3 ms·

Syncing of "MFA codes" is really syncing of the secret component of TOTP (time based one time password). And it's a good thing, and damn any 2fa solution that

Syncing of "MFA codes" is really syncing of the secret component of TOTP (time based one time password). And it's a good thing, and damn any 2fa solution that blocks it. I don't want to go through onerous, incompetent, poorly designed account recovery procedures if a toddler smashes my phone. So I use authy personally, while a friend backs his up locally.

skybrian 3y ago
A better way to fix this is to have multiple ways to log in. Printed backup codes in your safe with your personal papers and/or a Yubikey on your keychain. This works for Google and Github, at least. Passkey syncing is more convenient, though, and probably an improvement on what most people do.
itake 3y ago
> I don't want to go through onerous, incompetent, poorly designed account recovery procedures if a toddler smashes my phone Why don't you use the printed recovery tokens?
- monocasa 3y ago
  Who has a printer these days?
  - CameronNemo 3y ago
    Local libraries, print shops... but yeah that may be an attack vector.
- unethical_ban 3y ago
  Not all websites offer them. Hell, no bank I use (several large and several regional) support generic totp. Some have sms, one has Symantec VIP, proprietary and not redundant. Edit: since I'm posting too fast according to HN, even though I haven't posted in an hour, I'll say it here. Symantec is totp but You cannot back up your secrets and you cannot have backup codes.
  - CameronNemo 3y ago
    Symantec VIP is TOTP under the hood. https://github.com/dlenski/python-vipaccess https://github.com/dlenski/python-vipaccess
- Zarathustra30 3y ago
  The toddler got there first. Seriously, though, it's hard to keep track of something that gets used once every five years.
- e12e 3y ago
  > Why don't you use the printed recovery tokens? I currently see 53 2fa tokens in my private bitwarden. You expect me to print, keep safe and manually reset them all when I buy a new phone?
charcircuit 3y ago
If you can backup a key it is not MFA. It just a second password and not another factor. The solution to having your phone smashed is to have multiple "something you have", so you have a backup.

skybrian 3y ago

A better way to fix this is to have multiple ways to log in. Printed backup codes in your safe with your personal papers and/or a Yubikey on your keychain. This works for Google and Github, at least. Passkey syncing is more convenient, though, and probably an improvement on what most people do.

itake 3y ago

> I don't want to go through onerous, incompetent, poorly designed account recovery procedures if a toddler smashes my phone Why don't you use the printed recovery tokens?

monocasa 3y ago
Who has a printer these days?
- CameronNemo 3y ago
  Local libraries, print shops... but yeah that may be an attack vector.
unethical_ban 3y ago
Not all websites offer them. Hell, no bank I use (several large and several regional) support generic totp. Some have sms, one has Symantec VIP, proprietary and not redundant. Edit: since I'm posting too fast according to HN, even though I haven't posted in an hour, I'll say it here. Symantec is totp but You cannot back up your secrets and you cannot have backup codes.
- CameronNemo 3y ago
  Symantec VIP is TOTP under the hood. https://github.com/dlenski/python-vipaccess https://github.com/dlenski/python-vipaccess
Zarathustra30 3y ago
The toddler got there first. Seriously, though, it's hard to keep track of something that gets used once every five years.
e12e 3y ago
> Why don't you use the printed recovery tokens? I currently see 53 2fa tokens in my private bitwarden. You expect me to print, keep safe and manually reset them all when I buy a new phone?

charcircuit 3y ago

If you can backup a key it is not MFA. It just a second password and not another factor. The solution to having your phone smashed is to have multiple "something you have", so you have a backup.