3 ms·

Every competent TOTP implementation has backup codes. Use one of your backup codes when your phone breaks. You did write them down like the site told you to, r

Every competent TOTP implementation has backup codes. Use one of your backup codes when your phone breaks. You did write them down like the site told you to, right? Even if a site doesn't offer backup codes, you can extract the TOTP secret from the QR code, or most authenticator apps, quite easily, and then write it down. It's more secure to only save the backup codes though since they have a limited number of uses, while the TOTP secret has unlimited uses.

twothamendment 3y ago
I know you said competent, so this doesn't apply to the service I used yesterday, but it blew my mind. I lost access to TOTP for a service, but no big deal, I'm a good person who kept the backup codes. The codes are all 4 digits and the service wants a 6 digit code! Luckily it is some lame work account that someone else can unlock to get me back in. I couldn't believe that the backup codes provided are now obsolete!
- qingcharles 3y ago
  Damn, you're lucky it's not something important. Especially with accounts for things like Google or Facebook/Instagram where they boast about not having any human support and you are totally shit-out-of-luck if you can't get in.
londons_explore 3y ago
Except Google. Google backup codes are near useless because a Google backup code will let you log in, but won't allow you to disable 2 factor or add a new 2 factor device - meaning if you ever lose a 2 factor device and have to use a backup code, there is no way to recover your account.
- lxgr 3y ago
  Really? I'd imagine you'd need two codes (one for the login, one for access to your 2FA settings), but not being able to recover at all using them seems horrible!
  - londons_explore 3y ago
    It just gives some error like "this login method is not allowed for this action" or similar.
    - msm_ 3y ago
      Interesting. I can't confirm though - I personally changed my 2FA device 2 weeks ago using a backup code. I couldn't find old yubikey that I used as 2FA for google, decided to regain access with a backup code and add my new yubikey, and it worked flawlessly. It probably helped that I used the same machine as always. Google does a lot of undocumented heuristics in the background, and you either get additional verification or not.
      - qingcharles 3y ago
        Yes, same machine helped, it's definitely one of the factors it uses. I have a near-20-year Google account I can't access because I lost the 2FA number. I have the username, password and recovery email. But that isn't enough, apparently.

twothamendment 3y ago

I know you said competent, so this doesn't apply to the service I used yesterday, but it blew my mind. I lost access to TOTP for a service, but no big deal, I'm a good person who kept the backup codes. The codes are all 4 digits and the service wants a 6 digit code! Luckily it is some lame work account that someone else can unlock to get me back in. I couldn't believe that the backup codes provided are now obsolete!

qingcharles 3y ago
Damn, you're lucky it's not something important. Especially with accounts for things like Google or Facebook/Instagram where they boast about not having any human support and you are totally shit-out-of-luck if you can't get in.

londons_explore 3y ago

Except Google. Google backup codes are near useless because a Google backup code will let you log in, but won't allow you to disable 2 factor or add a new 2 factor device - meaning if you ever lose a 2 factor device and have to use a backup code, there is no way to recover your account.

lxgr 3y ago
Really? I'd imagine you'd need two codes (one for the login, one for access to your 2FA settings), but not being able to recover at all using them seems horrible!
- londons_explore 3y ago
  It just gives some error like "this login method is not allowed for this action" or similar.
  - msm_ 3y ago
    Interesting. I can't confirm though - I personally changed my 2FA device 2 weeks ago using a backup code. I couldn't find old yubikey that I used as 2FA for google, decided to regain access with a backup code and add my new yubikey, and it worked flawlessly. It probably helped that I used the same machine as always. Google does a lot of undocumented heuristics in the background, and you either get additional verification or not.
    - qingcharles 3y ago
      Yes, same machine helped, it's definitely one of the factors it uses. I have a near-20-year Google account I can't access because I lost the 2FA number. I have the username, password and recovery email. But that isn't enough, apparently.