8 ms·

I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes

I have 2FA backup codes! They let me log into my account! But using only backup codes, I cannot remove the lost 2FA. So now I have 8 consumable backup codes and after that I will not be able to access the account. To remove the lost 2FA, I need a fresh 2FA code. No alternatives given.

ironmagma 4y ago
Time to repeal 2FA. I can't believe it's required for SOC2 type 2 compliance.
- sureglymop 4y ago
  2FA is okay. But the practice of backup code sucks. Instead, save the TOTP hash and make extra sure to back it up. Then you can just reconfigure your 2FA app.
- jay-barronville 4y ago
  2FA/MFA isn’t the problem. Google is just a pain to deal with when their products don’t work as expected. On one hand, security-wise, it’s good that they tend to design their algorithms to err on the side of being restrictive, but on the other hand, they have no legit support, so if you or their algorithms mess up and you’re locked out of your account, you’re basically on your own. For a company so many of us rely on so deeply, that’s awful!
  - ironmagma 4y ago
    Nobody should be forced into this terrible scheme if even Google can’t get it working. It’s a case of “this idea isn’t bad, people just implement it wrong”. If nobody can implement it right, it’s not right. Complexity kills.
  - MetaWhirledPeas 4y ago
    The alternative is picking a smaller company that might be an easier hacking target or might go out of business when you're not paying attention. I have a Protonmail account but I do wonder how long they'll be around.
- jandrese 4y ago
  This really isn't a problem with 2FA. It is a problem with Google not understanding the reason for backup codes. It's just plain old bad design on Google's part.
eigenvalue 4y ago
The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).
- TacticalCoder 4y ago
  And for authenticators that do not allow to export the secret, while your authenticator is not lost yet, add another authenticator: and during registration, save the QR code.
  - deleted 4y ago
    [deleted]
  - tpmx 4y ago
    There is no option to add another authenticator app at https://myaccount.google.com/security https://myaccount.google.com/security (desktop UI). I think the only feasible option is to first remove Google Authenticator and then re-enable it. Seriously, Google? Might be micro, but this is not a sign of a healthy company on an upwards trajectory.
    - tpmx 4y ago
      It's time to de-google. Seriously. Now it's from a self-preservation POV, not a political POV.
- j1elo 4y ago
  The QR that you mention, is just an encoding of an actual string key (edit: I'm reading now that it's called seed). If possible, it is better to get the string directly, instead of its QR encoded counterpart. This is needed for example to store the TOTP in a device that has no camera. Or in your Bitwarden Pro account. Obviously you wouldn't be able to scan a QR with such an application, so the actual string is needed you just copy-paste it, so it should be provided by any service that offers 2FA (I confirmed Google does)
TacticalCoder 4y ago
Can't you add a security key like a Yubikey? Do they let you do that without requiring your Google Authenticator / TOTP secret? What about adding someone who can get access to your email after six months of inactivity? Maybe they let you add that without your lost google authenticator? It'd be better than nothing.
pja 4y ago
Time for a Google Takeout while you still have access to the account then!
jeroenhd 4y ago
I remember Google not letting me log in with my TOTP code when it insisted on me clicking a prompt I hadn't received. Only after two timeouts did it add the option to use a TOTP code. If I recall correctly, I had to let the thing fail and then click "let me try another way" or something similar. This leads me to believe that maybe Google hides certain options by default. However, I also think that Google keeps track of a "security rating" for your session; when I don't log in for a while, Google asks me for my password but when I use that same session token on another physical address I also need to authenticate with 2FA. This may imply that failed login attempts may flag your session as even worse than before. I have no idea if this is actually how it works or if this is purely coincidental, but it may be worth keeping in mind given that you have limited backup codes available to you. My recommendation would be to first get a Google Takeout backup stored somewhere safe, then see if you can get another 2FA method that you have control over connected to your account.
- freedomben 4y ago
  Yep it absolutely ratchets up "suspicion" on your account, and failed attempts will quickly get your account in some sort of state where you're locked out. It's absolutely maddening.
  - gravitronic 4y ago
    Definitely - and I think now that I've gone to that 2FA page and let it time out (since I only have backup codes), I think it's racheted up suspicion higher as these login attempts count as "an attacker has the password but not the 2FA code!"
    - freedomben 4y ago
      Definitely. I did that a few weeks ago and got an email from Google to my gmail saying something along the lines of "somebody has your password and is trying to log in!" even though it was just me on a different computer and after submitting password I realized I didn't have my phone on me so couldn't submit the 2FA. It was even a computer on the same LAN (with same WAN IP), so not like I had an active session in the US while the attempt came from Moscow...
pgalvin 4y ago
If you login on your phone, it’s possible your phone will automatically become a “second factor” if on Android, or if you have Google apps installed on iOS. This would resolve the problem, but I can’t promise it’ll work. Note: I mean in mobile apps, not browsers.
princevegeta89 4y ago
Thank you for this. I will make extra backups of my 2fa seeds. I currently have all of them in my bitwarden vault which won't probably ever fail me but it's better to be extra safe

ironmagma 4y ago

Time to repeal 2FA. I can't believe it's required for SOC2 type 2 compliance.

sureglymop 4y ago
2FA is okay. But the practice of backup code sucks. Instead, save the TOTP hash and make extra sure to back it up. Then you can just reconfigure your 2FA app.
jay-barronville 4y ago
2FA/MFA isn’t the problem. Google is just a pain to deal with when their products don’t work as expected. On one hand, security-wise, it’s good that they tend to design their algorithms to err on the side of being restrictive, but on the other hand, they have no legit support, so if you or their algorithms mess up and you’re locked out of your account, you’re basically on your own. For a company so many of us rely on so deeply, that’s awful!
- ironmagma 4y ago
  Nobody should be forced into this terrible scheme if even Google can’t get it working. It’s a case of “this idea isn’t bad, people just implement it wrong”. If nobody can implement it right, it’s not right. Complexity kills.
- MetaWhirledPeas 4y ago
  The alternative is picking a smaller company that might be an easier hacking target or might go out of business when you're not paying attention. I have a Protonmail account but I do wonder how long they'll be around.
jandrese 4y ago
This really isn't a problem with 2FA. It is a problem with Google not understanding the reason for backup codes. It's just plain old bad design on Google's part.

eigenvalue 4y ago

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

TacticalCoder 4y ago
And for authenticators that do not allow to export the secret, while your authenticator is not lost yet, add another authenticator: and during registration, save the QR code.
- deleted 4y ago
  [deleted]
- tpmx 4y ago
  There is no option to add another authenticator app at https://myaccount.google.com/security https://myaccount.google.com/security (desktop UI). I think the only feasible option is to first remove Google Authenticator and then re-enable it. Seriously, Google? Might be micro, but this is not a sign of a healthy company on an upwards trajectory.
  - tpmx 4y ago
    It's time to de-google. Seriously. Now it's from a self-preservation POV, not a political POV.
j1elo 4y ago
The QR that you mention, is just an encoding of an actual string key (edit: I'm reading now that it's called seed). If possible, it is better to get the string directly, instead of its QR encoded counterpart. This is needed for example to store the TOTP in a device that has no camera. Or in your Bitwarden Pro account. Obviously you wouldn't be able to scan a QR with such an application, so the actual string is needed you just copy-paste it, so it should be provided by any service that offers 2FA (I confirmed Google does)

TacticalCoder 4y ago

Can't you add a security key like a Yubikey? Do they let you do that without requiring your Google Authenticator / TOTP secret? What about adding someone who can get access to your email after six months of inactivity? Maybe they let you add that without your lost google authenticator? It'd be better than nothing.

pja 4y ago

Time for a Google Takeout while you still have access to the account then!

jeroenhd 4y ago

I remember Google not letting me log in with my TOTP code when it insisted on me clicking a prompt I hadn't received. Only after two timeouts did it add the option to use a TOTP code. If I recall correctly, I had to let the thing fail and then click "let me try another way" or something similar. This leads me to believe that maybe Google hides certain options by default. However, I also think that Google keeps track of a "security rating" for your session; when I don't log in for a while, Google asks me for my password but when I use that same session token on another physical address I also need to authenticate with 2FA. This may imply that failed login attempts may flag your session as even worse than before. I have no idea if this is actually how it works or if this is purely coincidental, but it may be worth keeping in mind given that you have limited backup codes available to you. My recommendation would be to first get a Google Takeout backup stored somewhere safe, then see if you can get another 2FA method that you have control over connected to your account.

freedomben 4y ago
Yep it absolutely ratchets up "suspicion" on your account, and failed attempts will quickly get your account in some sort of state where you're locked out. It's absolutely maddening.
- gravitronic 4y ago
  Definitely - and I think now that I've gone to that 2FA page and let it time out (since I only have backup codes), I think it's racheted up suspicion higher as these login attempts count as "an attacker has the password but not the 2FA code!"
  - freedomben 4y ago
    Definitely. I did that a few weeks ago and got an email from Google to my gmail saying something along the lines of "somebody has your password and is trying to log in!" even though it was just me on a different computer and after submitting password I realized I didn't have my phone on me so couldn't submit the 2FA. It was even a computer on the same LAN (with same WAN IP), so not like I had an active session in the US while the attempt came from Moscow...

pgalvin 4y ago

If you login on your phone, it’s possible your phone will automatically become a “second factor” if on Android, or if you have Google apps installed on iOS. This would resolve the problem, but I can’t promise it’ll work. Note: I mean in mobile apps, not browsers.

princevegeta89 4y ago

Thank you for this. I will make extra backups of my 2fa seeds. I currently have all of them in my bitwarden vault which won't probably ever fail me but it's better to be extra safe