Hacker News Reader

Hacker News

Comment by ckdarby | Hacker News Reader

Full thread

ckdarby

I doubt it being hundreds of hours.

Most will require two government IDs to be sent in to remove 2FA and 1-2 week process to review & confirm.

Moving forward you should look at Yubikey where you can with the backup being your phone via Authenticator app.

View on HN

You can already do backups with Authy but I think OP's issue is for SMS-based 2FA which is still very common.

Don’t you need your phone number to authenticate with Authy to get into the backups?

No. That might be a possible backup, but the usual way is any current logged-in device + password.

Uhh, if you need a currently logged in device to bypass the phone number login, then I wouldn’t say it’s a “possible backup”. Phone number is the primary authentication mechanism for Authy.

If you have “Allow Multi-Device” enabled, your keys are stored on Authy’s servers. You simply download Authy on a new device, sign into your account and you are done.

How do you sign into your Authy account? For me, it asks to send an SMS to my phone.

Huh? I use Authy because it allows me to use TOTP codes, from multiple devices, including devices without cell service. I switched to it from Google Authenticator specifically for that reason.

Okay, so how do you sign in to Authy if you don’t have another signed in device handy? I believe the only options are phone call or sms.

> SMS-based 2FA which is still very common

It's not like it's showing any signs of going away either, financial institutions even are newly implementing it.

SMS is not suitable for 2FA. It has a massive "help desk" hole that is obnoxiously easy to exploit. SMS is only useful as a proof of stake, IE something you do to initially set up a second factor to prove that you have some skin in the game, but not as the second factor itself. Honestly, even that proof of stake stuff is separate from setting up 2FA, it's mostly about slowing down botnet signups.

There are times where SMS 2 factor is worse than no 2 factor at all. Common number porting attacks allow an attacker to be far more convincing to the support staff when they call to say that they forgot the password but still have access to the second factor.

>Most will require two government IDs to be sent in to remove 2FA and 1-2 week process to review & confirm.

I've never heard of this. If I lose my number, can I still regain Google account access by mailing my info in?

No. Google will lock you out forever.

Reply on news.ycombinator.com