5 ms·

Use your backup codes that you've downloaded and safe-kept somewhere (you did this right?). If not, I'm afraid you're out of luck. There are two possible outco

Use your backup codes that you've downloaded and safe-kept somewhere (you did this right?). If not, I'm afraid you're out of luck. There are two possible outcomes from contacting support for a service, asking to regain control over a 2FA-protected account, both which sucks, but on different levels. 1. You write them, proving who you are, and they tell you to get lost unless you have the 2FA proper codes, or backup codes. This sucks because you still didn't get access. 2. You write them, proving who you are, and they give you access to your account, so you can reset 2FA. This sucks because this means the service is not secure and you/others can be "hacked" because customer support can be exploited.

huhtenberg 4y ago
> Use your backup codes that you've downloaded and safe-kept somewhere ... or re-initialize 2FAs from their original seeds, which are typically hidden under a "set up manually" option during the enrollment process.
bluGill 4y ago
This is why phone based 2fa is not secure and not recommended. Sure it is easy, but it isn't secure in important ways
- capableweb 4y ago
  What? Where the 2FA codes come from isn't relevant, as long as the device (laptop, phone, desktop, hardware) is protected in some way or another (like password). Backup codes come from the service which is 2FA protected anyways, not from the 2FA authenticator itself. Edit: oh, reading your message again, are you referring to SMS-based 2FA? I assumed TOTP 2FA in this submission. If you mean SMS-based 2FA, then yeah I agree, makes your account less secure than not having 2FA at all.
  - rat9988 4y ago
    I'm pretty sure he talks about totp too.
  - bluGill 4y ago
    Nobody has a secure password on their phone, so your requirement fails. There is no way to get a secure password on a phone as one of the requirements of a phone is quick access, and no fast password is secure. (maybe finger prints, but I have found them unreliable and so I quit using them) If your phone based code system is also available on other accounts, and you can access those other accounts without the phone then maybe. However many people only have a phone, and no other computer (or at least not a computer they use often enough that we can trust the 2fa isn't expired). The 2fa I've seen mostly has a SMS based fallback, and thus is no more secure than SMS.
    - capableweb 4y ago
      > Nobody has a secure password on their phone, so your requirement fails. Well, you could if you want to. That you don't want to, is a failure on your part, not on "everyone"'s part, since most phones do offer you the feature of setting a sufficiently secure password. > However many people only have a phone, and no other computer (or at least not a computer they use often enough that we can trust the 2fa isn't expired). You don't need a second device in order to backup your codes. By leveraging "cryptographic splitting" you can divide a secret into N parts and share them with friends and family, and if you need to regain access, ask them each for their part back and then you can recover from there. Now I guess that's kind of advanced so most people won't/can't do that, but it is possible at least. You could try something like https://iancoleman.io/shamir/ https://iancoleman.io/shamir/ if you're curious about the process, I've done this myself for some things. Easier solution is to create a encrypted archive with your backups, and upload to various cloud services. As long as the encryption scheme is secure, you'll be safe. > The 2fa I've seen mostly has a SMS based fallback, and thus is no more secure than SMS. I'm using TOTP 2FA for 100% of every service I use and that offers it. I think only one requires SMS-based fallback, the rest are optional so obviously I'm not using that.
    - carlosjobim 4y ago
      > Nobody has a secure password on their phone, so your requirement fails. > maybe finger prints, but I have found them unreliable and so I quit using them You mean that you specifically do not have a secure password on your phone because you chose not to. The rest of us use finger print sensors or facial recognition to make our devices as secure as can be. Your argument applies only to you and a handful of people. The SMS fallback is always combined with your finger print in all applications I've used.
- itake 4y ago
  What is recommended?
- jkepler 4y ago
  No, SMS-based 2FA is the security problem due to SIM-swapping attacks. Loss of a phone with a 2FA authenticator app isn't a security problem, unless one failed to make backups of the 2FA secrets for restauring.
dhdhhdd 4y ago
I so wish u2f/yubikey was supported on all websites :-(
- Zetobal 4y ago
  I use the yubikey authenticator app for the ones that don't. The secrets are saved on the key and you can password protect it... and as with all keys back it up to your spare.
  - latchkey 4y ago
    When you're traveling to Costa Rica, where do you keep your spare? Do you stay locked out until you get home? What if you're a nomad and you don't have a 'home'?
    - Zetobal 4y ago
      One of my spares is usually with my spouse (it's still password protect) and if both get lost I kinda deserve to be logged out until I get home.
jononomo 4y ago
I have backup codes saved in 1Password for maybe 10% of the online accounts with which I use 2FA + Google Authenticator. I'm concerned about the online accounts for which I don't have backup codes.
theonething 4y ago
I have Google Authenticator and Authy running on both my iPhone and my iPad (which always stays at home) Is this a bad way to do backup?

huhtenberg 4y ago

> Use your backup codes that you've downloaded and safe-kept somewhere ... or re-initialize 2FAs from their original seeds, which are typically hidden under a "set up manually" option during the enrollment process.

bluGill 4y ago

This is why phone based 2fa is not secure and not recommended. Sure it is easy, but it isn't secure in important ways

capableweb 4y ago
What? Where the 2FA codes come from isn't relevant, as long as the device (laptop, phone, desktop, hardware) is protected in some way or another (like password). Backup codes come from the service which is 2FA protected anyways, not from the 2FA authenticator itself. Edit: oh, reading your message again, are you referring to SMS-based 2FA? I assumed TOTP 2FA in this submission. If you mean SMS-based 2FA, then yeah I agree, makes your account less secure than not having 2FA at all.
- rat9988 4y ago
  I'm pretty sure he talks about totp too.
- bluGill 4y ago
  Nobody has a secure password on their phone, so your requirement fails. There is no way to get a secure password on a phone as one of the requirements of a phone is quick access, and no fast password is secure. (maybe finger prints, but I have found them unreliable and so I quit using them) If your phone based code system is also available on other accounts, and you can access those other accounts without the phone then maybe. However many people only have a phone, and no other computer (or at least not a computer they use often enough that we can trust the 2fa isn't expired). The 2fa I've seen mostly has a SMS based fallback, and thus is no more secure than SMS.
  - capableweb 4y ago
    > Nobody has a secure password on their phone, so your requirement fails. Well, you could if you want to. That you don't want to, is a failure on your part, not on "everyone"'s part, since most phones do offer you the feature of setting a sufficiently secure password. > However many people only have a phone, and no other computer (or at least not a computer they use often enough that we can trust the 2fa isn't expired). You don't need a second device in order to backup your codes. By leveraging "cryptographic splitting" you can divide a secret into N parts and share them with friends and family, and if you need to regain access, ask them each for their part back and then you can recover from there. Now I guess that's kind of advanced so most people won't/can't do that, but it is possible at least. You could try something like https://iancoleman.io/shamir/ https://iancoleman.io/shamir/ if you're curious about the process, I've done this myself for some things. Easier solution is to create a encrypted archive with your backups, and upload to various cloud services. As long as the encryption scheme is secure, you'll be safe. > The 2fa I've seen mostly has a SMS based fallback, and thus is no more secure than SMS. I'm using TOTP 2FA for 100% of every service I use and that offers it. I think only one requires SMS-based fallback, the rest are optional so obviously I'm not using that.
  - carlosjobim 4y ago
    > Nobody has a secure password on their phone, so your requirement fails. > maybe finger prints, but I have found them unreliable and so I quit using them You mean that you specifically do not have a secure password on your phone because you chose not to. The rest of us use finger print sensors or facial recognition to make our devices as secure as can be. Your argument applies only to you and a handful of people. The SMS fallback is always combined with your finger print in all applications I've used.
itake 4y ago
What is recommended?
jkepler 4y ago
No, SMS-based 2FA is the security problem due to SIM-swapping attacks. Loss of a phone with a 2FA authenticator app isn't a security problem, unless one failed to make backups of the 2FA secrets for restauring.

dhdhhdd 4y ago

I so wish u2f/yubikey was supported on all websites :-(

Zetobal 4y ago
I use the yubikey authenticator app for the ones that don't. The secrets are saved on the key and you can password protect it... and as with all keys back it up to your spare.
- latchkey 4y ago
  When you're traveling to Costa Rica, where do you keep your spare? Do you stay locked out until you get home? What if you're a nomad and you don't have a 'home'?
  - Zetobal 4y ago
    One of my spares is usually with my spouse (it's still password protect) and if both get lost I kinda deserve to be logged out until I get home.

jononomo 4y ago

I have backup codes saved in 1Password for maybe 10% of the online accounts with which I use 2FA + Google Authenticator. I'm concerned about the online accounts for which I don't have backup codes.

theonething 4y ago

I have Google Authenticator and Authy running on both my iPhone and my iPad (which always stays at home) Is this a bad way to do backup?