9 ms·
> And how are you supposed to handle the 2FA for your Google account? I mean I have U2F tokens which remove that concern, but that is far from the typical case.
by justeleblanc 3y ago
> And how are you supposed to handle the 2FA for your Google account? I mean I have U2F tokens which remove that concern, but that is far from the typical case. If you have the 2FA for your Google account in the Google Authenticator, which is probably a very common case, how does this entire thing work then when you need it, which is when you lose your phone?
You open your safe and you use one of the recovery codes that you wrote down when you setup 2FA.
- tasuki 3y agoDo you and people you know have a safe? Where I'm from, we generally don't use safes. Do you consider your safe to be... safe? I'd imagine it to be relatively easy to get into, by picking the lock or sawing through the safe.
- cyberbanjo 3y agoRelatively easy? Relative to what?
- jaggederest 3y agoRelative to the wrench attack, I guess: https://xkcd.com/538/ https://xkcd.com/538/
- saltcured 3y agoRelative to a naively imagined abstraction of a safe, perhaps. A decent home safe can be reasonable protection against that loose scrap of paper with backup codes ending up in the trash can and may even keep it legible in the event of a house fire. But it is true, it won't be much help if you are targeted by safe crackers.
- maxfurman 3y agoA safe is extremely safe against hackers on the other side of the world. Quite safe against more local threats without special equipment and time on their hands. Security is relative to your threat model!
- tedivm 3y agoMost decent safes are not trivial to pick, often using circular keys instead of the flat ones requiring a different type of pick. Newer safes don't even have keyholes but require that you actually know the combination. As for drilling or sawing through it, that's going to take hours to do.
- JohnFen 3y ago> As for drilling or sawing through it, that's going to take hours to do. This is true for expensive commercial safes, but not for home safes. You can drill/saw through them relatively quickly. What you can't do is drill/saw through them without making a whole lot of noise.
- justeleblanc 3y ago> Do you and people you know have a safe? Yes. I'm not taking about a safe like you can see in the movies. Just a locked box. > Where I'm from, we generally don't use safes. That's on you. > Do you consider your safe to be... safe? I'd imagine it to be relatively easy to get into, by picking the lock or sawing through the safe. That's not the point. 2FA is about thwarting password leaks. If someone has physical access to my house and knows my passwords, I'm screwed, yes. But since I don't live in a Jason Bourne movie, my threat model isn't a ninja who steals my passwords then comes into my house to hack my tiktok account. My threat model is breaking my phone and knowing that my backup passwords are in a minimally safe place where I expect them to be and weren't carelessly thrown away with old documents; and deter casual "attackers" like a niece who could be inclined to plunder my papers for coloring material. And if I did live in a Jason Bourne movie, I'd expect the ninja to just beat me up when I get home and unlock my safe for him, assuming I had bought an unbreakable safe.
- cooperadymas 3y ago> And if I did live in a Jason Bourne movie, I'd expect the ninja to just beat me up when I get home and unlock my safe for him, assuming I had bought an unbreakable safe. Here I was thinking you might blow him up with the toaster. Or crash him into a garbage truck after an extenuated car chase.
- TeMPOraL 3y agoWe live in the era of smart toasters. You'll need to use your 2FA tool before you can blow someone up with it, which kind of defeats the point when chased by a ninja that's after your 2FA tool.
- mardifoufs 3y agoSo 2FA is just for the tiny, tiny minority with a safe? What... Am I missing an obvious joke here?
- deadbunny 3y agoOr you know, a drawer with a notebook in it.
- jacobsenscott 3y agoJust keep the backup codes in your wallet - most people protect their wallets pretty well.
- ndsipa_pomu 3y agoI'd recommend obfuscating the codes in the event that you lose your wallet. You don't want a bad actor to find it and realise they can gain control of your account though they'd need to figure out your email first.
- jacobsenscott 3y agoThey need to figure out your email and password from your wallet contents, which is improbable. Anyone who takes your wallet just wants the cash and credit cards - and they toss the rest.
- darkvertex 3y agoYou can also buy a few cheap RFID stickers that can be overwritten from your phone. The cheapest stores like a kilobyte or so, which is plenty for quite a few codes. You can glue them in inconspicuous "boring" places in plain sight, like under a mousepad or behind a movie poster hung on the wall. Great way to hide secrets in your home without owning a traditional safe (which just screams "steal me! I'm the valuable thing in the room!" anyway.)
- NoZebra120vClip 3y agoI keep all the backup codes in my wallet, next to the $5000 in small bills. /s My backup codes are filed in an expando-file. There are far too many to cram into a wallet. Also, if I'm carrying them around with me when I don't need them, my risk/threat model now includes loss and theft of wallet. That's ridiculous and unnecessary.
- jacobsenscott 3y agoWhy would you label your backup codes as to what they go to? Of course that's silly. But if someone does get your wallet they still need to know the website they are for as well as your login and password. It is low risk. Or just ignore the backup codes altogether. We mostly have "fake 2fa" - where you can reset your 2fa auth if you lose your device because otherwise customer support would be impossible. Almost every service allows this.
- blendergeek 3y agoThe main purpose of a home "safe" is fire protection. If my house burns down, the contents of my safe should be fine. Obviously a sufficiently motivated adversary can get in. But that (usually) isn't something I am worried about. Most internet hackers do not physically break into houses and open safes.
- organsnyder 3y agoYeah, we actually keep the key in the lock in ours. If someone gets in and really wants to steal it (note to potential thieves: there isn't anything worth your while), they could just carry the whole safe with them. It's only for preserving important documents in case of fire.
- kbenson 3y agoMany safes allow for securing to the floor, making porting it away require a bit more effort, possibly including power tools which are quite loud. Also they're quite heavy usually. I remember as a child someone broke into our house while we were away to steal stuff. The safe wasn't bolted down, and they carried it from one end of the house to the other before giving up, either because they got spooked by something and bolted or because it was just too damn heavy. Think about the logistics of it. If they're stealing a safe, that probably requires a vehicle. A vehicle is more identifiable and unless stolen makes it easier to track people if noticed or recorded. If stolen, there's a chance it will cause a problem immediately before, during or after the crime. If they don't use a vehicle, all the benefits of not using one, such as being able to take non-road paths and blend into crowds are negated. And if they choose to crack the safe on location, that adds time to the crime while doing so, and all time spent at the location of the crime increases the chance they'll be caught because someone notes something suspicious. Like a lock on a house a safe within a house serves it's purpose not by making it impossible to gain access but by making it much more troublesome and likely to be noticed, changing the risk to reward ratio.
- wintogreen74 3y agoTh "protection" from home safes is a joke: typically 30-60 minutes at temperatures less than the heat generated by a house fire.
- wintogreen74 3y agoor a little water damage, or a fire lasting more than 30 minutes.
- kingcharles 3y agoMy entire storage building just burned to the ground with my safe in it, all my paper codes, my laptop with all my auth on it. Luckily by sheer fluke my phone was saved which has my TOTP apps on it or I would never get into anything again.
- ISL 3y agoWhy did the safe fail to protect the paper -- too hot, too long?
- kingcharles 3y agoLol the water from the fire service did more damage. Fire proof, but not high pressure water proof.
- djbusby 3y ago"The what in where?" says typical user.
- booi 3y agoCan you just reset my password to P@ssword2023!
- ndsipa_pomu 3y agoNo, it can't be a previous password
- dexterdog 3y agoIt was P@ssword2022! previously
- qup 3y agoIt must contain a bizarre character that you would normally never use in a password.
- NoZebra120vClip 3y agoMy passwords always contain at least one poop emoji, the Sanskrit OM glyph, and the hieroglyph which means "motorcycle".
- qup 3y agoSure, but you should know that OpenAI disputes the translation of the moto hieroglyph, and they use it to mean "UFO" which is against policy and therefore not allowed in your password.
- bombolo 3y agoBut it can't be a space or a letter in your own non-english language, or our hashing algorithm breaks.
- howinteresting 3y agoYou have to meet people where they're at.
- TeMPOraL 3y ago> You open your safe and you use one of the recovery codes that you wrote down when you setup 2FA. HN rarely does humor, but when it does, it really cuts deep. Can you really expect a typical person - including the tech-savvy ones - to keep a hastily written piece of paper for a decade or more, without losing it? My code card is clocking on a decade, I needed it only once (so far), and it's only pure luck that, in all those years, I haven't accidentally destroyed it or thrown it away. Also: it only recently became apparent just how bad it is to lose access to your Google account. Most tech-savvy people I know don't even realize how many things in their lives are gated by that little login form. Non-tech-savvy folks? Maybe they'll figure it out in a decade, after enough people became thrust into poverty for the lack of Google 2FA recovery codes - enough many that it's as boring news story as car accidents.
- jpalomaki 3y agoThis is why I don’t like when people outright dismiss SMS as suitable second factor. Yes, it has problems, but it also has a recovery mechanism that is accessible for ”ordinary peope”. The best solution (for me) would be to connect the Google Account to my government issued identity and utilize the strong authentication provided by government for account recovery.
- WorldMaker 3y agoI've been joking about a need for "notary factor" for a long time. There's an existing, deep and distributed network of notaries public that could be reused for stronger authentication in the modern world. In classic banking if you had a recovery problem you could send certain types of notarized letters to get stuff done. It was slow: however long it took to prepare the letter, find a notary public to get it notarized, and then presumably snail mail it to its destination. But sometimes slow is better: if someone is trying to steal my account, if they need to get the right forms notarized and mailed to the right PO Box, there are many steps along the way where I can intercede or a notary public can interject ("I won't notarize this because my ethics do not allow it.") or presumably human recipient at a PO Box can reject the mail for any number of violations or failures of documentation. I think it would be great if the recovery mechanism for "ordinary people" took about the same amount of time as a notarized letter. In that worst case where you are locked out of your account for a week or two it won't feel great, but it also helps you feel better that some jerk trying to steal your stuff can't do it any faster either. There are all kinds of fun technical things that could be used to actually build interesting "notary factor" tools. I think tech companies mostly reject how cool it could be to build because they see "slow" as a "bug" rather than a "feature".