Hacker News Reader

Comment by savingsPossible | Hacker News Reader

If anyone got afraid and wants to disable 2fa, go to

https://myaccount.google.com/security

The trick isn't to disable 2FA. It's to add a bunch of 2FA methods that don't rely on your cell phone: authenticator app, yubi keys, backup codes.

This is terrible advice. Please don't ever rely on authenticator apps. Try changing your phone, resetting your phone or losing your phone and watch yourself get locked out of your accounts with absolutely no recourse.

Isn't that the point of enabling multiple methods? So that the others can be used as backups? Or does enabling multiple 2fa methods potentially out you in a situation where if just 1 method is unusable you won't be able to log in?

TOTP can also be used from a PC with something like KeePassXC, and you can have the DB sync to other devices with SyncThing (including your phone where you can access them with KeePassDX). Much better than SMS which really is tied to your phone (or SIM, rather).

I chuck all my totps on my wifes phone as a backup. Google Authenticator lets you export the lot as a single QR

I agree, auth apps actually work relatively painlessly for day-to-day (especially if someone else supports them, like at work), but for me at least, as a personally managed last resort they turned out horrible. If something happens to the device(s), you're screwed. Even SMS is better, because at least you can move the sim or eventually recover your own phone number on a brand new device, even if the old one vanished. And yes, I know SMS's can be hijacked in some cases (like by a malicious mobile app) but for personal stuff there has to be some sane recovery, and Google does not give you one easily.

Swapping SIM cards to a new phone often doesn't work. Did you not read the OP?

> So my phone has been failing to charge for three weeks and I bought a new phone today and can't get it set up because the old one is dead and I can't get a verification code. So I moved the old sim card on the advice of one of my sons and the codes are still going to the old physical phone and Google says it will send me a link in 72 hours.

Wait. make a photo of QR code and send it to your spouse. Put it on her Google photos or facebook (make it private). Very unlikely both of you lose phones on the same day.

There are authenticator apps that backup up your 2FA accounts. I've been using Authy for years and have switched phones at least 5 times with it. I believe the Microsoft authenticator app also backs everything up to your Microsoft account.

"Ways we can verify it's you" seems to be limited to 1 email and 1 phone number now.

Yall need to post screenshots. I do not believe you

https://i.imgur.com/hENFQtG.png

As seen in the image, nearly 10 years, never a single issue, and there's not a chance of someone compromising one of my active 2FA options.

If you don't have 2FA enabled, it seems that Google will now sometimes arbitrarily choose a previously logged in device or previously associated phone number and require 2FA through those, so having it disabled can be even more dangerous.

Reply on news.ycombinator.com