4 ms·

Yubikey or equivalent. You don’t necessarily need a second phone. You may need a second phone number in your home country that you can get calls and SMS anywhe

Yubikey or equivalent. You don’t necessarily need a second phone. You may need a second phone number in your home country that you can get calls and SMS anywhere. VOIP services such as Google Voice, Hushed, Skype work, but test first because some banks etc. won’t accept VOIP numbers. I have travelled full-time for over 12 years. I carry one phone, an iPad, have three email accounts, two US numbers (Google Voice and Hushed), a local number wherever I stay (e-SIM), a Yubikey and backup key. Have never needed a second phone.

dheera 2y ago
> banks etc. won’t accept VOIP numbers Use a VOIP number in the UK, they usually can't tell. If you want a bulletproof solution for a US number though, spend $10/month for an additional SIM card and bona fide mobile number that goes to an separate, eternally stationary mobile device in your home country that forwards SMS to your e-mail or some other UI you can access from a public internet terminal, in case your phone is stolen, bricked, or held hostage.
- gregjor 2y ago
  You can do that with a “real” Twilio number and skip the second phone. All of my US banks and credit cards accept VOIP numbers now. A few did not when I first started traveling.
  - dheera 2y ago
    Most of my US banks work with VOIP numbers. Chase, for one, does not.
    - gregjor 2y ago
      I have Chase credit cards, they accept my Hushed number. Don’t have a Chase bank account. I use Schwab, they accept VOIP numbers.
      - dheera 2y ago
        Interesting, I only have Chase credit cards as well, and they don't take any of my Twilio numbers, or at least, they accept the number but I don't actually receive SMS codes.
        gregjor 2y ago
        I've had the most success with numbers from hushed.com. Google Voice usually works but not as reliably in my experience.
- red369 2y ago
  Some of these ideas are really becoming a rabbit-hole for me. I like the idea of forwarding SMS to email, but then you need an email provider who will never prompt for some sort of 2fA just because you're outside the country or on an unfamiliar device, and an always-on mobile device. The email provider who will never ask for 2FA to get in might be harder than it sounds. I've heard a story which I believed at the time, of Gmail not letting someone in without approving on an old device, even with the password and correct TOTP. Something odd like SDF could work here. I suppose the always-on device should have no battery. I once had an HTC smartphone that would power on with the battery remove, but would sometimes crash. I think people who run postmarketOS do something to not require the battery, but soldering seems to usually be involved. USB 4G modem, old laptop with built-in 4G? Edit: Just adding that I'm a big fan of SDF.org, so would love if that turns out to be the least messy solution!
  - dheera 2y ago
    > email provider who will never prompt for some sort of 2fA Or just forward it to a simple webapp that you design that runs in the cloud and only requires a password to login > I suppose the always-on device should have no battery. That might make you vulnerable to power outages. If you are worried about Lithium batteries being at 100% for an extended period of time, Samsung tablets (and probably phones) can be set to charge to 80% and stop.
fragmede 2y ago
But how many times have you had your phone/ipad/laptop get stolen/mugged for/lost, or all three, and how did you recover/break back into your digital life? If you've never needed a second phone because you've never lost the first/had it stolen/been mugged for it, that recommendation may be less relevant for someone that habitually loses phones.
- gregjor 2y ago
  > how many times have you had your phone/ipad/laptop get stolen/mugged for/lost, or all three I lost my iPhone in a taxi once. Had laptop die once. Not at the same time. > how did you recover/break back into your digital life Bought another phone, logged into my iCloud account with password and 2FA to my GMail account, got the code on my laptop. For catastrophic losses like you describe you should have the MFA backup code(s) printed and stored somewhere safe. I keep them with my passport and a backup copy on a secure USB key. I avoid having all of my stuff in the same place at the same time. I don't travel to/live in places where I have to worry about having my things stolen, or getting mugged. Can happen anywhere but some places have much higher crime rates than others. I didn't mention MFA backup codes, but anyone using MFA at all should print those out and have a couple of copies in safe places.

dheera 2y ago

> banks etc. won’t accept VOIP numbers Use a VOIP number in the UK, they usually can't tell. If you want a bulletproof solution for a US number though, spend $10/month for an additional SIM card and bona fide mobile number that goes to an separate, eternally stationary mobile device in your home country that forwards SMS to your e-mail or some other UI you can access from a public internet terminal, in case your phone is stolen, bricked, or held hostage.

gregjor 2y ago
You can do that with a “real” Twilio number and skip the second phone. All of my US banks and credit cards accept VOIP numbers now. A few did not when I first started traveling.
- dheera 2y ago
  Most of my US banks work with VOIP numbers. Chase, for one, does not.
  - gregjor 2y ago
    I have Chase credit cards, they accept my Hushed number. Don’t have a Chase bank account. I use Schwab, they accept VOIP numbers.
    - dheera 2y ago
      Interesting, I only have Chase credit cards as well, and they don't take any of my Twilio numbers, or at least, they accept the number but I don't actually receive SMS codes.
      - gregjor 2y ago
        I've had the most success with numbers from hushed.com. Google Voice usually works but not as reliably in my experience.
red369 2y ago
Some of these ideas are really becoming a rabbit-hole for me. I like the idea of forwarding SMS to email, but then you need an email provider who will never prompt for some sort of 2fA just because you're outside the country or on an unfamiliar device, and an always-on mobile device. The email provider who will never ask for 2FA to get in might be harder than it sounds. I've heard a story which I believed at the time, of Gmail not letting someone in without approving on an old device, even with the password and correct TOTP. Something odd like SDF could work here. I suppose the always-on device should have no battery. I once had an HTC smartphone that would power on with the battery remove, but would sometimes crash. I think people who run postmarketOS do something to not require the battery, but soldering seems to usually be involved. USB 4G modem, old laptop with built-in 4G? Edit: Just adding that I'm a big fan of SDF.org, so would love if that turns out to be the least messy solution!
- dheera 2y ago
  > email provider who will never prompt for some sort of 2fA Or just forward it to a simple webapp that you design that runs in the cloud and only requires a password to login > I suppose the always-on device should have no battery. That might make you vulnerable to power outages. If you are worried about Lithium batteries being at 100% for an extended period of time, Samsung tablets (and probably phones) can be set to charge to 80% and stop.

fragmede 2y ago

But how many times have you had your phone/ipad/laptop get stolen/mugged for/lost, or all three, and how did you recover/break back into your digital life? If you've never needed a second phone because you've never lost the first/had it stolen/been mugged for it, that recommendation may be less relevant for someone that habitually loses phones.

gregjor 2y ago
> how many times have you had your phone/ipad/laptop get stolen/mugged for/lost, or all three I lost my iPhone in a taxi once. Had laptop die once. Not at the same time. > how did you recover/break back into your digital life Bought another phone, logged into my iCloud account with password and 2FA to my GMail account, got the code on my laptop. For catastrophic losses like you describe you should have the MFA backup code(s) printed and stored somewhere safe. I keep them with my passport and a backup copy on a secure USB key. I avoid having all of my stuff in the same place at the same time. I don't travel to/live in places where I have to worry about having my things stolen, or getting mugged. Can happen anywhere but some places have much higher crime rates than others. I didn't mention MFA backup codes, but anyone using MFA at all should print those out and have a couple of copies in safe places.