Hacker News Reader

Comment by Eric_WVGG | Hacker News Reader

This phone verification shit is so awful. I have two friends who moved overseas and disconnected their cellphone plans without thinking about their MFA situation.

Today I have to enforce MFA at the small company I'm working at, and just a month prior I held a cybersecurity seminar for them and explained that "phone MFA is… okay… but you should really use verification apps." But I didn't realize that you can't even enable authenticator-app-MFA with Google without doing it through a phone first… just infuriating.

View on HN

So I have used Authy, which apparently is somehow protocol compatible with Google Authenticator, and you can back up your tokens with a password. I got a new phone, installed the app, entered the password, and all my tokens were there.

which apparently is somehow protocol compatible with Google Authenticator

Nothing mysterious. Authy and Google Authenticator simply implement the same standard, RFC 6238.

https://datatracker.ietf.org/doc/html/rfc6238

I've moved from using Authy to Aegis Authenticator [0], it's open source and allows you to export an (optionally encrypted) backup of your OTP secrets offline. I trust that more than a cloud backup. Plus you can more easily migrate if Aegis ever goes unmaintained.

[0] https://getaegis.app/

TOTP ("Time-based One-Time Password") isn't exactly a "protocol", just a big random number as a pre-shared key plus a method for hashing that with the current time to produce a six-digit number. Whatever you're authenticating to does the same computation with the key and, if the result you provide matches the one it got, it knows you have the same key it does.

SMS 2FA is a different proposition, in that the authentication provider sends you the intended response directly. This is a little easier for nontechnical users in that it doesn't require an app that can compute TOTP responses, but it's markedly less secure in that anyone receiving or intercepting the SMS can immediately respond to the challenge, and less resilient in that you can't authenticate at all if you don't receive the SMS - which is the failure mode under discussion here.

I just installed Authy on my other Android phone and I need to login with my "phone number".... WTF...?

use aegis or keepassXC/Keepassium/Keepass2Android. These apps allow to keep (backups of) your (T)OTP secrets offline and don't require additional PII info to set up.

The problem is that one has to enable phone MFA before they can enable Authy/other-app MFA. I have no idea why, only theory I can come up with is the value of tying accounts to outside marketing databases using phone numbers as IDs.

That is the answer. Authy can be used on several machines at the same time. Totally rocks - and is free

So now your second factor is... the Authy master password?

Which is still strongly preferable to getting locked out of everything because Google Authenticator refuses to participate in device backups. Lucky for me I found out about that well before I moved to "2FA wherever possible", but I still had to send some vendors scans of my driver's license to get back into my accounts with them.

Maybe they've fixed that since then, but I don't care. I'd rather risk a theoretical flaw in Authy's E2EE than risk getting screwed again, and by now much more thoroughly, by the flaw I know about in Google Authenticator.

Ha. Happens to be there is a script out there somewhere which allows you to extract the private key of any of your MFA codes from Authy through Chrome DevTools (it's an Electron app) so you can use it in whichever MFA solution you want.

And the private key material Authy has in its database.

I moved across the country a few years ago, and just a few months ago got a new phone on a new carrier. For a brief moment, I considered getting a new number. No more spam texts and calls (or at least different ones)? Having an area code matching where I lived? Seemed like positives, and it'd take me about 10 minutes to email or text my new number to the relevant parties.

I hadn't considered MFA because I use Authenticator and have most of my TOTP seeds in 1Password anyway, but man I'm thinking I dodged a bullet because there are a handful of things that use SMS only.

> just infuriating.

I just bought a prepaid card only for this - Google, Facebook, Twitter, Instagram. I don't use it for anything else. I took it out and hope to remember to top it up for another year to keep it in service. It's so stupid.

Yup. You have to enable it, add property MFA, then disable it.

Because Google knows best.

Reply on news.ycombinator.com