Hacker News Reader

Comment by arkh | Hacker News Reader

I'd like to see another article showing the steps to go through if you lose your keys.

This is my biggest concern about 2FA. On Google I have TOTP 2FA enabled, with my phone number as a backup. But everything goes through my phone - I'm not really worried about some stealing my phone to gain access, but what happens if I break or lose my phone.

A few years ago I was travelling abroad and had my suitcase stolen - which had my laptop (with FDE) and passport inside. Fortunately I had my phone and wallet on me, otherwise I really don't know what I would have done - I probably wouldn't even have remembered the name of the hotel I was staying at that night.

Google allows you to print a set of codes [1] that can be used to access your account if your device is lost. I printed a set and have them stored in a secure place at home. Some people keep them in their wallet/bag/similar.

[1] https://support.google.com/accounts/answer/1187538

According to [1]

  Advanced Protection uses a stricter implementation than
  Google has offered in the past: Only those physical 
  keys—along with a password—will unlock your account. If
  you lose them, you can't use a printed out backup code

So, no printed backup codes for Advanced Protection users!

That's the text making me want a follow-up article.

(Presumably your [1] reference is this: https://www.wired.com/story/google-advanced-protection-locks... )

Good point, although I think the parent comment was about Google's existing 2FA rather than the new advanced protection setting.

Yes I have those printed and stored securely, and also my landline set as a backup phone number, but that doesn't really help alleviate my concern of "what happens if I'm abroad and no longer have access to my phone".

I guess keeping the codes with my at all times would work, but doesn't seem like that great an option (paper is easy to lose and easy to destroy). Maybe I should memorize some of them?

When setting up TOTP you can copy the private key (basically the QR code) to a secure storage so you can restore it if your device gets lost or stolen.

However, Google Advanced Protection uses only U2F, not TOTP, so that isn't an option if you're using the advanced protection.

I'm using an alternate OTP app called andOTP that lets you make AES encrypted backups. I save the backup file inside my password manager.

I've been using U2F where possible for about a year, and I have a secondary Yubikey registered everywhere I have the primary registered.

I am going to be switching to a USB-C one soon, though, and it only now occurred to me that I haven't really been keeping a "list" of all the sites where I've got them registered. Right now, not a lot of sites support it so it won't be too tough to find them. But I should probably be keeping a list so I at least can be sure when I've definitely replaced registered the new Yubikey in all places the old one was registered.

That doesn't really address your question as to what happens when you lose your keys, but it's perhaps relevant that there are a few warts around replacing even keys you haven't lost.

You register more than one key, and use your backup. If the site lets you in without one of the keys you registered, it's a security theater :)

Google states there is a process to go through if you lose both keys that takes up to 3 days. The question is, how strict is this, and how easy is it to lock yourself out.

You use a less convenient backup authentication.

The specifics depend on the use case, but even if you fall back to something less secure like an email and TOTP, you still come out ahead overall because most authentications are done by U2F.

Yeah. That is the million dollar question.

Reply on news.ycombinator.com