Hacker News Reader

Comment by znpy | Hacker News Reader

this is extremely important: just yesterday I forgot my phone at my university (luckily it hasn't been stolen) and realized that i was cut out of most services that use my phone as second authentication factor.

View on HN

Print out the backup codes, and keep them in your wallet (or a safe at home). You should do that, anyway, in case your device gets stolen. Most sites which use 2FA tell you to do that right when you enable 2FA.

^ This. Print your QR codes and put them in the safe.

It's best to have the codes on multiple devices. Might not help in the short term ie 'left my phone and won't be home to use my tablet until 9'.

But in the event our phone was stolen, it can get pretty tough to recover some accounts once you've set up 2fa. If it's not, then there's really no point in having 2fa on the account at all.

EDIT: Also of note, If you don't have a second device, a yubi key will store all the codes on the key. So any phone/laptop with the yubico auth app will be able to show the codes if you wanted to use that for a backup.

Well, the kind of 2fa that simply sends you a text message, once you get a new phone with the same phone number, you're back in. Which can happen pretty quickly.

But yeah, I think there are probably a variety of 2fa nightmares that we'll only start encountering/discovering in the near futre, some amount of time after 2fa reached critical mass.

if your services doesn't provide fallback options for 2FA (TOTP/SMS/paper codes) I'm inclined not to consider enabling 2FA at all, it's just too risky.

I dislike sms since the most likely device I own to get stolen is my phone. Also, the codes aren't sent to your locked secured phone, they are sent to your SIM card.

Paper codes are the same as having a second device with TOTP, you probably won't carry them with you everywhere (both should be an offsite backup).

Get a pebble! You can have TOTP codes on your wrist where it's a lot harder to lose.

Presumably similar apps available for Android Wear and Apple Watch, but those are too smart for my tastes.

Authenticator Plus[1] has an android wear view, but it goes into lockdown mode if your phone is offline. Luckily (but also insecurely) it also supports regularly backing up two factor codes to google drive with gpg encryption, for when you crack the digitizer on your phone and need to get a new phone.

   1: https://play.google.com/store/apps/details?id=com.mufri.authenticatorplus&hl=en

Kickstarter idea: a pebble, but just as a 2FA, on your wrist.

Wasn't there some RSA authentication fob you could attach to your keys a while back? It generated keys like Google Authenticator and worked without internet thanks to the magic of RSA.

EDIT: RSA SecurID[0]

[0]: https://en.wikipedia.org/wiki/RSA_SecurID

RSA is the company, the RSA algorithm isn't involved in this product. It actually uses a TOTP [1], a variant of HOTP.

Here's the famous Blizzard authenticator in the manufacturer's original branding [2], from a competitor. There are others like this.

[1] https://en.wikipedia.org/wiki/Time-based_One-time_Password_A... [2] https://www.vasco.com/products/two-factor-authenticators/har...

Right, my mistake. I wasn't sure when I was writing the comment. When I made the edit, I forgot to change the "magic of RSA" part

That reason is why I have my various 2fa credentials available from my computer as well. Problem is that I have some that either use a text message or the Authy API, which has abysmal desktop support.

I put all my 2FA credentials into my Yubikey as well. Plus, if I lose it, you have to guess my PIN in three tries, otherwise the secrets get deleted.

Reply on news.ycombinator.com