Hacker News Reader

Comment by nelaboras | Hacker News Reader

My big mistake was to use 2FA - more precisely authenticator.

Around the same time my old phone broke and i had to change the password.

I must have mistyped the password while changing it in both fields and since then have never managed to re-access the account. I have old passwords, backup email, previous contacts, phone, ... But i cant restore the password because i hadnt yet set up authenticator on my new phone.

My fault? Probably. But that there's no way out, no option beyond the horrible restore wizard - that's Google's irresponsibility. How many millions must have lost access to their gmail accounts by now?

View on HN

Backup codes and use of Authy (running on phone and desktop), instead of Google Authenticator, can help in such situations.

Authy on desktop sounds like such a terrible idea, though. Take that second factor and put it right next to the first.

How is this any different from what you have on your phone?

If someone hacks your phone they have access to all your email, whether you have 2fa set up or not. If someone hacks your computer in this case then they also get access to all your email.

The thing that 2fa is good at is preventing hackers from logging in if they guess or find out your password. If your device is compromised then everything you do on it is vulnerable, no matter how many factors you have.

Not sure I get it. 2FA does not protect anyone from someone having your password AND having your phone or desktop.

It prevents from someone, somewhere, having your password but not your 2nd factor.

If someone manages to put software on your desktop then they have access to your password and 2nd factor.

I mean, it's game over in pretty much any situation that your endpoints are compromised.

It's incorrect to take these measures as giving perfect security. They're efforts to greatly increase the cost for attackers. It's a pretty good improvement to increase effort from "having a password" to "having remote access to your computer."

I'd still rather they didn't have direct access to my second factor in that situation.

But that’s your phone too. The second factor, is practice, having access to an active session on your device.

Alternatively if you dont want your keys stored in Authys cloud, you can replace Authy with AndOTP and export your keys in to an encrypted file which can be imported later back in to your phone when needed.

That's wahat I did for a while, but I heard Aegis takes security more seriously than AndOTP, so I use that now (both are available on F-droid).

AndOTP has some support for SteamGuard (though not everything), which I can't use since I refuse any proprietary app on my phone.

I wish websites supported PAKE, Fido U2F, Webauthn, TOTP and Client certs across the board, but that's probably a pipe dream :)

Reply on news.ycombinator.com