Hacker News Reader

Comment by jrochkind1 | Hacker News Reader

I use authy (free) for 2FA TOTP and have it set up on my work laptop, my home laptop, and my phone. As long as least one of those is still good, I should still be able to get in.

I honestly don't know what's going on behind the scenes to know if this is not as secure as it "should" be. But this was my reaction specifically to the non-SMS TOTP 2fa: Wait, if I lose my phone there's literally no way possible to get in? Oh there is, if I have the backup codes... yeah right, you think I can hold on to backup codes? Surely there's something I'm missing, what is everyone else doing here? Oh, everyone else is just hoping they never lose their phone? Really?

View on HN

> As long as least one of those is still good, I should still be able to get in.

Google has, in some cases, started requiring auth codes sent to specific devices, even if you're already using your own configured TOTP 2FA.

Correct. I have a fully bricked tablet because of this.

They expect that none of your devices will ever die? This makes no sense.

It makes plenty of sense to Google: engineer for the 98% use case and the remaining 2% should just go away and stop wasting their time.

100% of devices will fail, eventually. It is kicking the can down the road.

Hey it worked for the UNIX epoch, till those guys retired.

They're banking on you upgrading your device before it dies, as opposed to e.g. accidentally dropping it onto pavement and cracking the screen.

Had that happen to me, I was saved by still having the backup codes + having some unholy Tasker + Pebble automations that let me operate the phone without display - enough to launch AirDroid, use it as remote display/input to enable ADB over WiFi, and then finally use scrscpy over ADB as a remote display/input that doesn't blank out on security screens and in Google Authenticator. Only at this point I was able to transfer all the other TOTP entries in Authenticator to the new device.

Lesson learned: 2FA with TOTP is a responsibility to be taken seriously, despite what security professionals would make you believe.

Enable debugging on your phone preemptively, then you can remote display over USB :).

Doesn't matter, if the current people can get promoted. Problem is for future Googlers </sarcasm>

Many things are designed by roughly the same kind of people in roughly the same area. They are blind to a lot of use cases. Besides, it's a government's mandate to cover edge cases. Businesses only do it when compelled.

I had a similarly frustrating issue happen with PayPal, only they were refusing to let me log in with my YubiKey, insisting on SMS. But their phone system couldn't send a message to me by SMS. It errored before it even tried, because I could have gotten a code on that phone if they had actually sent it.

If I've agreed to use and keep track of a very small physical device to access my account, don't be going letting any ol' person who can access my phone number in there!

I have uninstalled Google applications from most of the mobile devices that I use for this exact reason.

Same! It was such an aggravation

Google will send you codes to devices that don’t even have the app installed. Ask me how I know.

use AndOTP with QR code from fdroid. Go to account settings in desktop browser and remove the phone as 2FA. It will not ask any code to device.

Google somehow seems to think I own this device despite it not being one of the devices on my account.

Wait, what? How does that work?

It doesn't :P

> Google has, in some cases, started requiring auth codes sent to specific devices, even if you're already using your own configured TOTP 2FA

This exact situation has been such a thorn in my side at my company lately. Does anyone know any way to disable this behavior, even just with Google Workspace accounts?

I've still yet to see a single bit of proof of this outside of claims from people who couldn't bother to do the things you're supposed to do when setting up 2FA. I remain skeptical.

All these claims and not a single screenshot of this scenario. Meanwhile I've been in 4 countries in 8 weeks and Google hasn't bothered me once beyond the normal "tap my yubikey on my keychain".

> work laptop, my home laptop, and my phone

There’s a fire or gas explosion or earthquake or something, and you need to leave all those behind. What do you do?

> Oh, everyone else is just hoping they never lose their phone? Really?

I would be very, very surprised if that’s not what the vast majority of the population is doing. Many people have a phone as their _only_ computing device, and no printer, and don’t really understand why they should be carrying around scrawled codes in their wallet.

> What do you do?

I get screwed!

I guess the right answer is that I have the backup codes carefully preserved.... off site! In case of natural disaster. Every time I sign up for a new account, I print out the backup codes, and take them to an off-site secure storage location, which of course i have... somewhere.

There's no way 90%+ of internet users are doing that.

I'm not even going to pretend I have any chance of doing that.

Ah, I see we both have a more similar view than I thought!

I really should be storing some codes for my password manager somewhere…

Although not as safe as a printout, I keep codes encrypted on a couple of flash drives, one stays in a drawer and one that's always on my person with my keys, yubikey etc. Haven't needed the codes thus far but feels like a decent compromise.

Note that flash drives typically use the absolute cheapest NAND cells available and I'm not sure what their shelf life would be...

That's a fair point, maybe I should have some SSD backups in addition to cloud backups.

90% of people just enter their phone number and call it a day because for most people it works just fine (barring simswaps hacks etc)

for the rest there are other options.

> I have the backup codes carefully preserved.... off site

Yeah f no. Most people just screenshot their backup codes and put it in a Google doc somewhere in plain text, at best. And at worst, they go "what the hell are these codes" and close the window.

Which, security-minded folks would know, is effectively equivalent to just writing passwords down in plain text.

Nobody thought to put even a tiny speck of product management into this system.

Considering that Authy relies on an SMS OTP for the account creation (and possibly account recovery), I prefer to use something else that provides the benefits of cloud syncing across devices and isn’t tied to a phone number. I understand that SMS OTP is simple for most people to handle (encouraged by many platforms over the years), but I just cannot get past that barrier to choose Authy over something else for personal use.

I'm literally only using it for things that require it. (including heroku, and rubygems). My thinking is: how do I meet this requirement with the least likelyhood of later locking myself out forever, and having HN threads blaming and shaming me for not carefully preserving my backup codes in a firesafe crypt?

If someone wants me enough to target Authy with an SMS reroute attack focused on me, they're gonna get me either way. I'm not Ed Snowden here, I'm just a guy trying not to lose his car keys.

But, what's the thing you use that provides the benefits of cloud syncing across devices and isn’t tied to a phone number? For anyone that might be interested, including me if it seems as easy and as idiot-proof. (and free or cheap).

I recently switched my laptop and my phone together, even though I have the same number, I cannot recover my account. SMS is better because even if you lose your phone, you can get a replacement sim card. Only if SMS is enough. In the case of Google accounts, no, it is not enough.

Also, it's kinda like Google corrupted 2FA TOTP's workflow : it should work on any device that implements the right algorithm and secret key. Instead Google sometimes turns it into MFA tied to a specific mobile device.

When that happens, Google asks to confirm with a known mobile device even though I have specifically configured 2FA TOTP since 2012 to be device independent (and I currently use keepassxc or mobile equivalent to generate the totp value). Google subsequently doesn't allow login by any other method and if the required device is lost or broken you lose access.

Most password managers has 2FA TOTP support these days so your OTP will be available on all devices that has your password manager installed.

Password managers usually have a comment field where you can store the backup codes.

Reply on news.ycombinator.com