Hacker News Reader

I've noticed that multiple sites that have two factor enabled give you the option to add a device, but not list or remove existing ones (without wiping them all).

At a glance, Google does not seem to enable you to do this, but might actually do it behind the scenes anyways.

View on HN

I've seen some companies (Cloudflare springs to mind) which requires a support ticket to disable MFA on a user's account. It's a little tedious but does add an extra hoop for an attacker to jump through.

Google only allows one "device" at a time, as far as I know. Adding a new device invalidates all old devices.

When you set up a new device, it gives you a new seed.

If you want two devices for Google 2FA, you need to either: - scan the qr code on both devices at once - or write down the seed for later use

Google won't let you retrieve the seed later (to prevent people from adding a second device with 2FA without your knowledge)

Reply on news.ycombinator.com