.g. accidentally dropping it onto pavement and cracking the screen. Had that happen to me, I was saved by still having the backup codes + having some unholy Tasker + Pebble automations that let me operate the phone without display - enough to launch AirDroid, use it as remote display/input to enable ADB over WiFi, and then finally use scrscpy over ADB as a remote display/input that doesn't blank out on security screens and in Google Authenticator. Only at this point I was able to transfer all the other TOTP entries in Authenticator to the new device. Lesson learned: 2FA with TOTP is a responsibility to be taken seriously, despite what security professionals would make you believe.
        cozzyd 4y ago
        Enable debugging on your phone preemptively, then you can remote display over USB :).
      - aledalgrande 4y ago
        Doesn't matter, if the current people can get promoted. Problem is for future Googlers </sarcasm>
    - nicbou 4y ago
      Many things are designed by roughly the same kind of people in roughly the same area. They are blind to a lot of use cases. Besides, it's a government's mandate to cover edge cases. Businesses only do it when compelled.
- smeej 4y ago
  I had a similarly frustrating issue happen with PayPal, only they were refusing to let me log in with my YubiKey, insisting on SMS. But their phone system couldn't send a message to me by SMS. It errored before it even tried, because I could have gotten a code on that phone if they had actually sent it. If I've agreed to use and keep track of a very small physical device to access my account, don't be going letting any ol' person who can access my phone number in there!
- halostatue 4y ago
  I have uninstalled Google applications from most of the mobile devices that I use for this exact reason.
  - bryanmgreen 4y ago
    Same! It was such an aggravation
  - saagarjha 4y ago
    Google will send you codes to devices that don’t even have the app installed. Ask me how I know.
    - alpentmil 4y ago
      use AndOTP with QR code from fdroid. Go to account settings in desktop browser and remove the phone as 2FA. It will not ask any code to device.
      - saagarjha 4y ago
        Google somehow seems to think I own this device despite it not being one of the devices on my account.
    - Wowfunhappy 4y ago
      Wait, what? How does that work?
      - saagarjha 4y ago
        It doesn't :P
- TimC123456 4y ago
  > Google has, in some cases, started requiring auth codes sent to specific devices, even if you're already using your own configured TOTP 2FA This exact situation has been such a thorn in my side at my company lately. Does anyone know any way to disable this behavior, even just with Google Workspace accounts?
- wereallterrrist 4y ago
  I've still yet to see a single bit of proof of this outside of claims from people who couldn't bother to do the things you're supposed to do when setting up 2FA. I remain skeptical. All these claims and not a single screenshot of this scenario. Meanwhile I've been in 4 countries in 8 weeks and Google hasn't bothered me once beyond the normal "tap my yubikey on my keychain".
jrmg 4y ago
> work laptop, my home laptop, and my phone There’s a fire or gas explosion or earthquake or something, and you need to leave all those behind. What do you do? > Oh, everyone else is just hoping they never lose their phone? Really? I would be very, very surprised if that’s not what the vast majority of the population is doing. Many people have a phone as their _only_ computing device, and no printer, and don’t really understand why they should be carrying around scrawled codes in their wallet.
- jrochkind1 4y ago
  > What do you do? I get screwed! I guess the right answer is that I have the backup codes carefully preserved.... off site! In case of natural disaster. Every time I sign up for a new account, I print out the backup codes, and take them to an off-site secure storage location, which of course i have... somewhere. There's no way 90%+ of internet users are doing that. I'm not even going to pretend I have any chance of doing that.
  - jrmg 4y ago
    Ah, I see we both have a more similar view than I thought! I really should be storing some codes for my password manager somewhere…
    - dotnet00 4y ago
      Although not as safe as a printout, I keep codes encrypted on a couple of flash drives, one stays in a drawer and one that's always on my person with my keys, yubikey etc. Haven't needed the codes thus far but feels like a decent compromise.
      - Wowfunhappy 4y ago
        Note that flash drives typically use the absolute cheapest NAND cells available and I'm not sure what their shelf life would be...
powerapple 4y ago
I recently switched my laptop and my phone together, even though I have the same number, I cannot recover my account. SMS is better because even if you lose your phone, you can get a replacement sim card. Only if SMS is enough. In the case of Google accounts, no, it is not enough.
newscracker 4y ago
Considering that Authy relies on an SMS OTP for the account creation (and possibly account recovery), I prefer to use something else that provides the benefits of cloud syncing across devices and isn’t tied to a phone number. I understand that SMS OTP is simple for most people to handle (encouraged by many platforms over the years), but I just cannot get past that barrier to choose Authy over something else for personal use.
- jrochkind1 4y ago
  I'm literally only using it for things that require it. (including heroku, and rubygems). My thinking is: how do I meet this requirement with the least likelyhood of later locking myself out forever, and having HN threads blaming and shaming me for not carefully preserving my backup codes in a firesafe crypt? If someone wants me enough to target Authy with an SMS reroute attack focused on me, they're gonna get me either way. I'm not Ed Snowden here, I'm just a guy trying not to lose his car keys. But, what's the thing you use that provides the benefits of cloud syncing across devices and isn’t tied to a phone number? For anyone that might be interested, including me if it seems as easy and as idiot-proof. (and free or cheap).
neurostimulant 4y ago
Most password managers has 2FA TOTP support these days so your OTP will be available on all devices that has your password manager installed.
tiborsaas 4y ago
Password managers usually have a comment field where you can store the backup codes.
pieter_mj 4y ago
Also, it's kinda like Google corrupted 2FA TOTP's workflow : it should work on any device that implements the right algorithm and secret key. Instead Google sometimes turns it into MFA tied to a specific mobile device. When that happens, Google asks to confirm with a known mobile device even though I have specifically configured 2FA TOTP since 2012 to be device independent (and I currently use keepassxc or mobile equivalent to generate the totp value). Google subsequently doesn't allow login by any other method and if the required device is lost or broken you lose access.

crooked-v 4y ago

> As long as least one of those is still good, I should still be able to get in. Google has, in some cases, started requiring auth codes sent to specific devices, even if you're already using your own configured TOTP 2FA.

icelancer 4y ago
Correct. I have a fully bricked tablet because of this.
jrochkind1 4y ago
They expect that none of your devices will ever die? This makes no sense.
- crooked-v 4y ago
  It makes plenty of sense to Google: engineer for the 98% use case and the remaining 2% should just go away and stop wasting their time.
  - stubish 4y ago
    100% of devices will fail, eventually. It is kicking the can down the road.
    - NaturalPhallacy 4y ago
      Hey it worked for the UNIX epoch, till those guys retired.
    - TeMPOraL 4y ago
      They're banking on you upgrading your device before it dies, as opposed to e.g. accidentally dropping it onto pavement and cracking the screen. Had that happen to me, I was saved by still having the backup codes + having some unholy Tasker + Pebble automations that let me operate the phone without display - enough to launch AirDroid, use it as remote display/input to enable ADB over WiFi, and then finally use scrscpy over ADB as a remote display/input that doesn't blank out on security screens and in Google Authenticator. Only at this point I was able to transfer all the other TOTP entries in Authenticator to the new device. Lesson learned: 2FA with TOTP is a responsibility to be taken seriously, despite what security professionals would make you believe.
      - cozzyd 4y ago
        Enable debugging on your phone preemptively, then you can remote display over USB :).
    - aledalgrande 4y ago
      Doesn't matter, if the current people can get promoted. Problem is for future Googlers </sarcasm>
  - nicbou 4y ago
    Many things are designed by roughly the same kind of people in roughly the same area. They are blind to a lot of use cases. Besides, it's a government's mandate to cover edge cases. Businesses only do it when compelled.
smeej 4y ago
I had a similarly frustrating issue happen with PayPal, only they were refusing to let me log in with my YubiKey, insisting on SMS. But their phone system couldn't send a message to me by SMS. It errored before it even tried, because I could have gotten a code on that phone if they had actually sent it. If I've agreed to use and keep track of a very small physical device to access my account, don't be going letting any ol' person who can access my phone number in there!
halostatue 4y ago
I have uninstalled Google applications from most of the mobile devices that I use for this exact reason.
- bryanmgreen 4y ago
  Same! It was such an aggravation
- saagarjha 4y ago
  Google will send you codes to devices that don’t even have the app installed. Ask me how I know.
  - alpentmil 4y ago
    use AndOTP with QR code from fdroid. Go to account settings in desktop browser and remove the phone as 2FA. It will not ask any code to device.
    - saagarjha 4y ago
      Google somehow seems to think I own this device despite it not being one of the devices on my account.
  - Wowfunhappy 4y ago
    Wait, what? How does that work?
    - saagarjha 4y ago
      It doesn't :P
TimC123456 4y ago
> Google has, in some cases, started requiring auth codes sent to specific devices, even if you're already using your own configured TOTP 2FA This exact situation has been such a thorn in my side at my company lately. Does anyone know any way to disable this behavior, even just with Google Workspace accounts?
wereallterrrist 4y ago
I've still yet to see a single bit of proof of this outside of claims from people who couldn't bother to do the things you're supposed to do when setting up 2FA. I remain skeptical. All these claims and not a single screenshot of this scenario. Meanwhile I've been in 4 countries in 8 weeks and Google hasn't bothered me once beyond the normal "tap my yubikey on my keychain".

jrmg 4y ago

> work laptop, my home laptop, and my phone There’s a fire or gas explosion or earthquake or something, and you need to leave all those behind. What do you do? > Oh, everyone else is just hoping they never lose their phone? Really? I would be very, very surprised if that’s not what the vast majority of the population is doing. Many people have a phone as their _only_ computing device, and no printer, and don’t really understand why they should be carrying around scrawled codes in their wallet.

jrochkind1 4y ago
> What do you do? I get screwed! I guess the right answer is that I have the backup codes carefully preserved.... off site! In case of natural disaster. Every time I sign up for a new account, I print out the backup codes, and take them to an off-site secure storage location, which of course i have... somewhere. There's no way 90%+ of internet users are doing that. I'm not even going to pretend I have any chance of doing that.
- jrmg 4y ago
  Ah, I see we both have a more similar view than I thought! I really should be storing some codes for my password manager somewhere…
  - dotnet00 4y ago
    Although not as safe as a printout, I keep codes encrypted on a couple of flash drives, one stays in a drawer and one that's always on my person with my keys, yubikey etc. Haven't needed the codes thus far but feels like a decent compromise.
    - Wowfunhappy 4y ago
      Note that flash drives typically use the absolute cheapest NAND cells available and I'm not sure what their shelf life would be...

powerapple 4y ago

I recently switched my laptop and my phone together, even though I have the same number, I cannot recover my account. SMS is better because even if you lose your phone, you can get a replacement sim card. Only if SMS is enough. In the case of Google accounts, no, it is not enough.

newscracker 4y ago

Considering that Authy relies on an SMS OTP for the account creation (and possibly account recovery), I prefer to use something else that provides the benefits of cloud syncing across devices and isn’t tied to a phone number. I understand that SMS OTP is simple for most people to handle (encouraged by many platforms over the years), but I just cannot get past that barrier to choose Authy over something else for personal use.

jrochkind1 4y ago
I'm literally only using it for things that require it. (including heroku, and rubygems). My thinking is: how do I meet this requirement with the least likelyhood of later locking myself out forever, and having HN threads blaming and shaming me for not carefully preserving my backup codes in a firesafe crypt? If someone wants me enough to target Authy with an SMS reroute attack focused on me, they're gonna get me either way. I'm not Ed Snowden here, I'm just a guy trying not to lose his car keys. But, what's the thing you use that provides the benefits of cloud syncing across devices and isn’t tied to a phone number? For anyone that might be interested, including me if it seems as easy and as idiot-proof. (and free or cheap).

neurostimulant 4y ago

Most password managers has 2FA TOTP support these days so your OTP will be available on all devices that has your password manager installed.

tiborsaas 4y ago

Password managers usually have a comment field where you can store the backup codes.

pieter_mj 4y ago

Also, it's kinda like Google corrupted 2FA TOTP's workflow : it should work on any device that implements the right algorithm and secret key. Instead Google sometimes turns it into MFA tied to a specific mobile device. When that happens, Google asks to confirm with a known mobile device even though I have specifically configured 2FA TOTP since 2012 to be device independent (and I currently use keepassxc or mobile equivalent to generate the totp value). Google subsequently doesn't allow login by any other method and if the required device is lost or broken you lose access.