3 ms·
Many years ago, I lost my phone with Google Authenticator (which doesn't have a backup option like Authy does) and got locked out from AWS. The next day there w
by melvinmelih 4y ago
Many years ago, I lost my phone with Google Authenticator (which doesn't have a backup option like Authy does) and got locked out from AWS. The next day there was a production issue with our website. Long story short, our website was down for more than 2 weeks while I was trying to regain access to our AWS account. #2faneveragain
- lexapro 4y agoYour website was down for more than 2 weeks not because 2FA is badly designed, but because you bet everything on your phone not getting lost or damaged. And now you refuse to secure your accounts.
- melvinmelih 4y ago> And now you refuse to secure your accounts. No, the big lesson for me is to have proper backups of credentials (like the other commenter mentioned) and ensuring multiple people have access to the prod environment. Don't just turn on 2FA without having these things in place.
- Spunkie 4y agoActually in this case it's likely AWS is also responsible for having trash 2fa restrictions. AWS will only allow you to setup one single 2fa method. If you register with a yubikey, you can't register a 2nd yubikey as backup, nor can you register an authenticatior(TOTP) as a backup.
- bityard 4y agoI feel like the lesson there isn't 2FA == bad, but rather it's important to have backups of your most important data and credentials, including TOTP seeds.
- MilaM 4y agoWhat is also very frustrating with AWS is that you can only set up one 2FA method. You have to choose between TOTP OR security key and can't have both at the same time. I wanted to add a yubikey to my account a couple of weeks ago, but had to switch back to TOTP. A lost Yubikey means you're looked out, TOTP secrets can be backed up at least.