7 ms·

Never enable 2FA for accounts that you actually care about (2023)

10 points by benwilber0 2y ago

evanjrowley 2y ago
I went though a similar problem about 10 years ago. In my case, the phone (iPhone 4S) wasn't lost, but it's clock was perpetually off. The WiFi radio had failed and the Stratum 1 time server on my mobile network seemed to be sending it the wrong time. This resulted in all of the MFA TOTPs getting rejected and me not being able to access Gmail for a year. Despite the clock issue, many things still worked, presumably because this was still back when much of the internet used either weak or zero TLS/SSL.
- Brian_K_White 2y ago
  There is no such problem as you describe, because you were never limited to a single device like that. You just didn't know it because both the totp app and the site that used it conspire to not tell you something very simple. Which is that all you need is the seed value from the original qr code or url, or sometimes it's even just displayed in plain text on screen. But it's perfectly readable from the url or qr code too. That value is all you need to generate valid current totp codes on a new device, or on 30 different devices and platforms all at the same time. It's no more difficult or risky than any other password. It's just a short random string you have to store any way you want anywhere you want any number of copies and forms you want, and can use on any new device you want at any time. You can have as many working totp generators as you want, all at the same time. You can spin up a brand new device from scratch any time you want. But the apps and sites don't tell you about that, and instead give you the one-time-use emergency codes, and only display those one time, and if it's 10 years ago and the whole process is a mystery, you can easily blow through that screen without realizing it was actually important to capture those and then not lose them. (And with the seed value, the emergency codes are no longer important.) In the case of your defective phone, had you known to save the original seed value, you just grab any other new phone, or your laptop, or anything, install whatever totp app you like on that, fetch your password db however you like (that doesn't itself require totp), and add the saved seed values in the new totp app, and it starts generating current valid totp codes. keepass actually does both in the same app. It can not only store the seed value just like a password, it will also display/clipboard the current totp code the same as any other totp app directly itself.
  - leereeves 2y ago
    That's assuming the seed value is given to you at all, and not hidden inside a custom app.
  - evanjrowley 2y ago
    Yes! That is exactly what I did in the aftermath of that iPhone 4S fiasco. I went though some iterations of Android phones and made sure I got the TOTP seed in the MFA app on both devices. Eventually I moved onto TOTP apps that can sync these and stopped worrying about it.
ggm 2y ago
> didn’t have backup codes ok. check. So.. the advice is maybe.. "always have your backup codes"
- benwilber0 2y ago
  oh shit I lost my backup codes. So now I'm just never allowed to use Uber again?
  - andrewxdiamond 2y ago
    As long as you dont loose your backup codes and your MFA device at the same time, you're safe.
    - benwilber0 2y ago
      Well, hopefully you never lose your original birth certificate and your social security card! You won't be a citizen anymore!
      - shadowgovt 2y ago
        But unlike your original birth certificate and your social security card, you can keep an arbitrary number of copies of your backup codes in an arbitrary number of safe caches.
        benwilber0 2y ago
        But what if I did't do any of those things? What if I made a mistake and didn't save my backup codes on 3 different types of storage medium (at least one of them offsite)? Or at all?
        3np 2y ago
        I mean, we just read about it, right? (: Harsh but let this be a lesson to set up a more resilient structure for yourself moving forward. Anyone can make mistakes. You can set up failsafes for your own ones pre-emptively. "2FA is garbage" is not the right lesson to learn here...
petcat 2y ago
This is also why stuff like blockchain-based currency will never be realistic or accepted in the "real world". We need the ability to fix things out-of-band. Like you said, people make mistakes. Imagine that your bank or credit card just says Tough Luck! Nah. Of course not. edit: Fuck Uber anyway
- OutOfHere 2y ago
  > We need the ability to fix things out-of-band. Out-of-band fixes require trusting banks, but how trustable are banks really? Often the banks do say "tough luck". This is why you should never leave much balance in an active bank account in the US. Credit card issues are more fixable, but only in the US. Regarding blockchain, it grants freedom in that you have the choice of trusting a third-party custodian, or doing self-custody. Having choices is good.
  - petcat 2y ago
    So you've never had a credit card. Or any bank card at all where fraudulent usage is the liability if the bank, not you. How do you think that works?
    - OutOfHere 2y ago
      > So you've never had a credit card. Or any bank card at all where fraudulent usage is the liability if the bank, not you. That's some inapplicable and incorrect nonsense you invented right there. If you need help with logical reasoning to go correctly from A to B, then GPT can guide you.
      - petcat 2y ago
        How do you think that credit cards work? I assume you have one. Or bank cards. I steal your credit card and spend $80 to fill up my gas tank and then go buy a pair of sneakers, who do you think pays for that? It's not you. It's the credit card or bank company. And then they call and ask if it was fraud and you say "yeah, it was fraud. I was nowhere near a Foot Locker in Gary, Indiana." So they "reverse" it and they absorb the loss. It's how the entire credit financial system works. I'll send you some books you should read.
theo0833 2y ago
> I didn’t have backup codes for some of them uh oh...
shadowgovt 2y ago
I ran into this issue when I accidentally cooked my phone while on a trip out of town. Google wouldn't reauthorize me to log in because the phone that got cooked was my second device. ... So I fixed the problem when I got home. I don't put myself in a situation where losing one device completely ruins my ability to move around the country. That's just unsafe. It was, admittedly, inconvenient to not have easy access to everything my Google account locks against... But it's also convenient to not have to worry too much about hackers compromising my account if they manage to guess my password. I appreciate this level of security on something that I've routed way too many authentication keys through.
deleted 2y ago
[deleted]
CrendKing 2y ago
"Blame" 2FA for your own mistakes just sends bad message. How do people who are capable of setting up 2FA (therefore not tech-illiterate) still don't use password manager? Imagine storing either the 2FA secret or the backup code in it.
- petcat 2y ago
  2FA apps are a fundamentally broken auth mechanism. We just saw Microsoft's authenticator app inexplicably delete people's codes and lock them out of their accounts. And this is another example of how stupid the whole thing is. It's all for theater.
  - OutOfHere 2y ago
    You're speaking nonsense. If you use a bad app, that's on you. There are plenty of 2FA apps that work just fine.
    - petcat 2y ago
      > There are plenty of 2FA apps that work just fine. Is one of them Microsoft Authenticator?
      - OutOfHere 2y ago
        > Is one of them Microsoft Authenticator? Hell no.
bxparks 2y ago
What would be the point of 2FA if a scammer can just email Uber to turn it off?
Dwedit 2y ago
TOTP on the other hand is completely fine. Encrypt your TOTP secret file just to keep it around, and enter the secret into your Firefox Browser (TOTP browser extension), and the android app "Secur". No third parties involved. Nothing to worry about if you lose your phone.
calmbonsai 2y ago
Uber effectively doesn't have customer service--or at least it hasn't for the past few years. You can no longer simply "call" and the out-of-app email is a chatbot ouroboros straight out of dystopian fiction. Think Gilliam's Brazil, but worse. After a few failed Uber pick-ups and one instance of a mysterious 27% post-ride "corridor fee", my policy moving forward was to simply no longer do business as a paying customer with any business that doesn't have actual customer support. This meant, among other things, migrating off of Google, a few brokerage accounts, and one national bank. Doing a "support test" is also now one of the very first things I do as a new customer of any company. So far, I have zero regrets. In a perverse way, I give Uber credit for providing the impetus for those decisions.
- OutOfHere 2y ago
  > email is a chatbot ouroboros straight out of dystopian fiction Hold on there. The chatbot may be dystopian, but an ouroboros is never dystopian. An ouroboros represents cyclicality, unity, or the eternal return, but not in a dystopian context of meaninglessness. An ouroboros is meant to grant a grand perspective, not to be a well of misery.
  - calmbonsai 2y ago
    From a historic mythical standpoint, you're absolutely correct. I was using it as a topological (I guess technically graph-theoretic) metaphor for the self-consuming looping that was/is Uber's email support system. Over the course of 36+ hours, multiple "support agents" kept re-quoting either my responses or their own responses as "the newest escalation". It was hilarious and also sad. I just ended up doing a charge-back on the card.
amanzi 2y ago
Why do you care about an Uber account? Can't you just create a new account and start over? The accounts I care about are the ones where I've got important files or data stored in them.
- petcat 2y ago
  In USA, Uber accounts are locked to phone numbers. You can't just create a new account. OP is fucked.
  - amanzi 2y ago
    Ah - interesting. I just created a new Uber account here in NZ and during the sign-up process I get this: "Enter your mobile number (Optional)". No need to enter a mobile number.
  - reportgunner 2y ago
    Must you have a singular phone number in USA ? I don't see the problem.
OutOfHere 2y ago
> Never enable 2FA for accounts that you actually care about This is an extremely bad take for two reasons: 1. The author failed to store the 2FA Secret Key. This is exposed by any good 2FA app, but not by bad 2FA apps. The Secret Key must be backed up. A good 2FA app will backup everything easily with an encrypted password. 2. The author doesn't store or use backup codes for the app or site. In short, the author is completely irresponsible, and then has the audacity to give bad advice.
- benwilber0 2y ago
  Author here. Explain to me why I should be permanently banned from Uber because I accidentally forgot the secret key to log in to my account.
  - OutOfHere 2y ago
    > Explain to me why I should be permanently banned from Uber You shouldn't, but your headline doesn't attack Uber, does it? Perhaps it should.
    - benwilber0 2y ago
      Do you think that you could get Google, or Github, to turn off your 2FA login requirement if you really needed it? Like if you lost your codes? Or never saved them in the first place?
      - OutOfHere 2y ago
        In general, if an account is associated with a phone number, then I expect to be able to use the phone number to restore access to the account. Uber looks to have failed you here. As for my Google and GitHub accounts, if they're not associated with a phone number or recovery email address, I fully expect to lose access permanently if I were to lose the codes. In such a case, I take responsibility for it.
        2y ago
Brian_K_White 2y ago
There is no such problem. It's not even the emergency codes. Those are just a silly misdirection all sites engage in. When you set up 2fa, you just save the seed value exactly the same way you save any other good random password you rely on a password manager to keep for you. It is exactly as difficult and exactly as easy and exactly as portable as the regular password. They just don't tell you that the number in the qr code is something you can keep and re-use exactly like the password. They lead you to throw that away and give you the stupid emergency codes instead. But just, don't throw it away that's all. It's the keys to your own kingdom. If you throw it away, yes, you can lock yourself out. One way you could solve that is by not having any keys, or another way is by just not throwing away your keys. You were never limited to any single magic device that better never break or get lost. You can have N different devices all generating the same valid current totp codes at the same time. You can set up a brand new device any time you want, if you just have any form of access to any copy of your password db. Flagging this was correct. What is wrong with 2fa is the way all the apps and sites don't tell users what the seed value is and don't tell them to keep it and thereby put the users into a risky position they never had to be in. It's criminal if you ask me, like a doctor or lawyer giving bad advice.

10 points by benwilber0 2y ago

I went though a similar problem about 10 years ago. In my case, the phone (iPhone 4S) wasn't lost, but it's clock was perpetually off. The WiFi radio had failed and the Stratum 1 time server on my mobile network seemed to be sending it the wrong time. This resulted in all of the MFA TOTPs getting rejected and me not being able to access Gmail for a year. Despite the clock issue, many things still worked, presumably because this was still back when much of the internet used either weak or zero TLS/SSL.

Brian_K_White 2y ago
There is no such problem as you describe, because you were never limited to a single device like that. You just didn't know it because both the totp app and the site that used it conspire to not tell you something very simple. Which is that all you need is the seed value from the original qr code or url, or sometimes it's even just displayed in plain text on screen. But it's perfectly readable from the url or qr code too. That value is all you need to generate valid current totp codes on a new device, or on 30 different devices and platforms all at the same time. It's no more difficult or risky than any other password. It's just a short random string you have to store any way you want anywhere you want any number of copies and forms you want, and can use on any new device you want at any time. You can have as many working totp generators as you want, all at the same time. You can spin up a brand new device from scratch any time you want. But the apps and sites don't tell you about that, and instead give you the one-time-use emergency codes, and only display those one time, and if it's 10 years ago and the whole process is a mystery, you can easily blow through that screen without realizing it was actually important to capture those and then not lose them. (And with the seed value, the emergency codes are no longer important.) In the case of your defective phone, had you known to save the original seed value, you just grab any other new phone, or your laptop, or anything, install whatever totp app you like on that, fetch your password db however you like (that doesn't itself require totp), and add the saved seed values in the new totp app, and it starts generating current valid totp codes. keepass actually does both in the same app. It can not only store the seed value just like a password, it will also display/clipboard the current totp code the same as any other totp app directly itself.
- leereeves 2y ago
  That's assuming the seed value is given to you at all, and not hidden inside a custom app.
- evanjrowley 2y ago
  Yes! That is exactly what I did in the aftermath of that iPhone 4S fiasco. I went though some iterations of Android phones and made sure I got the TOTP seed in the MFA app on both devices. Eventually I moved onto TOTP apps that can sync these and stopped worrying about it.

ggm 2y ago

> didn’t have backup codes ok. check. So.. the advice is maybe.. "always have your backup codes"

benwilber0 2y ago
oh shit I lost my backup codes. So now I'm just never allowed to use Uber again?
- andrewxdiamond 2y ago
  As long as you dont loose your backup codes and your MFA device at the same time, you're safe.
  - benwilber0 2y ago
    Well, hopefully you never lose your original birth certificate and your social security card! You won't be a citizen anymore!
    - shadowgovt 2y ago
      But unlike your original birth certificate and your social security card, you can keep an arbitrary number of copies of your backup codes in an arbitrary number of safe caches.
      - benwilber0 2y ago
        But what if I did't do any of those things? What if I made a mistake and didn't save my backup codes on 3 different types of storage medium (at least one of them offsite)? Or at all?
        3np 2y ago
        I mean, we just read about it, right? (: Harsh but let this be a lesson to set up a more resilient structure for yourself moving forward. Anyone can make mistakes. You can set up failsafes for your own ones pre-emptively. "2FA is garbage" is not the right lesson to learn here...

petcat 2y ago

This is also why stuff like blockchain-based currency will never be realistic or accepted in the "real world". We need the ability to fix things out-of-band. Like you said, people make mistakes. Imagine that your bank or credit card just says Tough Luck! Nah. Of course not. edit: Fuck Uber anyway

OutOfHere 2y ago
> We need the ability to fix things out-of-band. Out-of-band fixes require trusting banks, but how trustable are banks really? Often the banks do say "tough luck". This is why you should never leave much balance in an active bank account in the US. Credit card issues are more fixable, but only in the US. Regarding blockchain, it grants freedom in that you have the choice of trusting a third-party custodian, or doing self-custody. Having choices is good.
- petcat 2y ago
  So you've never had a credit card. Or any bank card at all where fraudulent usage is the liability if the bank, not you. How do you think that works?
  - OutOfHere 2y ago
    > So you've never had a credit card. Or any bank card at all where fraudulent usage is the liability if the bank, not you. That's some inapplicable and incorrect nonsense you invented right there. If you need help with logical reasoning to go correctly from A to B, then GPT can guide you.
    - petcat 2y ago
      How do you think that credit cards work? I assume you have one. Or bank cards. I steal your credit card and spend $80 to fill up my gas tank and then go buy a pair of sneakers, who do you think pays for that? It's not you. It's the credit card or bank company. And then they call and ask if it was fraud and you say "yeah, it was fraud. I was nowhere near a Foot Locker in Gary, Indiana." So they "reverse" it and they absorb the loss. It's how the entire credit financial system works. I'll send you some books you should read.

theo0833 2y ago

> I didn’t have backup codes for some of them uh oh...

shadowgovt 2y ago

I ran into this issue when I accidentally cooked my phone while on a trip out of town. Google wouldn't reauthorize me to log in because the phone that got cooked was my second device. ... So I fixed the problem when I got home. I don't put myself in a situation where losing one device completely ruins my ability to move around the country. That's just unsafe. It was, admittedly, inconvenient to not have easy access to everything my Google account locks against... But it's also convenient to not have to worry too much about hackers compromising my account if they manage to guess my password. I appreciate this level of security on something that I've routed way too many authentication keys through.

deleted 2y ago

[deleted]

CrendKing 2y ago

"Blame" 2FA for your own mistakes just sends bad message. How do people who are capable of setting up 2FA (therefore not tech-illiterate) still don't use password manager? Imagine storing either the 2FA secret or the backup code in it.

petcat 2y ago
2FA apps are a fundamentally broken auth mechanism. We just saw Microsoft's authenticator app inexplicably delete people's codes and lock them out of their accounts. And this is another example of how stupid the whole thing is. It's all for theater.
- OutOfHere 2y ago
  You're speaking nonsense. If you use a bad app, that's on you. There are plenty of 2FA apps that work just fine.
  - petcat 2y ago
    > There are plenty of 2FA apps that work just fine. Is one of them Microsoft Authenticator?
    - OutOfHere 2y ago
      > Is one of them Microsoft Authenticator? Hell no.

bxparks 2y ago

What would be the point of 2FA if a scammer can just email Uber to turn it off?

Dwedit 2y ago

TOTP on the other hand is completely fine. Encrypt your TOTP secret file just to keep it around, and enter the secret into your Firefox Browser (TOTP browser extension), and the android app "Secur". No third parties involved. Nothing to worry about if you lose your phone.

calmbonsai 2y ago

Uber effectively doesn't have customer service--or at least it hasn't for the past few years. You can no longer simply "call" and the out-of-app email is a chatbot ouroboros straight out of dystopian fiction. Think Gilliam's Brazil, but worse. After a few failed Uber pick-ups and one instance of a mysterious 27% post-ride "corridor fee", my policy moving forward was to simply no longer do business as a paying customer with any business that doesn't have actual customer support. This meant, among other things, migrating off of Google, a few brokerage accounts, and one national bank. Doing a "support test" is also now one of the very first things I do as a new customer of any company. So far, I have zero regrets. In a perverse way, I give Uber credit for providing the impetus for those decisions.

OutOfHere 2y ago
> email is a chatbot ouroboros straight out of dystopian fiction Hold on there. The chatbot may be dystopian, but an ouroboros is never dystopian. An ouroboros represents cyclicality, unity, or the eternal return, but not in a dystopian context of meaninglessness. An ouroboros is meant to grant a grand perspective, not to be a well of misery.
- calmbonsai 2y ago
  From a historic mythical standpoint, you're absolutely correct. I was using it as a topological (I guess technically graph-theoretic) metaphor for the self-consuming looping that was/is Uber's email support system. Over the course of 36+ hours, multiple "support agents" kept re-quoting either my responses or their own responses as "the newest escalation". It was hilarious and also sad. I just ended up doing a charge-back on the card.

amanzi 2y ago

Why do you care about an Uber account? Can't you just create a new account and start over? The accounts I care about are the ones where I've got important files or data stored in them.

petcat 2y ago
In USA, Uber accounts are locked to phone numbers. You can't just create a new account. OP is fucked.
- amanzi 2y ago
  Ah - interesting. I just created a new Uber account here in NZ and during the sign-up process I get this: "Enter your mobile number (Optional)". No need to enter a mobile number.
- reportgunner 2y ago
  Must you have a singular phone number in USA ? I don't see the problem.

OutOfHere 2y ago

> Never enable 2FA for accounts that you actually care about This is an extremely bad take for two reasons: 1. The author failed to store the 2FA Secret Key. This is exposed by any good 2FA app, but not by bad 2FA apps. The Secret Key must be backed up. A good 2FA app will backup everything easily with an encrypted password. 2. The author doesn't store or use backup codes for the app or site. In short, the author is completely irresponsible, and then has the audacity to give bad advice.

benwilber0 2y ago
Author here. Explain to me why I should be permanently banned from Uber because I accidentally forgot the secret key to log in to my account.
- OutOfHere 2y ago
  > Explain to me why I should be permanently banned from Uber You shouldn't, but your headline doesn't attack Uber, does it? Perhaps it should.
  - benwilber0 2y ago
    Do you think that you could get Google, or Github, to turn off your 2FA login requirement if you really needed it? Like if you lost your codes? Or never saved them in the first place?
    - OutOfHere 2y ago
      In general, if an account is associated with a phone number, then I expect to be able to use the phone number to restore access to the account. Uber looks to have failed you here. As for my Google and GitHub accounts, if they're not associated with a phone number or recovery email address, I fully expect to lose access permanently if I were to lose the codes. In such a case, I take responsibility for it.
      - 2y ago

Brian_K_White 2y ago

There is no such problem. It's not even the emergency codes. Those are just a silly misdirection all sites engage in. When you set up 2fa, you just save the seed value exactly the same way you save any other good random password you rely on a password manager to keep for you. It is exactly as difficult and exactly as easy and exactly as portable as the regular password. They just don't tell you that the number in the qr code is something you can keep and re-use exactly like the password. They lead you to throw that away and give you the stupid emergency codes instead. But just, don't throw it away that's all. It's the keys to your own kingdom. If you throw it away, yes, you can lock yourself out. One way you could solve that is by not having any keys, or another way is by just not throwing away your keys. You were never limited to any single magic device that better never break or get lost. You can have N different devices all generating the same valid current totp codes at the same time. You can set up a brand new device any time you want, if you just have any form of access to any copy of your password db. Flagging this was correct. What is wrong with 2fa is the way all the apps and sites don't tell users what the seed value is and don't tell them to keep it and thereby put the users into a risky position they never had to be in. It's criminal if you ask me, like a doctor or lawyer giving bad advice.