Hacker News Reader

Comment by fidget | Hacker News Reader

If you loose your github 2FA, they will ask that you prove your identity by SSHing to some host and providing them with the token returned by that host

View on HN

I had recently reset phone and had lost my 2FA recovery codes. This was how I was able to recover my account.

Take a look at Authy as a drop-in replacement for your Google Authenticator app. Codes are encrypted and stored on Authy's servers -- they can be re-synced to your phone after a wipe. There's also a Chrome plugin that syncs with the mobile app.

How do we know it's encrypted in a way they can't see?

The same way you know (or don't) that your existing OTP app is not uploading your secret key.

You don't, but that's fine for my risk profile. I use LastPass, as well, with different passwords for every site and 2FA where available.

You can also have a backup phone number on most websites (google, github, dropbox).

If you lose your phone you call your carrier to block that sim card and request a new one anyway, so you're not locked out.

And how well does your carrier verify your identity?

Now this worries me, beacause in my country you just call to your carrier and ask the number to be deleted, you just need to provide your name, then anyone can cancel your number.

What country, may I ask?

Mexico

About my previous reply, that is if I recall correctly, I remember being able to cancel numbers of lost phones providing the number and the name of the owner (in this case, one time I lost my number, other times my dad lost his')

Reply on news.ycombinator.com