Hacker News Reader

Comment by albertgoeswoof | Hacker News Reader

I lost my 2FA to AWS (my phone broke), now I have to provide:

1) A completed, signed, and notarized Identity Verification Form and Affidavit 2) A photocopy of the AWS account owner’s primary proof of identification, such as a State driver’s license or US passport. (note that I don't live in the US) 3) A photocopy of the AWS account owner’s proof of address matching the address on record (I don't live there anymore)

in order to stop them from billing me every month for resources I don't use.

I lost my MongoLab token as well, now I can only access my database over a connection string.

Now I don't enable 2FA, the chances of me losing my token are higher than the chances of me being hacked. And after 2 or 3 years I don't remember where my backup tokens are so that's not a realistic option

View on HN

This is why properly implemented 2FA provides backup codes when you first set it up.

I'm frankly glad that Amazon are requiring you to go to such lengths to prove your identity to bypass the 2FA and access your account. I think you should appreciate that they're taking the integrity of your account so seriously.

I only enable 2FA if it's TOTP or HOTP. In the case of TOTP I save the key (the data in the QR code) in my password manager (KeePass), in the case of HOTP my backup key is in my fireproof safe at home along with other important documents. That's admittedly a small portable box with a carry handle, so easy for a burglar to steal, but it's also easy to get to and I can take it with me if I ever have to evacuate or move.

I just made a couple of copies and stashed one in my house and the other at work. If the entire metro area burns down I'll be SOL, but for reasonable levels of disaster I should be able to manage.

Saving the 2FA key along with your password makes it a single factor. I just add every new key to my Yubikey (as well as FreeOTP on my phone), so I have a backup if one breaks (this is on top of the backup codes).

To quote the AWS ManPage[0]:

> We recommend that when you configure a virtual MFA device to use with AWS that you save a copy of the QR code or the secret key in a secure place. That way, if you lose the phone or have to reinstall the MFA software application for any reason, you can reconfigure the app to use the same virtual MFA. This avoids the need to create a new virtual MFA in AWS for the user or root user.

That's the nice thing about TOTP[1] ("Google Authenticator"); a single relatively short string can be backed up to later restore access, or you can even print the QR code on a black & white printer.

[0] http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentia...

[1] https://en.wikipedia.org/wiki/Time-based_One-time_Password_A...

My standing recommendation is printing that QR code on paper and not keeping any digital copy of it, as it does function like "your second password" for all intents and purposes. You really don't want your 2FA tokens synced anywhere online, or stored on any device someone could potentially break into over the Internet.

That QR code paper can be secured the old fashioned way: I recommend a fireproof safe. The fact that you'd have to compromise your physical security (either the phone or your safe) and digital security (your password) at the same time provides reliable 2FA.

The nice part about AWS MFA is that there's usually multiple people with IAM access. So rather than use backup codes, we rely on co-workers to help us resynchronize. It may not work for 1-man shops, but how many AWS accounts only have 1 admin?

I got a $20 fire-resistant lock box just to keep my backup codes in, written down on index cards.

It was a huge pain in the ass to go back into all my accounts and get the codes. In many cases, I had to reset 2FA to get the codes. But now that I've done this, it's easy to keep up when adding 2FA to an account, and I no longer have the anxiety of worrying about getting locked out of important accounts.

Another idea I've been considering is a separate password manager account (from a different provider) just for backup codes. It would have a really hard password and 2FA stored on paper.

Completely unrelated to 2FA... but what kind of fire-resistant lock box did you get? I'm looking into something like this for the same reason.

The failure modes of 2FA and what happens when a token is lost or breaks are definitely one of the pain points.

I'm not a fan of the "back up recovery token" approach, as if you only need the backups once every couple of years, a lot of people (myself included) are likely to misplace, forget where the tokens were.

My current approach is TOTP with sync via iCloud, so the tokens are available on each of my mobile devices, so unless I lose all of them I should be ok.

Of course that provides a weak point (my iCloud account) but there's always a tradeoff somewhere.

Good! That actually makes me feel really good about their policies. Weaker ID requirements result in people social-engineering their way into other people's accounts.

Your particular situation might be a bit more annoying since all you want to do is close the account, but how does AWS know that? For all they know, you could be a malicious person trying to delete someone else's data.

Coincidentally I set up 2FA on Amazon yesterday. I am disappointed they do not give you backup codes, nor do they support FIDO U2F. I made sure to keep a copy of the secret token in case anything happens to my phone I can set it up again. The way I do it is to scan the barcode in a reader first, save the token, then scan it in an authenticator app to install it.

For me I opened a ticket and they verified few questions and address on phone and was cleared on 2FA , in fact I wiped my phone forgot about gauth few times had no issue with aws

you should always have at least two keys (devices) just as you always have at least two sets of keys to your home or car. same for u2f tokens.

Reply on news.ycombinator.com