8 ms·

Ask HN: How do you start over with 2FA after losing your phone?

78 points by jononomo 4y ago

I left my iPhone in a cab in Costa Rica by mistake. I may as well have thrown it into a volcano. I have 2FA set up on three dozen different and important online accounts, and it's all through the Google Authenticator app on that iPhone. Is there a recommended way to go about this problem? Or have I locked myself out of my entire life?

sposeray 4y ago
[dead]
moviuro 4y ago
As specified when activating MFA, did you download (and print) your backup codes? If so, use them to re-enroll a new device into MFA. If not, you can try reaching out to customer service after you get a new SIM card. For banking and everything else IRL, you can just walk up to the teller with your ID.
capableweb 4y ago
Use your backup codes that you've downloaded and safe-kept somewhere (you did this right?). If not, I'm afraid you're out of luck. There are two possible outcomes from contacting support for a service, asking to regain control over a 2FA-protected account, both which sucks, but on different levels. 1. You write them, proving who you are, and they tell you to get lost unless you have the 2FA proper codes, or backup codes. This sucks because you still didn't get access. 2. You write them, proving who you are, and they give you access to your account, so you can reset 2FA. This sucks because this means the service is not secure and you/others can be "hacked" because customer support can be exploited.
- huhtenberg 4y ago
  > Use your backup codes that you've downloaded and safe-kept somewhere ... or re-initialize 2FAs from their original seeds, which are typically hidden under a "set up manually" option during the enrollment process.
- bluGill 4y ago
  This is why phone based 2fa is not secure and not recommended. Sure it is easy, but it isn't secure in important ways
  - capableweb 4y ago
    What? Where the 2FA codes come from isn't relevant, as long as the device (laptop, phone, desktop, hardware) is protected in some way or another (like password). Backup codes come from the service which is 2FA protected anyways, not from the 2FA authenticator itself. Edit: oh, reading your message again, are you referring to SMS-based 2FA? I assumed TOTP 2FA in this submission. If you mean SMS-based 2FA, then yeah I agree, makes your account less secure than not having 2FA at all.
    - rat9988 4y ago
      I'm pretty sure he talks about totp too.
    - bluGill 4y ago
      Nobody has a secure password on their phone, so your requirement fails. There is no way to get a secure password on a phone as one of the requirements of a phone is quick access, and no fast password is secure. (maybe finger prints, but I have found them unreliable and so I quit using them) If your phone based code system is also available on other accounts, and you can access those other accounts without the phone then maybe. However many people only have a phone, and no other computer (or at least not a computer they use often enough that we can trust the 2fa isn't expired). The 2fa I've seen mostly has a SMS based fallback, and thus is no more secure than SMS.
      - capableweb 4y ago
        > Nobody has a secure password on their phone, so your requirement fails. Well, you could if you want to. That you don't want to, is a failure on your part, not on "everyone"'s part, since most phones do offer you the feature of setting a sufficiently secure password. > However many people only have a phone, and no other computer (or at least not a computer they use often enough that we can trust the 2fa isn't expired). You don't need a second device in order to backup your codes. By leveraging "cryptographic splitting" you can divide a secret into N parts and share them with friends and family, and if you need to regain access, ask them each for their part back and then you can recover from there. Now I guess that's kind of advanced so most people won't/can't do that, but it is possible at least. You could try something like https://iancoleman.io/shamir/ https://iancoleman.io/shamir/ if you're curious about the process, I've done this myself for some things. Easier solution is to create a encrypted archive with your backups, and upload to various cloud services. As long as the encryption scheme is secure, you'll be safe. > The 2fa I've seen mostly has a SMS based fallback, and thus is no more secure than SMS. I'm using TOTP 2FA for 100% of every service I use and that offers it. I think only one requires SMS-based fallback, the rest are optional so obviously I'm not using that.
- dhdhhdd 4y ago
  I so wish u2f/yubikey was supported on all websites :-(
  - Zetobal 4y ago
    I use the yubikey authenticator app for the ones that don't. The secrets are saved on the key and you can password protect it... and as with all keys back it up to your spare.
    - latchkey 4y ago
      When you're traveling to Costa Rica, where do you keep your spare? Do you stay locked out until you get home? What if you're a nomad and you don't have a 'home'?
      - Zetobal 4y ago
        One of my spares is usually with my spouse (it's still password protect) and if both get lost I kinda deserve to be logged out until I get home.
- jononomo 4y ago
  I have backup codes saved in 1Password for maybe 10% of the online accounts with which I use 2FA + Google Authenticator. I'm concerned about the online accounts for which I don't have backup codes.
- theonething 4y ago
  I have Google Authenticator and Authy running on both my iPhone and my iPad (which always stays at home) Is this a bad way to do backup?
thecopy 4y ago
This is what the recovery/backup codes are for. Unless you have saved them somewhere i would assume you have lost access unless each service has a support path for you
nigamanth 4y ago
This same thing happened to me with Discord once, I just wrote to them and filed a complaint saying my account got "hacked" and that the hacker changed the 2fa mobile number. With adequate proof and justification I think you should be able to get back your accounts, that is if your service does allow you to get back your account. One tip is to have multiple phones for 2fa and then just not using the other phone, if you don't use it how can you lose it? (that's what I did since I lost it once).
- dncornholio 4y ago
  Why did you decide to lie in your complaint?
  - TrueGeek 4y ago
    Yeah, this is disturbing. He's admitting he used social engineering to get back into his own locked account and he's happy that it worked. Assuming he did this over email / web the "proof" he sent them was probably a photo of driver's license which really doesn't prove ownership of identity when your account was just hacked. We really need a third party service that allows you to walk up, have some DNA taken, verify you are who you say you are, and then unlock accounts in these cases. We can have the government do it, they have all our DNA anyway!
    - philwelch 4y ago
      This isn’t secure against evil twins.
    - huhneverthot 4y ago
      Pretty much every single one of these threads is about half full of people demanding more, larger foot-guns with which to shoot themselves because they just can't be bothered (just assure you'll hear when they're eventually locked out, etc).
guluarte 4y ago
Using an auth app that supports encryted cloud backups, like bitwarden, ms auth, etc
- guluarte 4y ago
  If the site supports FIDO2 I use my yubikey.
josteink 4y ago
When you enable 2FA you are on pretty much every service asked to download recovery-codes, and save them somewhere safe. Did you do that, and if not, why not? Also: Didn't you backup the 2FA codes somewhere else where you can "sync" them in? I use Bitwarden Authenticator for 2FA (part of Bitwarden Pro) and it syncs my 2FA codes to all devices where I log on to Bitwarden. That way I avoid a single point of failure. Consider that the next time around :) As a meta-comment on this thread itself... That even people here on HN can enable and make use of 2FA incorrectly is the reason it will never be a viable way to protect accounts for "everyone and their grandmother". It's too complex, and we need something better.
- bluGill 4y ago
  Where do you download those codes that is safe and secure? Everything I can think of, I can also think of a counter that means that mode is likely to fail. I'm a professional in the computer industry, so i'm more aware of possible failure modes than most people, but I also am aware of safe storage modes that most people don't have. The recovery codes as implemented are not useful backups for most people. Telling people to use them is the wrong answer. Sadly I know the above, but I don't have a better solution. It is a hard problem.
rhn_mk1 4y ago
The solid way to do it is to have a backup, like another second factor enrolled and stored in a safe place. Or to have recovery codes. Without those options, now that you lost the only second factor, you have to reach out and convince the service providers that you're you. Good luck.
dpz 4y ago
Unfortunately not unless you have recovery codes. You can prevent this for the future by pretend you can read the QR codes and getting the secret string allowing you to set up across multiple devices. Your best best would be contacting support for individual accounts and hoping you have enough historical information to be approved access.
lifely 4y ago
I've never trusted a single device for two factor authentification, My solution, trust in 1Password and it's encryption, I have access to my 2fa anywhere I need but it a computer, phone, tablette. Soon it will be passkeys and they'll be safe in the 1Password vault, no worrying about losing the device w/ the keys again.
- tashbarg 4y ago
  So ... your solution is no tfa? Putting second factor material in password managers is terrible advice. For reasons unknown to me, it might be the right solution for you. But in general, it defeats the two factor authentication purpose if you reduce the factors again to knowledge alone. The whole point of tfa is, that the second factor is something you possess and not something you know (which is the first factor).
  - ydant 4y ago
    There are multiple attack vectors that 2-factor helps with, and storing your 2-factor alongside your password does still help in some, just not all. For the more common attacks I expect to encounter, namely a single password being leaked, a password manager is still based on something I "possess" (to an extent) - the decrypted password vault. It's separate from the single password that's likely to have been compromised in the most common scenario. Of course, if my whole vault is compromised, then yes, storing my 2-factor in there made my life worse than the alternative. I just don't see that as anywhere near as likely a scenario as an individual account being compromised. Having 2-factor enabled in a less secure method is still better than not having 2-factor enabled at all. Basically, there's nuance to this, it's not the extreme you present - a more in-depth comment on this: https://security.stackexchange.com/questions/150448/is-it-secure-to-store-a-two-factor-authentication-seed-in-a-password-manager https://security.stackexchange.com/questions/150448/is-it-se...
  - wordyskeleton 4y ago
    You're assuming a compromised password == compromised 1Password vault which is clearly not going to be the case most of the time
rodolfosilva 4y ago
I think you have iPhone backup on icloud. If you get your phone number back, you can unlock your life again.
Lambdanaut 4y ago
This is crazy haha. I literally just left my phone in a cab(tuktuk) in Costa Rica a couple weeks ago. It was in my hand one second and then I got out and it wasn't. I've had to contact each organization I have 2fa with and get 2fa reset through personal identification measures. For my company that meant a quick zoom call. For banking that meant driver's license scans and photos of me. You'll have to work with your 2fa providers.
jodrellblank 4y ago
> "Is there a recommended way to go about this problem?" Restore the backup of your phone which you have locally in iTunes, or in iCloud. (And, before you lose it, take a backup)
huijzer 4y ago
When setting up 2FA, the services typically give a list of recovery codes which you hopefully still have. With those, you can gain access and link other 2FA devices. If you have the recovery codes and got access again, then you can get a bit more redundancy in your system by also setting up security keys such as a Yubikey. These keys can be added next to your authenticator app(s).
lordnacho 4y ago
You can back up your 2FA codes to another phone, at least Google Authenticator lets you do this. An old phone is the easiest, most convenient way to do this since it has a camera that you can use to scan the code on your main phone. If you don't have the backup codes or the one-time codes, you're going to have a problem and you'll need to contact the services to somehow let you in or take off 2FA. Depending on what the service is, it might get very tedious.
- Aldipower 4y ago
  BTW this process is broken with small display. I have a very tiny Android phone and to backup the codes I need to scan an QR code on this small display, which isn't working out. The resolution is too small. And there is no other way to backup Google Authenticator I am aware of. So be careful in smaller display, you probably cannot backup Goggle Authenticator.
  - dpz 4y ago
    There is on a rooted android phone with an adb shell sqlite3 /data/data/com.google.android.apps.authenticator2/databases/database \ 'select email,secret from accounts' not aware of any other way on none rooted/ios
  - sn0wleppard 4y ago
    You may have tried this already, but the QR code gets bigger the more entries you export - have you tried selecting them one at a time?
    - Aldipower 4y ago
      Ah, did not knew that, just check it out. Thanks for the hint. Uh, if I select only one entry the QR code gets smaller in itself. So basically same problem still. facepalm :-D
      - matthews2 4y ago
        > if I select only one entry the QR code gets smaller in itself Does it block you from taking a screenshot? Maybe you could screenshot it and then zoom in the gallery app.
ecesena 4y ago
If you have a backup, try to restore it on your new iphone. In the vast Google Authenticator didn’t restore, but I read it may now? FWIW, this is the reason I use Authy, it works nicely with backup/restore. Beware that Authy has a cloud backup/multi device function that I personally keep off. Another option would be 1password, though I’d personally won’t mix passwords and 2fa codes in the same app. Assuming the worst case where you can’t recover the codes, and assuming it course you never stored the offline codes, you have to go through the process of recovering 2fa. This usually requires submitting documents that prove who you are, and waiting 1-2 weeks. So the only recommendation is to begin this process asap. And while you re-setup 2fa make sure you either keep a backup or use an app that works when you backup+restore your phone, Im sure others will provide more options. Good luck!
- peacemaker 4y ago
  +1 for Authy, though I keep the backups and multi-device turned on for convenience. My old phone died and I had no way of getting into some of my 2FA secured accounts a while back and it was a wakeup call that eventually led to using Authy.
  - kawsper 4y ago
    Our org is using a mix of Google Authenticator and Authy, but I am currently trialing https://2fas.com/ https://2fas.com/ which is an opensource application that work with iOS backups.
TedDoesntTalk 4y ago
I know it doesn’t help now, but next time use Authy instead of Google Authenticator. It can sync to multiple devices. I have it synced to my laptop so if I lose my phone, I still have Authy on my laptop with all 2FA.
- e-clinton 4y ago
  Microsoft Authenticator also provides the same.
  - nashashmi 4y ago
    It does not do this on desktop
deleted 4y ago
[deleted]
owurkan 4y ago
Hopefully you have recovery codes for all these accounts. With that said, I don't like to rely on these recovery codes bc of some horror stories. Alternatively when setting up 2FA, you can for example: - use Authy bc it syncs tokens in the cloud and so you can recover your 2FA tokens on a new phone based on your phone nbr. I used to do that but have stopped bc Twilio (owner of Authy) is slowly retiring the product. - Keep a copy of each token when you set up 2FA. I keep an encrypted disk image with a list of my 2FA tokens. Yes, it weakens a little bit the security. But I sleep well bc I won't lock myself out in case of trouble. It's a trade-off I embrace.
can16358p 4y ago
Happens all the time when I get a new phone because for some reason Auhenticator (MS) never transfers the authentication codes while setting up new iPhone (just why?). Providing any services that I don't have backup codes with identity documents solve the problem. Never had issue with any service but it's annoying.
jgalt212 4y ago
Can't you get the seed values out of Google's Authenticator (which is TOTP?)? I would put these somewhere safe--rather than save a bunch of backup codes.
hmate9 4y ago
If you’re reading this and don’t have backup codes for Google auth stored somewhere offline then this is your wake-up call to do it now.
jefftk 4y ago
Not a solution for the OP, but to anyone else reading: do not set up 2FA with a single point of failure. If you lost any one thing, would you be locked out like the OP? If you have to use TOTP codes be religious about saving your backup codes. Otherwise, using multiple security keys means you can recover from losing one, with the bonus of phishing protection (since they can't be tricked into supplying your codes to the wrong domain).
mikece 4y ago
Backups: you MUST have a backup! One thing I do is avoid proprietary apps like Google Authenticator and make sure I store the TOTP key separately so I can reconstitute my TOTP codes in another app if necessary. Backups are kept on a backup handset, on my computer, and in an encrypted volume in the cloud at a minimum. What's a little harder to deal with are the services/providers that insist on SMS 2FA (and not to a VoIP number).
- tzs 4y ago
  > One thing I do is avoid proprietary apps like Google Authenticator and make sure I store the TOTP key separately so I can reconstitute my TOTP codes in another app if necessary I'm not sure what avoiding Google Authenticator has to do with that. You can store the keys separately for any TOTP app. That's kind of inherent in the way TOTP works.
tinus_hn 4y ago
For the services that don’t allow their keys to be included in the backup this is a common occurrence and they will probably have a support system that will allow you to reset the authentication. Which makes 2fa worthless theatre but that’s reality.
djha-skin 4y ago
I use KeepassXC password manager[1], it keeps my TOTP information and makes it available to use on all my devices. It syncs between my devices using Dropbox. Kepassium[2] makes it available on iOS, and Keepass2Android[3] makes it available on Android. It also manages my SSH keys and adds them to the ssh-agent, even on Windows. It houses a backup of my GPG keys. I even found that it can manage my credentials for use in scripts and git using git-credential-keepassxc[4]. Similar functionality can be had from 1Password[5], if you're into the more fancy experience. As a bonus this approach makes it very easy to store all those backup codes that totp services often give you. Won't help your current predicament but will prevent it from happening again :) 1: https://keepassxc.org/ https://keepassxc.org/ 2: https://keepassium.com/ https://keepassium.com/ 3: https://github.com/PhilippC/keepass2android https://github.com/PhilippC/keepass2android 4: https://github.com/Frederick888/git-credential-keepassxc https://github.com/Frederick888/git-credential-keepassxc 5: https://1password.com/ https://1password.com/
- ahofmann 4y ago
  This is the way. The KeepassXC File is under your control, and you're able to make as many copies, as are necessary. 2fa is the right thing, but having the TOTP Codes on only a single device will get you in bad situations.
jqpabc123 4y ago
Always, always create a backup. Or three. I carry a backup with me strapped to my wrist. It is a cheap digital watch with a strap modified to securely hold a microSD card with all my really important, must have data ---encrypted with Bitlocker. This data is as safe as I am. I leave a copy of this card in a fireproof safe at home. A trusted family member has the combination. A friend has the Bitlocker decrypt key. My will brings these two people together to obtain access to the data in case of my demise. Twice a month, I swap the two cards and update the one I will carry with only the changed info using a xcopy batch script. My Android phone also has my 2FA keys using FreeOTP+ with an access code and backup capability. I keep the backup from FreeOTP+ on the memory cards along with a little Windows CLI utility of my own making that can read this backup and generate 2FA codes as needed. I'm fairly confident I won't ever be totally locked out of my accounts. If you are locked out without a backup, your only realistic option is to contact each service provider and follow their instructions.
- jareklupinski 4y ago
  thanks for the details! I do something simmilar with three flash drives, but wondering if it's overkill curious, how long have your microsd cards been working for, and have you experienced any bit-rot / bad blocks yet?
  - jqpabc123 4y ago
    I have had minimal issues with SD cards but I always buy name brand --- and I have 2 copies just in case. Plus, the working data is also stored on my in-house network. The first thing I do with any new memory card is reformat it. Many (if not most) cheapo, off brand, Chinese cards won't even format properly. Either the stated capacity is being faked outright or the card was a factory reject with bad blocks that shouldn't have been sold. Do not buy --- end of story. In any case, my xcopy update script will totally rebuild the backup from network source if I decide to replace one of the cards with a new empty one. I replace at the first sign of trouble but this has only occurred every few years.
- TurkishPoptart 4y ago
  can you share the strap design to hold the microSD? how do you decrypt it when accessing it? very cool!
Tade0 4y ago
Funny you should ask - a while ago I had the screen and battery replaced in my phone, so I did a factory wipe. Little did I know, backing up the Google Authenticator app doesn't preserve the config, so all my codes were gone. Apparently most services don't mind and will let you disable MFA via email confirmation. One notable and unlikely exception was OVH - luckily I had backup codes, so I didn't have to present them my id.
Saris 4y ago
Unfortunately google authenticator is a bit user-hostile and doesn't offer backups, Aegis is a nicer alternative that does, I would recommend using that or something similar as you set things back up.
ethicalsmacker 4y ago
This is a complex problem. I considered this for many hours. How does one securely restore their secure measures once their devices are lost? Assume you lost your phone, laptop is also gone and your house burned down and your papers are gone with it. I personally symmetrically encrypt my ssh keys and send them to my wife every six months or so. I also send them to a burner gmail account I use basic password auth with. In a chaotic moment I can just ask my wife to download the file from her email and I can decrypt and ssh into my server where I store all files and important things encrypted.
- deleted 4y ago
  [deleted]
- geraldhh 4y ago
  > I personally symmetrically encrypt my ssh keys and send them to my wife every six months or so. curious, how do you store that key?
  - ethicalsmacker 4y ago
    Memorized. If I don’t or can’t recall it then I’m dead or may as well be.
    - geraldhh 4y ago
      ah, so i assume your "symmetric key" for the ssh-key is a password?
      - ethicalsmacker 4y ago
        That's correct-- secure password encrypts the ssh keys. Those keys then access the server, which has my pass vault, gpg keys, two factor recovery codes, etc.
huhneverthot 4y ago
You know the big black bold huge warning you clicked through to active 2fa? The one that told you you really really needed to save backup codes? The one that said you will lose your account without said backup codes? You do have those backup codes, right? Backups, password managers, now 2fa backups, all things that people just cannot seem to care about until it's too late
happynacho 4y ago
I use Step Two which also has a Mac app, that also does sync to iCloud. Not a single point of failure.
ectospheno 4y ago
iOS password area of settings also handles verification codes. They are synced across all of your devices. So if you always leave one device at home then you can’t get locked out losing your phone.
manv1 4y ago
Use a 2FA app that backs up to iCloud or syncs to another copy of itself somewhere. Google authenticator is great, until it wipes out all your entries. It did that a few years ago for reasons unknown, so I moved to 2STP (which is now unavailable). Also, the app you use should have an apple watch app, so at least if your phone dies you can use your watch to authenticate.
tpoacher 4y ago
Not that this is of help to you now, but my own controversial take is, avoid any services that push 2FA. Especially if they do so aggressively. This includes things like switching from github to sourcehut for me (though MS+copilot didnt help either) For services where you cant avoid it (e.g. your company email), download a local OTP app, effectively converting back to 1FA, for each device you use to access that service. 2FA is a cancer and needs to die. Mandatory-phone-based 2FA doubly so. The only thing mandatory phone 2FA has done for me is it gives websites an excuse to make a phone a "necessary" field, so now I get spam/scam on my phone as well as my email.
- ASalazarMX 4y ago
  One of the best ways to rob someone of their non-2FA account, is to find their password, and then activate 2FA on an attacker's device. 2FA makes your credentials more secure, specially when you use standards so it can be integrated with third-party apps, like authenticators or password managers. I completely agree about the phone authentication, it's bullshit meant to get your phone number in your profile. SMS is obsolete as a security measure.
- ProllyInfamous 4y ago
  I have closed two bank accounts, both because they required 2FA (I do not use a phone).
- q-base 4y ago
  What is the inherent issue with 2FA? I see the point about phone-number - that is absolutely valid. But if you could I would like to have a few more details about categorizing 2FA as cancer in general?
lazyeye 4y ago
I have 3 phones, my primary phone and a couple of older phones. The older phones are not connected to the internet. I always register new authenticator accounts on all 3 of them.
codegeek 4y ago
I don't know if I can help OP but anyone reading this who uses Google Authenticator. PLEASE BACKUP AUTHENTICATOR on another phone. It is very easy. Here are the steps: https://www.protectimus.com/blog/google-authenticator-backup/ https://www.protectimus.com/blog/google-authenticator-backup...
- ASalazarMX 4y ago
  Also, while it defeats the 2FA somewhat, you can activate TOTP in your KeePass entries, obviating the need for a third authentication app. If you really want to be superstrict, you can have one KeePass database with your passwords, and another, with a different master passwords, for your TOTPs. It's less convenient, but it still stays completely under your control. Except for Apple, which rolled their 2FA in their own, incompatible way... for your convenience and safety, of course.
- huhneverthot 4y ago
  That article is hot garbage, predictably since the app is purpose built to not allow proper backups/migrations. "Go back in time and save the raw secrets" might as well be a certain-fingered emoji to basically literally everyone. At this point, the only hope is getting webauthn everywhere and train people to always enroll a primary and backup token.
DogLover_ 4y ago
The problem with backup codes is that many people don't understand how crucial they are if they loose their device. Even IT people. I believe it is a step many skips because they falsely believe they can get access in some other way if necessary. That it has become standard makes me think the inventors/providers have not thought it through.
- warner25 4y ago
  I'll admit to being an IT person who didn't understand how they worked for a whole year after I first set them up on my Google account. I seriously thought that they were one-time passwords by themselves. About a year later, I decided to test my disaster recovery plan and found that I also needed to have my Google password memorized; I couldn't depend on retrieving it from my KeePass database stored in Google Drive. In retrospect, yes I was stupid, but this honestly wasn't clear to me at first.
nashashmi 4y ago
Google Authenticator is the worst, last time I used it. Too often my 2FA codes would not remain after updates. And when it did remain, it would not transfer to new phones. iPhone has a built in 2FA code generator. HTTP://TOTP.app is a web app that stores 2FA codes. Awesome to use. But you have to remember to download and back up the codes stored in TOTP. Microsoft Authenticator used to be my favorite because it would sync phenomenally well. In the following order, I would rank the 2FA code generators: 1. iPhone (especially if you are using iCloud password manager). 2. totp.app (you can use it even on desktops and every device you possibly have) 3. Microsoft auth (it only backs up to iCloud on iPhone. On android it backs up to an MS account. Can’t be used on desktop). Depending on the service, you have locked yourself out of that service. I screenshot and store 2FA codes on paper because too often I lost my codes because of Terrible unreliable apps.
sebivaduva 4y ago
If you have lost your phone, you will need to contact your authentication provider to disable 2FA on your account. Once you have regained access to your account, you will need to re-enable 2FA.
tacostakohashi 4y ago
I right-click / "Save Image As..." on the image with the QR code, and store all the images in a directory so I can re-import them as needed. Low-tech compared with all the other suggestions here, I should look into how to extract/store the actual seed values instead, etc... but it works for me and has done for years.
gbraad 4y ago
Keep hard copies... Share an export from an app like Aegis Google's doesn't have an export AFAIR. If rooted you might be able to import to Aegis. Oh right, an iPhone. And you lost the phone? You're screwed You can only try to to get the 2FA removed, but for AWS this process is hard, others might be OK... Or unreachable, like Google. Ive been through this, but luckily kept backups in another accounts, just had a hard time remembering the password under stress. My devices were stolen from my home.
71a54xd 4y ago
If you don't have backup codes most companies have a manual flow to regain access. It's a pain, but to be honest I prefer it that way instead of leaving more vectors for social engineering to compromise my accounts.