4 ms·
My fear is that your phone is also the primary MFA device, so losing that could mean you can't log into your account anymore (and therefore can't restore the cl
by mook 3y ago
My fear is that your phone is also the primary MFA device, so losing that could mean you can't log into your account anymore (and therefore can't restore the cloud backup)…
- ISL 3y agoGoogle offers to back up Authenticator, should you choose to do so.
- zigzag312 3y agoWhich defeats the purpose of MFA, since your Google account becomes your only factor.
- mook 3y agoSorry, I should be clearer: to login to Google on a new device, you typically need to accept a prompt on an old device. But if your old device is dead, that's not possible. Authenticator does TOTP and things, which is typically not adequate for logging in (even though it _should_ be).
- pmontra 3y agoI'm not using Google Authenticator or anything like that but when my old phone dropped somewhere at the bottom of a river all my banking apps, which do 2FA, had a way to let me start again on my new phone. Services that don't assist their users in a disaster recover scenario are severely lacking.
- btreecat 3y agoYes they are, and yet they exist.
- utybo 3y agoThe prompt on an old device is just one of the MFA options you can use. You can also use a security key (e.g. Yubikey, Solokey, etc.).
- sirius87 3y agoThis was my worst fear but I had opted-in to backup Authenticator with Google. Opting in to backup your data with Google is seamless and it also restores stuff like SMS messages. But I suppose this is one more thing the anti-trust case against Google should probably be looking into. Should Google be allowed this deep integration with their cloud services?