Hacker News Reader

Comment by AdmiralAsshat | Hacker News Reader

I switched to Authy some years ago. It took Google forever to add the ability to Authenticator to let you migrate 2FA codes to new devices, and even then, it was only Google codes. I got tired of having to deactivate 2FA on my 20 or so accounts, switch to my new Android device, reactivate 2FA, and then scan the QR codes on the new device. Authy made it a painless experience, particularly since I could verify codes were working on the new device before factory resetting the old one.

View on HN

IIUC the Authy "feature" where it allows you to transfer 2FA codes to a new device defeats the purpose of 2FA. That is, if someone gets access to your Authy account they'll get access to your 2FA codes. This has been used to steal cryptocurrencies from users in the past:

https://www.newsbtc.com/2017/06/03/coinbase-recommends-users...

True, but you can enable/disable the multi-device feature at any time. So you can theoretically just turn it long enough to port your codes over to the new device, confirm that they work, and then de-authorize the old advice from the account and turn the feature off.

I ended up doing as much when I lost my Android tablet at a bookstore on which I had Authy installed. It gave me a mild panic attack at the time, but, a year later and none of my accounts have been hacked yet, so, I have to hope that the other security measures on the device were enough to thwart the potential thief/adversary.

I use Authy, but God, I hate their UI and UX. Finding the accounts there is a pain in the ass, and for some reason, I always end up with duplicated accounts (when I just added them once). Also, it has been two months since their last iOS update, so it's not like Twilio is taking care of it either.

Give andOTP a try[0]

[0]: https://github.com/andOTP/andOTP

I love andOTP, it does one job and gives me (not my phone's firmware) control over the secret storage.

Agreed. My biggest complain is the sorting of the list, a very simple thing to fix. I mean, how come I can't change the order of some accounts on some platforms? I only login to my tax account once a year, but on the desktop app it is first alphabetically so it's always at the top. Meanwhile, I login to my vpn multiple times a day and it is alphabetically at the bottom. So, I've had to start prefixing names with bullshit just to get them in a convenient order. It's like they don't use their own product or they'd notice this flaw very quickly.

I went to Authy and then to Yubikey. I can get to my OTP from just about any smart phone now or even my desktop.

What do you do in the event you lose your Yubikey?

You hope that you have printed backup codes for whichever services provide it, or alternative auth, or you go through ID verification to regain access.

Not much else you can do, the point of 2FA is that you can't get in without it.

Some services let you store multiple keys. So you can own a separate yubikey that you keep in a trusted place eg deposit box.

Yubikey recommends "having a backup device and registering both with your accounts". I vaguely remember some people saying that they have a backup Yubikey that they keep in their safe deposit box, so that it's as safe as possible.

Does anybody do this? I've read that as well but it doesn't make sense to me. How do I add my backup device if it is in a vault somewhere? For that to be useful I would have to have my backup device on me so I can add new accounts, but then that defeats the purpose.

I could see this working for a few very secure logins, but if the idea is to two factor everything it doesn't seem tenable.

No, your backup device need to be stored until you need it, not with you all times.

you add your main device and your backup device.

than you store the backyup device, after having it configured on your accounts, in the safe and use the main device to authenticate on a daily basis.

when you create a new account you add your main device and than when possible retrieve the backup device from storage and add the new account to it and store it back again.

on the event of you loosing your main device you retrieve the backup device from storage, use it to authenticate and remove your lost device from your accounts.

You can then acquire a new one key, add to all your accounts and store the backup in a safe again until needed.

Safe deposit boxes aren't that safe.

Can't speak to the OP but I have multiple yubikeys. One I carry with me all the time, and at least one backup, which I keep somewhere safe. Most sites allow you to register multiple keys.

Another approach is to have your phone as the daily 2FA device and the yubikey is the backup.

Multiple YubiKeys/FIDO authenticators. Registering them can be an issue. I haven't checked since last year, but the only website supporting them that allowed me to associate more than 1 to an account was Google.

You know you can have OTP on YubiKey and app on authenticator app on phone or laptop. Then you just connect your key to device and you are independent from a device.

I save each OTP config on three separate Yubikeys using Yubico Authenticator. I also screen-shot the QR code and save that and any recovery codes to a veracrypt volume.

If the site allows for UTF I register each key for that too, but only if I can also use OTP since I can't yet use UTF with my android phone.

I have two of them. In the event that both are lost, I still have my recovery codes in a safe.

Have more than one yubikey (I have one for home, one for work, and one in a safe deposit box)

Do Yubikeys have a shelf life? Something akin to a usb flash drive?

I'm guessing that the lifespan is longer than the security of the algorithms it uses.

I actually associated a Yubikey to my account because I was so annoyed at this problem. I wanted a better backup plan than the physical printed codes idea. I didn't realize that a better 2FA app would have solved this :P

Not everything supports Yubikey/FIDO U2F at this point, so that wouldn't work for everything, although I do have one. My Gmail account itself is behind a Yubikey (and a a backup Yubikey), not a 2FA app, because I'm trying to avoid a Game Over scenario. The Gmail address is the recovery address for my password manager account, so getting that pwned is basically the keys to the kingdom for every other account.

I realize not everyone wants to leave Gmail, but another reason I'm thinking of using tutanota aside from e2e encryption is you can create a second user that's tied to your master account. You can reset the passwords of your sub accounts from the main accout if they are compromised.. of course you have to pay for multiple accounts though.

The weird thing is: Yubikey was the only option for me in Gmail. Only after I associated a Yubikey with it, was I able to also use an authenticator app.

Does anyone know if this is normal behaviour, and if so, what the reasoning behind it is?

That's weird, probably a glitch. TOTP is the basic option.

Having printed access codes in your safe doesn't seem worse than a backup Yubikey in your safe? Maybe better, since electronic devices can break.

Either way, put it in a tamper evident envelope in the safe.

The QR code you scan is stored in app's db, you can use generic scanner to get the code and save it on paper or another encrypted DB or extract them from the Google Auth app SQL DB - if you have root access.

Good luck getting root access on a US Snapdragon Samsung phone. IIRC, they physically damage themselves in some way if they detect that they've been rooted, which then caps the battery from ever going beyond 70 or 80%.

I'm interested to read more about this, do you have a source for it?

That seems like it would be just asking for a world of warranty returns and support nightmares for whatever company built it into their phones.

Here's the only quick source I could find about the battery being capped while rooted: https://www.xda-developers.com/sampwnd-root-galaxy-s8-snapdr...

I'm pretty sure this was implemented across their phones after the Galaxy Note 7 debacle. I think the idea was that anyone who tried to root their devices and avoid Samsung remotely deactivating them would at least be prevented from charging the battery to full, which could cause the battery swelling/overheating/fire-catching problem.

I'll have to do more digging on the quote I remember about Samsung phones physically blowing a circuit somewhere if they detect they've been rooted.

> I'll have to do more digging on the quote I remember about Samsung phones physically blowing a circuit somewhere if they detect they've been rooted.

This sounds like the ODIN QFuse.

These aren't really particularly dramatic- they're tiny, microscopic "fuses", designed to blow cleanly and easily. Most devices have plenty of them- used to lock the devices down after manufacturing.

Blowing one of those fuses because a device thinks it has been rooted is pretty extreme though, no? (If this is in fact happening.)

To follow up on this (in case you see ever see this comment) - I don't think that the linked article suggests that rooting the phone -permanently- damages anything. To me, that reads more like "the phone's bootloader checks to see whether it's booting a signed kernel. If not, it tells the battery controller to limit charging capacity until the next boot."

In this particular case, it was probably a safety thing on that particular phone. I bet that Samsung pushed it in a firmware update because of their "batteries catch fire" issue, which was fixed with some patches to the kernel driver. Chances are this was intended to make sure that somebody running an unsigned/homebrew kernel (which might or might not have the patched charge-controller drivers) wouldn't be able to make their battery catch fire.

Source

TitaniumBackup does the job quite nicely if you're rooted, transferred codes through 4+ phones so far.

Reply on news.ycombinator.com