Hacker News Reader

Comment by JonathanBeuys | Hacker News Reader

That's the problem with 2FA as it is done these days. The second factor is not under your control. It begs the question if 2FA makes your setup more secure or less. In this case, it backfired.

People are trusted with their own keys to their apartments, cars and houses.

Will we ever trust people with their own keys to their social life?

View on HN

Google forced 2FA for (all?) accounts earlier this year. I turned it off immediately, because I was more worried about losing access than someone guessing my password (besides, Google has other mechanisms already in place like IP checks or new device checks). I can't believe Google would activate 2FA on all accounts. It seems too easy for it to go wrong for normal people.

I relogged into gmail recently and no 2fa was required.

You must have disabled it some time back.

There are a couple of options to fix this: - Use QR code and save the image to another secure store (I save them in KeePass) - Use an MFA program that allows you to back them up or restore to a new device (I use Authy)

And what if you somehow lose access to your password manager?

Make a script to send the Keepass database you your email weekly.

WAIT

There's a big difference between Google (which will lock you out for no good reason, or ban your account without stating a cause, and has no support or appeal process) and 1password (which AFAIK doesn't randomly block/ban accounts). You can still forget your password to either, but one is clearly safer.

I'm personally using KeePassX, and so, all I need is the kdbx password safe file, the key file, and software that opens it. The password file has backups, and is synced to multiple locations; the key file too, and it's something I can re-download from the internet from multiple locations; and there are multiple implementations of the software for different platforms. So for myself, I don't worry about this angle.

As an alternative, I read that other people print their password list from time to time, and put it in their actual safe or a bank's deposit box.

Same, but I use a master password for my kdbx file so I don’t have to worry about yet another file.

Yes, this is what I do as well.

Reply on news.ycombinator.com