4 ms·

It was not difficult because you actually had the recovery codes. How many people have them? Also you're supposed to print them. Where? How many people own a p

by guappa 2y ago

It was not difficult because you actually had the recovery codes. How many people have them? Also you're supposed to print them. Where? How many people own a printer? If you print them in a shop they can be considered compromised.

akx 2y ago
The recovery codes I've seen tend to have been 10 8-digit sequences. If you don't have a printer and care about recovery codes, those are easy enough to transfer manually onto dead-tree material using a stylus-like handheld device that deposits graphite or ink onto the surface it touches.
- guappa 2y ago
  Except that you need to decipher your own handwriting years after having written it. And you also need to remember where you safely stored it.
  - kibwen 2y ago
    When I know it's important to decipher something later, I have a 100% accurate decoding rate on my own handwriting, so that's not a problem. It's not hard to write clearly and carefully. In addition, they give you ten codes to use, so you'd need to make indecipherable errors in all of them. Also, having a safe place to store documents is table stakes for adulthood.
samatman 2y ago
We're talking about software developers, right? I would hope that when a software dev sees a widget that says "these are your recovery codes, write them down or copy them to a secure location or you may lose access to your account", they do exactly that. Except for codes which protect my money (which go onto paper, which goes in a safe), I put them in a password vault. TOTP offers protection against getting shoulder-surfed, key logged, or phished, it isn't much protection if Mallory gets access to my entire password vault. YMMV.
- guappa 2y ago
  > I would hope that when a software dev sees a widget that says "these are your recovery codes, write them down or copy them to a secure location or you may lose access to your account", they do exactly that. Yes software developers are known for never making any mistake.

by guappa 2y ago

akx 2y ago

The recovery codes I've seen tend to have been 10 8-digit sequences. If you don't have a printer and care about recovery codes, those are easy enough to transfer manually onto dead-tree material using a stylus-like handheld device that deposits graphite or ink onto the surface it touches.

guappa 2y ago
Except that you need to decipher your own handwriting years after having written it. And you also need to remember where you safely stored it.
- kibwen 2y ago
  When I know it's important to decipher something later, I have a 100% accurate decoding rate on my own handwriting, so that's not a problem. It's not hard to write clearly and carefully. In addition, they give you ten codes to use, so you'd need to make indecipherable errors in all of them. Also, having a safe place to store documents is table stakes for adulthood.

samatman 2y ago

We're talking about software developers, right? I would hope that when a software dev sees a widget that says "these are your recovery codes, write them down or copy them to a secure location or you may lose access to your account", they do exactly that. Except for codes which protect my money (which go onto paper, which goes in a safe), I put them in a password vault. TOTP offers protection against getting shoulder-surfed, key logged, or phished, it isn't much protection if Mallory gets access to my entire password vault. YMMV.

guappa 2y ago
> I would hope that when a software dev sees a widget that says "these are your recovery codes, write them down or copy them to a secure location or you may lose access to your account", they do exactly that. Yes software developers are known for never making any mistake.