Hacker News Reader

Comment by flurdy | Hacker News Reader

So 2FA reset via SMS is bad, which I agree but what are the alternatives to prevent a meltdown when your 2FA device dies?

I have had two phones die on me that was my 2FA device, plus OS upgrades, so I have gone through resetting 10-20 2FA accounts a few times. Though with upgrades usually I foresaw that and downgraded my 2FA before hand.

All I wish for was that resetting 2FA would be a very very slow step by step process and spammingly broadcasted to all emails, sms, postal etc associated with the account. But I know for cost cutting customer services departments that wont happen.

View on HN

Most major providers like GitHub, Google etc allow you to create "recovery" codes - so you can do a one-off login without 2FA using the code.

I've started getting a recovery code for each of my major accounts, printing it out, then literally putting it in a safe.

I use 2FA code generator in cloud-synced 1Password. That endures all software upgrades, unlike Google Authenticator or Authy.

TIL. Thank you.

If all this information is in 1Password then I guess you are back down to one factor - your 1Password master password. Which may be ok with you. Just pointing it out.

If you use an Android phone that's rooted, you can use Titanium Backup to copy your Google Authenticator app data between devices. It's up to you to copy that data somewhere else, but it is a very low level alternative to storing everything in 1Password or similar.

Even without rooting, just do that that next time when you register for 2FA, save that QR image, or screenshot it, and/or save that 16+ chars string somewhere safe, same as where you save passwords. Phone died/changed/lost? Install Google Auth, rescan that QR/Screenshot.

2FA systems have a code that serves as the seed for the token. If you keep this code you can set up 2FA on a new device any time you want without having to reset it. Just be careful securing the code.

I've had this happen with Microsoft/Office365. Lost access, couldn't get the recovery email. They sent emails and made me wait a day or two before resetting things.

Reply on news.ycombinator.com