19 ms·

Tell HN: It is impossible to disable Google 2FA using backup codes

• przeor 4y ago
  I do recommend toget 2fas.com asap and export your codes to iCloud/G Drive. If you lose the phone its easier to recover.
  • gravitronic 4y ago
    Yeah, apparently that 2FA handshake is crucial with some providers. I was not expecting this, I thought careful management of my 2FA backup codes would suffice!
  • Brajeshwar 4y ago
    I would also suggest https://authy.com https://authy.com It has apps for phones/tablet and desktop.
• gravitronic 4y ago
  Side-comment: is there a type of shadowban with HN where my posts do not make it into the frontpage, even 2 or 3 or more pages deep? I've seen this with a few of my posts recently where they appear in the 'new' and 'show' or 'ask' tabs, but not the frontpage.. even 300 posts deep while similarly aged and upvoted posts are on second page. edit: now it's on the frontpage! Guess it just had to hit a vote threshold.
  • darepublic 4y ago
    I clicked into this off the front page.
    • gravitronic 4y ago
      Just updated my comment, I guess there's some other criteria or age to hit before it gets ranked.
  • TheFreim 4y ago
    I believe that text posts are ranked lower than links.
  • dredmorbius 4y ago
    Among other weighting factors, HN-as-customer-support-of-last-resort posts have recently started being downweighted. See: <https://news.ycombinator.com/item?id=34444459 https://news.ycombinator.com/item?id=34444459>
• torstenvl 4y ago
  I hate current popular implementations 2FA and similar IT fads for this exact reason. They are inherently insecure, and any security professional who pushes them without serious thought through all the failure modes should be blacklisted from the industry.
  • Spivak 4y ago
    Competently administering 2FA essentially requires human intervention to handle the "I lost all my credentials" case because it will happen with probability 1 eventually. Workplaces can do this because you can call IT and have an already established identity based in the real world.
    • torstenvl 4y ago
      100%. I've never had any issues with IRL 2FA. If I lose or damage my CAC card I can go to the ID card office with a different photo ID and get a new one with new certificates and set a new PIN. My old certificates will be revoked. But that's not what's currently popular. What's currently popular is just to check a box with some poorly thought-out system and screw anyone who ever loses their phone number or 2FA device. That's dangerous and unprofessional.
    • jandrese 4y ago
      The problem with this is that we are talking about pseudo-anonymous signup for websites. They can't go back and verify the credentials you used to create the account because you didn't provide any. But if this is the case then the help desk is a major security vulnerability, since just anybody can claim to be you and take over your account. The help desk has little to no way to actually verify your identity. At the very least if the helpdesk does reset your account, there should be a 48 hour lockout and a message sent to the account allowing the owner to dispute the change. Yes it is inconvenient in cases where the actual owner lost all of their login credentials, but this is hopefully rare.
  • jeroenhd 4y ago
    This isn't a security flaw, this is incompetency. Google not allowing disabling or altering 2FA after resorting to a backup code is simply bad design. They could've done the same with any method of authentication. Using a password isn't even enough for Google any more these days, look at Gmail+IMAP. This is pure incompetency, not a flaw in 2FA. Whatever device this person is on has been flagged insecure enough to need repeated re-authentication of the highest level, locking them in a loop until the recovery mechanisms are exhausted. Competent support would also have helped. Google doesn't do support for almost all of its customers but in a normal company, a support agent would've been able to help restore the account. Sure, Twitter has shown us that such support can also be a major risk to important or famous people, but that's why Google has a special program you can enable that will lock down security even more.
• ReptileMan 4y ago
  And that is why I utilize the "very secure" flow of also keep the original qr codes ... in a keepass vault, but still. Most of the security is theater. On the other hand I think that every tech savvy person should at least try to keep the TOTP seeds.
  • gravitronic 4y ago
    Good idea! That had never occurred to me before this incident.
    • ClassyJacket 4y ago
      You have to take a photo of the screen on another phone, Google disallows you from screenshotting them.
      • msdrigg 4y ago
        Just use a different 3rd party authenticator app
    • yieldcrv 4y ago
      Really? At what point do we blame the victim because this is so obvious to me. I keep the TOTP and only sometimes keep the backup codes I avoid the issue created from losing my phone, because the next device can generate codes immediately by importing or scanning the TOTP I also don’t call it “2 factor” I just call it “one time passcode”
      • happytoexplain 4y ago
        Nothing is "obvious" in tech any more, because there is simply too much. Two "tech savvy" people will often each have things they think is "obvious" that the other isn't familiar with. And this isn't even a good example of something that is "obvious" to some people, because Google makes it very, very clear that saving the QR code is NOT a backup option. It is labeled only as a mechanism to transfer to a new phone, so one has no reason to believe that it's non-ethereal. Further, the app disallows taking a screenshot. You have to point a camera at your phone. It's mind-blowing to suggest that it might be appropriate to blame the user for not doing this.
• gravitronic 4y ago
  It would be useful if people went to their Google Account page, clicked the Security tab, then tried to access the Two Factor Auth page and reported back what options they had to authenticate. Do you have options other than "enter a two factor auth code"? Can you authenticate on that page with SMS or a backup code?
  • proactivesvcs 4y ago
    Using the Google app on my Android phone (stock, unrooted, GPlay enabled), the Security, 2FA link launches a WebView screen. It has my username prefilled. When I click Next, I'm given a failure page saying "This browser or app may not be secure". The Web View app is up to date, version 108.
    • gravitronic 4y ago
      Wow, that's.. even worse than my experience. It would probably work if you used the official browser, it's not a bad idea for the website to block webviews. But pretty funny that their app uses a webview which the service then blocks.
• rhacker 4y ago
  > What am I supposed to do in this situation? This. Support systems in the world post computers eating everything is basically HN posts.
  • TheSpiceIsLife 4y ago
    When I had a self-inflicted issue with my non-Google email service I context support and has the issue resolved within a couple hours.
    • gravitronic 4y ago
      How does one contact support? Every path I've tried leads to a support community forum. I haven't tried posting there yet as I assumed it was a black hole. Are you saying that that works?
      • tcoff91 4y ago
        He said non-google. There is no decent support from google.
  • epicureanideal 4y ago
    Maybe the next million new jobs is just rebuilding a reasonable level of customer support at all tech companies, funded by modest usage fees. $5/mo, $50/yr, or $500 for lifetime guaranteed permanent access so no lockouts are possible, I would definitely pay for Gmail or an equivalent service. And there are people who I’m sure would pay much more. Another short term option: $500-1000 right now to get a couple hours of support to unlock an account.
    • TaylorAlexander 4y ago
      High fees mean that most people even in places like the USA cannot afford it. Would be nice to have modest customer service options for everyone.
      • 4y ago
• sneak 4y ago
  TOTP is bad 2FA. Google supports U2F security keys. Use them.
  • gravitronic 4y ago
    If you lose your U2F security key, are you sure you'll be able to remove it from your Google account? Because what I'm experiencing right now is that they support TOTP and you can't remove it if you lose it..
    • dheera 4y ago
      Yes, I lost a key 6 months ago and removed it from my Google account. I have multiple other U2F keys also registered.
      • azinman2 4y ago
        Having those extra registered I think is the missing bit. The OP could have also registered additional 2FA methods, but didn’t thinking backup codes were as advertised.
    • Groxx 4y ago
      Specifically you need multiple registered keys, to prevent this current situation. But yeah, this is why I dislike 2FA. There are clear security benefits, but it comes with the extreme downside of "what you know is not sufficient". When it's e.g. a corporate-controlled account and your IT desk can just reset it to "password123!" to let you back in, it's quite a good trade-off. When it's your main email, i.e. your primary online identity, losing access is kinda a big deal, and Google has famously bad support.
      • sureglymop 4y ago
        I used to do this but it was a hassle to set up. I can't imagine a normal person (less interested in tech) to use this.
      • browningstreet 4y ago
• andrewmcwatters 4y ago
  Oh my god. 2-Step verification on your Google Account is actually less secure than not using it at all. I just posted about something similar maybe 3 months ago?[1] > I kid you not. Google's actual official answer to this is... create another account![1][2][3] > Edit: Now that I have your attention: > PSA: Go create "Backup codes" for your Google Account in your 2-Step Verification settings. > [1]: https://support.google.com/accounts/troubleshooter/2402620?hl=en#ts=2402626%2C2402728 https://support.google.com/accounts/troubleshooter/2402620?h... > [2]: https://support.google.com/accounts/answer/7682439 https://support.google.com/accounts/answer/7682439 > [3]: https://support.google.com/accounts/answer/7299973 https://support.google.com/accounts/answer/7299973 [1]: https://news.ycombinator.com/item?id=33692942 https://news.ycombinator.com/item?id=33692942
  • gravitronic 4y ago
    I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.
    • ironmagma 4y ago
      Time to repeal 2FA. I can't believe it's required for SOC2 type 2 compliance.
      • sureglymop 4y ago
        2FA is okay. But the practice of backup code sucks. Instead, save the TOTP hash and make extra sure to back it up. Then you can just reconfigure your 2FA app.
      • jay-barronville 4y ago
        2FA/MFA isn’t the problem. Google is just a pain to deal with when their products don’t work as expected. On one hand, security-wise, it’s good that they tend to design their algorithms to err on the side of being restrictive, but on the other hand, they have no legit support, so if you or their algorithms mess up and you’re locked out of your account, you’re basically on your own. For a company so many of us rely on so deeply, that’s awful!
• random2021 4y ago
  I just tested this. You should not disable 2FA. - Just click on the Authenticator app - Change Authenticator app - https://ibb.co/dPCMpdN https://ibb.co/dPCMpdN Just works.
  • gravitronic 4y ago
    Hey, thank you so much for trying to help me. On what page do you see the Authenticator app listed? I suspect it's on the "Two Factor Auth" page. My problem is that I cannot even load that page. I click on "Security" in the menu, and it's when I click on "Two factor auth" to do any 2fa-related task, that's when I'm forced to log in and provide a 2fa code (which I do not have)
    • random2021 4y ago
      go to https://myaccount.google.com/security?hl=en https://myaccount.google.com/security?hl=en Then, https://myaccount.google.com/signinoptions/two-step-verification https://myaccount.google.com/signinoptions/two-step-verifica... There you can see Authenticator app. (I am doing this on desktop. Not sure about phone)
      • gravitronic 4y ago
        Thanks for the followup. I'm also on desktop. When I click the second link, I'm forced to reauthenticate. During that reauthentication my only option for 2-factor auth is... a valid 2FA code. Backup codes are not allowed. I suspect since you originally logged in with a 2FA code (I'm guessing), your session is marked as "recently two factor verified", and when I logged in with a backup code, I was not marked the same level of "secure".
        • random2021 4y ago
          since you told me I am using a I tried without 2FA code but with backup-code > When I click the second link, I'm forced to reauthenticate. Here, I am being asked my password. Then get that page.
• treeman79 4y ago
  Then there is Facebook which won’t let you use your email or phone if hacker changes those. Your email was changed 20 minutes ago? Clearly the one you used for 15 years isn’t trustworthy anymore. Zero way to talk to a human about it.
• jchw 4y ago
  Try enrolling another 2FA method while you're in there.
  • gravitronic 4y ago
    I cannot access the Two Factor authentication page at all - it is when attempting to access that page that I'm forced to log in again and provide a 2FA code.
    • jchw 4y ago
      Weird, this used to work... I guess they changed it at some point.
      • jeffbee 4y ago
        It's a mistake to believe that every user will uniformly see the same things on the same pages. Google's account abuse system will offer different options to different users based on how suspicious their behavior appears to be.
        • jchw 4y ago
          Which abuse system? I worked there and I wasn't aware of myaccount changing behavior based on how "suspicious" the session is. In fact, I didn't know sessions had such an attribute, assuming this is true. Granted, I didn't work on the account dashboard, but still. I'd assume it's more likely the behavior really is changing, specifically because in the past, the user's login session was treated as a valid factor alongside the user's password for disabling 2FA, which was criticized as being less secure than expected. However, I'm not sure they intended for the fix to that to not allow backup codes...
      • jandrese 4y ago
        You might be surprised just how subtly corporations will break accounts that they are suspicious of. There is a whole world of anti-bot measures that come across to humans as just slightly odd behavior or weird bugs. It can be weirdly capricious as well. For example, I recently was having trouble logging into a website and was having to do a ton of SMS re-authentications. When logging into the website using Chrome I was given SMS messages with a 15 minute timeout. When logging in with Firefox the same SMS verification message only had a 5 minute timeout. Several times I would go through the authentication flow and then the service would seem to just crash, loading only a blank page, but I'm pretty sure that was just an anti-bot measure kicking in. I eventually only got it to work normally by switching over to my Phone's hotspot. The website was just hating on my IP address for no disclosed reason.
• bikeformind 4y ago
  To avoid a situation like this, I keep backup screenshots of the 2FA QR codes stored off-line on an encrypted USB drive.
  • bantunes 4y ago
    You can also just store the data encoded in them - it's usually just a string.
  • qzw 4y ago
    No need for screenshots even, right click and Save Image almost always works. I save them all and encrypt them in a separate archive with a different password. No, your probably shouldn’t save them to your password vault (unless you know what you’re doing).
    • sureglymop 4y ago
      You can also save the TOTP hash instead of the QR code (which basically just contains that hash)
  • laurent123456 4y ago
    Or just use Aegis - you can export all your codes as an encrypted backup.
    • ses1984 4y ago
      What’s that?
      • nszceta 4y ago
        It's an Android app. Its easier to manage OTP codes inside your password manager. Do everything with KeepassXC and KeepassDX. How to sync a file between computers and your phone is left as an exercise to the reader. However I recommend using Syncthing.
  • aceazzameen 4y ago
• nicoburns 4y ago
  This is why I use SMS as my second factor for my Google account. Much harder to lose. It could be vulnerable to sim swapping attacks, but I consider Google locking me out of my own account a more likely threat (and frankly I'm probably not a high-profile enough target for anyone to bother with that, and in any case they'd still need my password).
  • loriverkutya 4y ago
    Instead of SMS, get a pair of yubikey recommended by some other posters, so you are not depending on your mobile provider as they own the number and it is just "rented" to you.
    • arduinomancer 4y ago
      How does that work? Do you have to carry around a Yubikey/Dongle everywhere with your phone?
      • ufmace 4y ago
        Personally, I don't, since I've never wanted to log into my Google account on a device I encountered while out of the house. I'm not really sure why you'd ever do that IMO.
      • vel0city 4y ago
        For my phone, I'm already logged in and never get any future challenges. I needed the Yubikey when I first logged into my phone, but after that the phone has been authenticated. If I unlink my phone to my Google account I'll need the Yubikey again, but I don't normally do that. So normally I don't carry a Yubikey with me, like when I go to the store and what not. That said, I do keep a Yubikey with me in my bag when I travel in case my phone breaks and I need to authenticate into a new device. I do take a Yubikey with me going to and from the office as there are other services and platforms which do challenge my Yubikey more often.
      • ok_dad 4y ago
        I keep one on my keychain in my pocket and one at home in a fireproof box, plus a backup one that I haven't even opened next to the backup so if I lose the keychain one I have another ready to go as my "new backup".
• Ravikukadiya 4y ago
  [flagged]
• Ravikukadiya 4y ago
  [flagged]
• TacticalCoder 4y ago
  I've got a fully airgapped Raspberry Pi, an old version (one without WiFi capability), which has a copy of all my "Google Authenticator", TOTP style, secrets. I made a little terminal app (so no need for a mouse / no need to boot into a GUI), with my secrets protected by a password. I use that in addition to Google Authenticator on my phone. And in addition to paper backups of the secrets (I don't print the QR code: I write the secret down, like 16 letters) which I keep in a safe. I've also set someone as the person of trust should I not access my email for 6 months. And I set up webauthn as well. It's a pain but I don't want to have to deal with an account I lost access too.
• purpleblue 4y ago
  I lost a bunch of email addresses because they decided to start enforcing the use of security answers even when I had the correct password. Then I lost some more email accounts because I logged in from different locations (I moved) and they thought I was a fraud, even though I was able to confirm using the backup email address. I'm fairly concerned that eventually I'm going to lose all my email addresses due to these increasingly draconian requirements that are sprung upon us.
  • RulerOf 4y ago
    >due to these increasingly draconian requirements that are sprung upon us. I'm all for improving authentication, but it's profoundly annoying when authentication requirements are not made clear before logging in. For a user with a password manager, forcing a user to answer "security questions" will compromise UX at best, and reduce overall security at worst.
• deleted 4y ago
  [deleted]
• omarhaneef 4y ago
  Microsoft Authenticator syncs across all instances so you just have to log in to a new Authenticator on the new phone and the codes are there. (I think it uses OneDrive). I am sure that is less secure than a local only copy but this may be least bad of all alternatives. You might even give a trusted person a login and have it on their phone so you can use theirs in an emergency.
  • Nextgrid 4y ago
    How do you login to the authenticator itself? If it's MS-account-based doesn't that itself requires 2FA and you thus have a chicken & egg problem?
    • ranger_danger 4y ago
      It doesn't need a login... only the syncing part uses your account.
• TurkishPoptart 4y ago
  Same thing happened to me. The backup paper 2FA codes I kept failed when my Pixel phone spontaneously bricked itself.
• Waterluvian 4y ago
  “How’s our 2FA working out?” “Fantastic. We haven’t heard from anyone with a complaint!”
• bastardoperator 4y ago
  Get off Google so you dont have to deal with zero customer service: https://github.com/tycrek/degoogle https://github.com/tycrek/degoogle
  • gravitronic 4y ago
    I use fastmail almost entirely, this is a historical account. My wife just happened to share something to my Google docs leading me to log into this mess today
• melvinmelih 4y ago
  Many years ago, I lost my phone with Google Authenticator (which doesn't have a backup option like Authy does) and got locked out from AWS. The next day there was a production issue with our website. Long story short, our website was down for more than 2 weeks while I was trying to regain access to our AWS account. #2faneveragain
  • lexapro 4y ago
    Your website was down for more than 2 weeks not because 2FA is badly designed, but because you bet everything on your phone not getting lost or damaged. And now you refuse to secure your accounts.
    • melvinmelih 4y ago
      > And now you refuse to secure your accounts. No, the big lesson for me is to have proper backups of credentials (like the other commenter mentioned) and ensuring multiple people have access to the prod environment. Don't just turn on 2FA without having these things in place.
    • Spunkie 4y ago
      Actually in this case it's likely AWS is also responsible for having trash 2fa restrictions. AWS will only allow you to setup one single 2fa method. If you register with a yubikey, you can't register a 2nd yubikey as backup, nor can you register an authenticatior(TOTP) as a backup.
  • bityard 4y ago
    I feel like the lesson there isn't 2FA == bad, but rather it's important to have backups of your most important data and credentials, including TOTP seeds.
  • MilaM 4y ago
    What is also very frustrating with AWS is that you can only set up one 2FA method. You have to choose between TOTP OR security key and can't have both at the same time. I wanted to add a yubikey to my account a couple of weeks ago, but had to switch back to TOTP. A lost Yubikey means you're looked out, TOTP secrets can be backed up at least.
• NgooIGGERgle 4y ago
  [dead]
• erremerre 4y ago
  I completely believe you. I got in a similar situation in 2020. In that case it was a change of password of the main account that went wrong. How? Don't know, I have a password manager that captured the password I inputted and it was exactly as it should inputted. But when I put it in google it told me that it was incorrect. When I commented to people, everyone told me that they could change their password doing this and that, but... I wasn't. Looks like there are different security levels based on arbitrary rules and what an user could do, I was unable to do it. I only had the account logged in in my phone, and every day I kept restoring the account, every day to be unsuccesfully. One day, after 5 weeks from the day it happened, doing exactly the same than the previous days, one of the recovery attemps worked out, and was able to reset my password. It completely put me off using google services, but God, it is hard to abandon your first mail services, I got way too many things hooked up with them.
• gr4yb34rd 4y ago
  just be happy you didn't get caught up in the g+ debacle. i did exactly what they told me to do to keep from using a real name across their services and they fucked me 10 ways to sunday for doing so. brand account worked great up until ~2013, then they changed something and my settings are all greyed out. can't update phone numbers, can't view mature content, etc. all i can do is collect adsense while the account lasts.
• arriu 4y ago
  Whenever one of these threads about Google (or Apple) come up, I am shocked at the lack of response from people working at those companies. It seems reasonable that this site would be where you'd find someone from a team that interacted with logic that OP is having trouble with. I'd expect to see something like a "hey, yeah, I know a guy on our team that might be able to get in touch with the team who maintains this. I've sent them this thread"... I'm hoping OP got a private message.
  • gravitronic 4y ago
    Nothing yet, but I just added an email in profile if any helpful googlers are able to assist
  • halkony 4y ago
    Developers at large corporations are strictly informed that they are not the public face of the company and can't do that. These aren't mom and pop developer shops.
    • arriu 4y ago
      I agree to some extent but large companies do staff roles that have public outreach as part of their job description. Suggesting that no one is able to say "there is an internal ticket for this" is not the full answer.
      • phendrenad2 4y ago
        Really? I've never seen anyone at Google or Apple who's in a "staff role with public outreach as part of their job". I don't think any big tech companies have those.
        • arriu 4y ago
          They do, and Google does. Job descriptions are usually something like: "As a Technical Evangelist, you will be the face of the platform and often the first contact our customers have with us, both online and in person." https://en.wikipedia.org/wiki/Technology_evangelist https://en.wikipedia.org/wiki/Technology_evangelist
• renonce 4y ago
  Maybe too late to give you any helpful advice, but setting up Advanced Protection may make sense. You need to buy at least two (preferably three) YubiKeys and the password plus any of these keys allow you to login to your account. Nothing more, nothing less. Costs a few bucks, but at least the auth flow is very clear. Another thing you can do is to wait for a week and see if anything changes. Having the session last for more than a week may give you more options in passing the challenge.
  • dfdz 4y ago
    Best advice in this thread: https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/
    • fullstop 4y ago
      Keep in mind that this can make signing into some devices tricky. On devices which do not support webauthn (nintendo switch) it will prompt you to acknowledge the code sent to another device which does support webauthn. You can't authenticate some Roku channels as well, such as PhotoView for Google Photos.
      • tonymet 4y ago
        also many Google TVs do not support it
  • oftenwrong 4y ago
    One downside of Advanced Protection for Android users that intend on linking the account to their device is that you will not be able to install apps from "aftermarket" app stores, like F-Droid. You can still install apps with `adb install`, though.
  • kobalsky 4y ago
    I did this but I'm concerned about the recovery process. Google says at https://landing.google.com/advancedprotection/faq https://landing.google.com/advancedprotection/faq that: >>> If you lose your key and are still signed in on one of your devices, visit account.google.com to add or replace a key. Otherwise, submit a request to recover your account. Google may take a few days to verify it’s you and restore your access. I've assumed the risk of temporarily losing access to my account if I happen to lose all my hardware keys and devices for some reason while they confirm my identity, but from these posts I think that Google may not be of help at all and I could permanently lose access. I'm starting to wonder if I shouldn't go back to regular 2FA since I can safely backup those codes.
• rndmize 4y ago
  I was recently trying to log into Slack on a new computer. It required a login and password, and then emailed a 2FA code to my login email. Then it _also_ wanted 2FA code from my mobile app, which it seems wasn't configured correctly on my new phone. The experience left me with multiple questions - what needed to be transferred from my 2FA app on my old phone to my new phone that didn't make it? Why wasn't the email code good enough (as that is literally already two factors?) I've largely stuck with strong passwords for most of my accounts because of issues like these, and others I saw first hand - such as when my dad used to have a password db on a palm pilot. He had no backups, some point the device fails, everything was lost. I only felt comfortable moving to a password db once dropbox became a thing as a result - the balance of security vs. usability is pretty shit if there's a single point of failure with no recovery possible, and I'm not inclined to set up some backup process manually (dropbox has reliably been something I haven't had to think about for a decade.) 2FA feels a lot like that to me, except now with multiple points of failure that can be difficult to recover. Backup codes feel half-baked; it strikes me as the kind of thing that was tacked on to help the issues around hardware failure/human error that one _should expect and design for_; instead, we put the onus on the user with "your account may be unrecoverable" warnings as an excuse. A better system, IMO, would have N factors and require one less. Keepass is the place where this has bothered me for some time - I can configure things so my db requires a password, and a file, and a Yubikey - but why can't I have two of three? Hell, why can't I have _one_ of two? If I'm in a car crash and die and I want one particular person to cleanup some aspects of my virtual life, it'd be nice if I could give them a key file and let them know there's a Yubikey in a safe deposit box. I feel secure, as no one has all three tokens but me and two are always needed; but I also feel the system is durable, in case something is forgotten, crushed, lost, etc. I dunno, maybe there's people or companies that already do stuff like this and I just don't know about it.
  • MetaWhirledPeas 4y ago
    My fear (disclaimer: I'm a bit ignorant on the topic) is that system breaches will become more common, maybe with the help of AI. Maybe AI will help with social engineering. Maybe it will help with malware proliferation. Regardless, when I hear of groups like LastPass getting breached I'm suddenly much less keen on 1FA. Besides, some services no longer offer 1FA at all. Google seems to require 2FA of some sort no matter what (although maybe that's just my settings?). So it becomes more important to at least weed out the "bad" 2FA like SMS or security questions. I've heard warnings about Google Authenticator before, something about the inability to make backups or something?
• reaperducer 4y ago
  I had a similar situation with Facebook. Set up 2FA with an app called Duo-somethingorother. Broke my phone. Trying to use Facebook with new phone requires 2FA. Duo-somethingorother app on the new phone won't authorize my Facebook login because the app on the new phone isn't linked to my Facebook account. Result: I'm locked out of Facebook Every year or so I follow Facebook's login authentication steps, including sending photos of my government-issued ID, but nothing happens. Facebook support? What's that? At this point, all I want to log in to Facebook for is to download the photos from my account. But I'm not in Europe, so I have no rights to my photos and nowhere to complain. You get what you pay for.
  • Nextgrid 4y ago
    > I'm not in Europe, so I have no rights to my photos and nowhere to complain. If it makes you feel any better, Facebook doesn't care about the law and Europeans don't have any more luck than you do when it comes to this: https://ruben.verborgh.org/facebook/ https://ruben.verborgh.org/facebook/
    • reaperducer 4y ago
      An interesting read. Too bad the author made himself look like a kook in his correspondence, and thus ignoreable by Facebook. I'd like to see an actual lawyer try it and document the effort with similar rigor. I wonder what the response from FB would be.
      • Nextgrid 4y ago
        Considering the GDPR doesn’t really give you the right to sue by yourself and that the best you can hope is for the regulator to fight for your case, I’m not sure the profession of the data subject would matter. Keep in mind that the regulator who’s supposed to regulate them is corrupt and complicit so it’s very unlikely anything would work.
• tppiotrowski 4y ago
  I lost access to my Coinbase account a while back because I was using Authenticator on the iPhone and when I bought a new phone and set it up, my Authenticator codes did not transfer with the rest of my data. At that point I stopped using Authenticator. I hope that's still not an issue upgrading iPhones today.
  • fl0id 4y ago
    This is by design with the app. There are other authenticator apps like authy that save/sync 2FA.
  • RulerOf 4y ago
    I use OTP Auth[1] and enable its iCloud sync function to guard against this specific scenario. 1: https://cooperrs.de/otpauth.html https://cooperrs.de/otpauth.html
• babyshake 4y ago
  Is the only viable solution to have 2FA setup on multiple devices, with at least device in a "break glass in emergency" type of vault storage?
  • bxparks 4y ago
    Yup. I keep a cheap backup Android phone with Google Authenticator installed just for this purpose. Every time I add a 2FA code, I add it to the backup phone. I also print out the QR code, but a backup phone is far more convenient. I dropped my main phone into the toilet a week ago, completely fried it. Moved the SIM card to my backup phone, and carried on like almost nothing happened. I then powered up my 10-year old Nexus 7 tablet, and duplicated all my 2FA codes to the tablet. When I get a new replacement phone, I will duplicate my 2FA codes again.
  • Nextgrid 4y ago
    This is extremely inconvenient as it means if you're signing up for an account you need to have access to all those devices, even the one that's supposed to be in vault storage (potentially a bank vault, etc). TOTP just isn't a good protocol for this. Last-resort 2FA should be based on public key crypto where your last-resort device has a public/private key and you can enroll it as a recovery token by providing the (static) public key - this means you do not need active access to the device to enroll it.
• jneal 4y ago
  I had this same issue just a few weeks ago. I recall being asked for my 2FA on a few separate occasions and could never disable it or switch to a new authenticator app even though I had backup codes. However, I tried it a 3rd time one day and for whatever reason I was able to do it. If I recall correctly, it suddenly gave me the option to instead authenticate with my password again, which I did. Good luck!
  • NavinF 4y ago
    Makes sense. They delay 2fa changes on new devices so people don't get their accounts stolen permanently when they lose their backup codes.
• bunnyswipecom 4y ago
  Proton mail for the win
• cameldrv 4y ago
  I've found in these situations that the most effective way to solve the problem is to contact a Google employee that you know personally. If you can do this, they can fill out a form where they vouch for you, and you can get the account unlocked.
• joshAg 4y ago
  Hey, so this is admittedly monday morning quarterbacking, but in the future, you can definitely consider moving from Google Auth to Twillio's authy [1]. It lets you move devices and all your secrets come with you (it's also got other cool features, but the one that is killer IMO is the ability to migrate from device to device). https://authy.com/ https://authy.com/
  • adamors 4y ago
    I can’t recommend Authy enough. It’s multi device from the start and has cloud backup. I once broke my phone with Google Authenticator on it and I spent 2 days locked out from my work accounts. Never risking that again.
    • joshAg 4y ago
      One important note, though, is that the backup and multidevice requires their cloud servers* so the threat model is a little different. They've got a blog on how they do the cloud backup**, but since you need a password it either needs to be something you can remember or be stored in a password vault that doesn't rely on getting a 2fa code from authy for access. * for the paranoid, there's a mode where it doesn't backup to the cloud, which makes it function the same as google auth, but that does defeat a lot of authy's benefits. ** https://authy.com/blog/how-the-authy-two-factor-backups-work/ https://authy.com/blog/how-the-authy-two-factor-backups-work...
• jakedata 4y ago
  Do you have access to an Android device (or the gmail app on IOS)? If you can sign that device into your Google account with one backup code you may be able to get Google login prompts without explicitly authorizing that feature in the blocked account settings page. I know when I have set up crappy tablets with my credentials they automatically started showing prompts to approve logins from other devices. If nothing else it may save you from running out of backup codes.
• dec0dedab0de 4y ago
  There are going to be way too many people affected by this within the next few years as warranties expire and it's not worth repairing phones. There is no way they won't come up with a better solution as they see engagement drop across all of their properties. That said, this is probably a business oppurtunity for reverse engineering and recovering the 2fa code from broken phones. I suspect there is a key stored locally, and tied to the device id. If you could get a setup together for reliably extracting/cloning that info, people locked out of essential services would be willing to pay.
• jiximus 4y ago
  It’s always good to have a Yubikey
• boomer918 4y ago
  Thank you for posting and reminding us that multiple 2FA methods are a good backup plan with Google. I just added: - SMS - Authenticator app (Authy, of course) - Generated backup codes That in addition to my Pixel 4, and maybe 3-4 authorized devices (laptop, ubuntu desktop, windows desktop), I feel a bit better about this. Sorry for your trouble though, I hope you figure it out.
• nogridbag 4y ago
  Related: I recently bought some Yubikey Security Keys (U2F/FIDO2/WebAuthn only) and decided to update all websites I use with those keys. The problem is virtually no website supports them. I think out of the hundreds of accounts I have only Google, Cloudflare, and 1Password support them. But also the UX is a bit of a disaster: https://blog.silverorange.com/web-authn-ux https://blog.silverorange.com/web-authn-ux I had an old set of YubiKeys which I used as a MFA option for LastPass. In comparison to WebAuthn, the process is dead simple. Input master password and LastPass prompts to touch yubikey. Dead simple with no scary dialogs. I have not seen any website offer an integration with Yubikeys like that. Is that only possible because LastPass was a Chrome extension? Or is it simply lack of demand?
  • Nextgrid 4y ago
    The problem with these 2FA systems is that they require access to the 2FA device during enrollment which makes it very inconvenient/impossible to maintain a backup device in off-site secure storage as you'd need access to it every time you create a new account. There needs to be a new 2FA standard which only needs the public key of the authentication instrument during enrollment - that way the actual instrument doesn't need to be accessed when creating new accounts and can be kept in secure storage, only accessed in an actual disaster situation.
• arikr 4y ago
  Google's 2FA is an absolute embarrassment. Super annoying that Google hasn't yet done more to improve it. See also: https://news.ycombinator.com/item?id=33895836 https://news.ycombinator.com/item?id=33895836
  • Eric_WVGG 4y ago
    I gave a big long speech on security to my company, mentioned that SMS 2FA was junk and to use authentication apps instead, then made 2FA mandatory on our Google accounts… only to find out that you can’t even enable good authentication without enabling SMS 2FA first. Absolute madness.
    • ranger_danger 4y ago
      Actually there is a way, but instead of enabling SMS you have to enable U2F first, then it will allow you to turn on TOTP. If you don't have a U2F-capable device then you can use a program like softu2f that emulates one on your computer, even if it's just temporary in order to get TOTP turned on.
      • Eric_WVGG 4y ago
        Good to know, but wow, that's wretched.
• danuker 4y ago
  My advice is only actionable for others, not OP. You should have backups on places other than the phone. I warmly recommend andOTP for managing your TOTPs. It's open source and available on F-Droid. https://f-droid.org/en/packages/org.shadowice.flocke.andotp/ https://f-droid.org/en/packages/org.shadowice.flocke.andotp/
  • doodlesdev 4y ago
    Even better would be Aegis which does backups for you, and (at least in my opinion) has the best UI for an aithenticator app. Also available on FDroid. https://getaegis.app/ https://getaegis.app/
• danwee 4y ago
  If there is anything worse than having no 2FA, is to have 2FA with Google. Like, if something is messed up the only way (if any) to recover access to your account is by asking here on HN.
• renewiltord 4y ago
  Interesting. I have to 2FA to get into my account but when I go to modify 2FA I only need my password. Thank god I keep 2FA in Bitwarden. I did not realize I'm this close to losing my Gmail. Jesus.
• hot_gril 4y ago
  Add this to the list of reasons I don't fk with Google Authenticator. It used to be hard to even get the backup codes, or maybe it still is, idk.
• gooeykabuki 4y ago
  Which non google 2FA app would folks recommend?
  • timbit42 4y ago
    I hear Aegis is good. It allows backups.
• cypherpunks01 4y ago
  Any possible way to upgrade to a paid account, personal or business, that would grant access to the proper level of support to fix this? I realize it's paying the people holding the account hostage, just thinking of practical solutions to get in touch with the right support level who could assist.
• throwaway4759 4y ago
  Don’t trust any apps to handle backup and syncing TOTP keys for you. Gliches happen. I encrypt and back up all TOTP secret key, which are used to generate six digit codes, to my local offline password store (usb key and paper). In fact, I mostly used my laptop as the second factor because it is more convenient. My phone also has the TOTP key and in case it is lost, I can just regenerate the QR code.
• anonuser123456 4y ago
  Always backup your 2FA. I keep a cold yubikey in a locked cabinet at work as well as my TOTP secret, encrypted and printed.
• antisthenes 4y ago
  The person who successfully convinced people that 2FA is actually more security is the biggest scumbag in history. The lost productivity dealing with shitty 2FA implementations and the subsequent shitty customer support is enough to build all 7 wonders of the world many times over.
• skizm 4y ago
  If you also have SMS codes enabled, in addition to the authenticator app, will the SMS codes with if you lose access to your authenticator app?
• deleted 4y ago
  [deleted]
• hairofadog 4y ago
  I'm trying to push adoption of 1Password in my workplace, and one of the things that drives me crazy about Google's sign-in process is that they obfuscate the 2FA functionality behind two confusingly-named links. First they present 2FA via the Google Mobile app, and you have to click "Try another way", which makes it feel like something has already gone wrong. Then they give you the option to the Google App again, to get an SMS message, to use a backup code, or to use "Google Authenticator". So my instructions to a would-be 1Password user are: Sign in with your email address and password, click "Try another way", and then click "Use Google Authenticator", but don't actually use Google Authenticator; use 1Password.
• gghffguhvc 4y ago
  Every Google Authenticator entry I have I duplicate onto a second device that I keep in a safe. My fear of losing my phone has decreased quite a bit when I started doing this. To export your codes, click top right ... and then "Export Accounts".
• casenmgreen 4y ago
  I had much the same problem with AWS. Their 2FA login was not working - my logins were rejected. I think I needed to resync. The resync pages were not working. When 2FA breaks, for whatever reason, there is a form you use to let AWS know. You cannot send a message - only a phone number. AWS will call you back. Where I was at the time, a phone number was not available. That was it. End of the road. 2FA not working, could not log in, the Support I could reach could not help. Support suggested "make new account", as of course they do what they can, which means offering options from within their power, and there was nothing they could do (except suggest a new account). Fortunately, I had no servers running. I don't know what would have happened, if I had. With email based accounts, the email used to make the account is the email used to recover the password, so making an account also proves the recovery mechanism. With 2FA, this is not the case. 2FA is absolutely necessary for security, but flawed implementations are I would say much more of a risk than the security issues 2FA defends against. I am very unlikely to be hacked - I am one in a billion - but if the 2FA mechanism is flawed, it is reasonably likely to affect me. Large companies are totally unaware of end user experiences, so when for example 2FA recovery is broken, they have no idea this is occurring. It is dangerous for end-users to rely on large companies to implement systems which can block end-user access to critical systems.
  • ranger_danger 4y ago
    > I am very unlikely to be hacked More likely to be framed for someone else's crime (maybe someone uses your AWS account to hack others), because, well, who would miss casenmgreen, right? There are non-obvious reasons people should still use 2FA even if they have "nothing to hide".
• keyme 4y ago
  Another reason to root your phone first thing before you use it for anything. Was in a similar situation, having a real backup of every apps data (including the "secret" data) saved me a couple of times.
• Ikatza 4y ago
  This is exactly my current situation, exacerbated by the fact that I cannot contact support as I am a user of legacy Gsuite. To get support I would need to upgrade. To upgrade I need to enter my authenticator code. To enter my authenticator code I need to contact support...
• littledemoguy 4y ago
  Google 2FA is a security feature that requires you to enter a code to access your account. It is a second layer of security to your account.
  • popcalc 4y ago
    ChatGPT?
• nikanj 4y ago
  What you are supposed to do in this situation? Post on HN / Reddit
• getoffmyyawn 4y ago
  When I was 16 I locked the keys in my parents old car when I drove it so many times that my father, having grown tired of coming to my rescue, put a spare key on a dog tag chain and told me to wear it around my neck. I continued locking the keys in the car when I would drive it, but it was never a problem again. Now I keep a key chain with a yubikey on it that serves as a redundant option for 2fa to authenticate my google account, in addition to the app in my phone. I actually have two of them and the other is in a secure remote location. If you are doing anything critical in your google services you must have multiple 2fa options for disaster recovery.
• darkhelmet 4y ago
  Tip: You can bulk export your google authenticator app secrets for a disaster recovery like this. I had not seen this functionality before but I'm glad it existed when setting up a new phone yesterday. I remember the old high friction way of having to deregister and reregister for each account. Howto: ... menu in top right -> export accounts make sure all are selected, select export It will generate a series of dense QR codes. Screenshot / photograph / add to backup phone, save and print for your document safe, whatever. Of course, this doesn't help if you're already in a loss situation. But recovery this way is SO much easier than typing in a backup code. Recovery is as quick as having the app scan each of the QR codes in sequence. For me it was just 3 dense QR codes. I was a little surprised that it was this easy to extract all the secrets. I'm going to have to think even more carefully about what TOTP secrets go in there now.
• cf512 4y ago
  Github sure does seem to have the best 2FA, methods, recovery options, etc. All super straightforward and reliable. Has anyone experienced otherwise with Github? I wish all platforms modeled their 2FA to be like Github's.
• aborsy 4y ago
  It’s worth mentioning that, although Google Authenticator allows one to export two factor authentication codes, it’s only in the format of a QR code that can be scanned by another phone. It doesn’t provide the option of exporting 2FA codes in an encrypted file that one could store in a safe place. So it seems that the backup is intended that the user purchases a second phone!
• fitblipper 4y ago
  This is horribly frustrating and I'm sorry you are facing this. The thing I have taken away from these continual Tell HN posts about Google acounts getting locked up because of 2FA is that the "something you have" factor needs redundancy. I now have my phone, and 4 yubikeys on my household's carkeys and a trusted friends and a family member's firesafe. These have also given me enough stress that when I visited home for the holidays I added to my aging parents' Google accounts with a handful of additional security keys to go with their SMS 2FA. Personally I would rather have accounts which are secure and can be lost if I am not careful with my 2nd factors than one that has vulnerabilities that the whole internet can attempt to exploit, but I realize others do not have that same priority.
• trinsic2 4y ago
  I use Authy with a second backup phone. You can install Authy on two or more devices so you can recover from situations like this. After the backup phone is setup. I turn off the ability to add more devices in the settings.
• gbraad 4y ago
  Google's 2FA is terrible for Google workspace when you add a phone number. In that case, you are up to the whim of the country to allow your SMS to be received (serious consideration in some parts of the world). When a phone is added, you will not be able to use a device for 2fa, but always defaults to SMS!
  • ranger_danger 4y ago
    Are you sure you didn't overlook the "try another way" button?
• cookiengineer 4y ago
  The problem I had while my company phone got remote wiped: Google Authenticator uses a protobuf based export qr code, which any other 2FA app doesn't support. I wrote a small cli tool that can export all data inside it, and that tries to generate qrcode images for each entry for re-import into another 2fa app. I hope this can help someone with the same problem, I got stuck with a camera photo of this seemingly useless qrcode for a couple hours until I built my tool. Always remember to backup google authenticator, and always make a physical backup of your encrypted passwords database! [1] https://github.com/cookiengineer/qrcode-extractor https://github.com/cookiengineer/qrcode-extractor
• cookiengineer 4y ago
  OP: Do you still have adb running on the phone? If yes, then you might be able to backup google authenticator's data using adb. Alternatively maybe a tool like scrcpy [1] might be able to help when the screen is broken. [1] https://github.com/Genymobile/scrcpy https://github.com/Genymobile/scrcpy
• spicymaki 4y ago
  Here is an anecdote. I had my iPhone replaced last year due to a battery issue and I forgot to migrate my authenticator codes to the new phone (I did not realize they did not restore if you changed phones). I was able to log in via a known authenticated web browser and reset my 2FA TOTP. I am a little hazy on if it used my mobile gmail app as a second factor though (with content restored from backup). I did not need my backup code. Perhaps it would be good to get an additional hardware security key for the account just in case.
• spicymaki 4y ago
  I think that as a regular consumer there is not enough training on how to manage secrets. There is a lack of transparency about the implications of enabling/ignoring security settings. I should not have to be a certified security expert to manage my account properly. The deeper issue is the situation is kafkaesque. Imagine explaining to a stereotypical elderly grandparent (with minimal computer experience) that you need to configure a 2FA TOTP on your mobile phone and save backup codes in a secure location. BTW don’t lose your phone or you will need to initiate a complex recovery procedure. Oh BTW you need to memorize a 20 character length passphrase along with the 30 other websites you use. Perhaps you could use a password manager, but it will need a 20 character length password and 2FA TOTP as well. Oh make sure you certify the password hashing function and iteration count follows current NIST-800 guidelines. It will need to reauthenticate periodically so don’t forget your password manager’s passphrase. Be sure to make it a sentence and sprinkle in a number and punctuation mark or two. Oh Back to your original account: It might prompt you to log with a previously known authenticated mobile app at random. There is also a random AI agent scoring how secure your device is and can cancel you at anytime. Oh BTW if you want have extra protection buy this $30 hardware key we don’t advertise. Actually buy two hardware keys and keep one offsite just in case. Don’t use that key use this one. We might drop the other key for unknown reasons. The key might be exploitable since it has Bluetooth so keep it shielded in a faraday cage at all times. The security policy can change at anytime with no warning or requirements notification update. Do not contact customer service, because you are not a customer but a product being sold at data mining auction. Instead you will need to plead your case on Twitter, Reddit, or Hacker News and pray someone working at the company sees it and is willing to help.
• lucasgonze 4y ago
  This seems like a bug, not a feature. Personally I have Authenticator for day to day use, a Yubikey for restoring access if something happens to my phone, and backup codes.
• beej71 4y ago
  At the recommendation of some of those here, and with the help of a webcam to capture my Authenticator QR code, I successfully moved everything over to Aegis. I set up a strong password, stored in my password vault. Aegis lets you do biometric login. Took a screenshot of Authenticator's export QR code via the webcam, then added it with Aegis. Then went to Aegis's Settings->Backup and exported a JSON backup, which is encrypted with the password. That's a bit more peace of mind.