Hacker News Reader

Comment by havo | Hacker News Reader

This is terrible advice. Please don't ever rely on authenticator apps. Try changing your phone, resetting your phone or losing your phone and watch yourself get locked out of your accounts with absolutely no recourse.

View on HN

Isn't that the point of enabling multiple methods? So that the others can be used as backups? Or does enabling multiple 2fa methods potentially out you in a situation where if just 1 method is unusable you won't be able to log in?

I agree, auth apps actually work relatively painlessly for day-to-day (especially if someone else supports them, like at work), but for me at least, as a personally managed last resort they turned out horrible. If something happens to the device(s), you're screwed. Even SMS is better, because at least you can move the sim or eventually recover your own phone number on a brand new device, even if the old one vanished. And yes, I know SMS's can be hijacked in some cases (like by a malicious mobile app) but for personal stuff there has to be some sane recovery, and Google does not give you one easily.

Swapping SIM cards to a new phone often doesn't work. Did you not read the OP?

> So my phone has been failing to charge for three weeks and I bought a new phone today and can't get it set up because the old one is dead and I can't get a verification code. So I moved the old sim card on the advice of one of my sons and the codes are still going to the old physical phone and Google says it will send me a link in 72 hours.

I chuck all my totps on my wifes phone as a backup. Google Authenticator lets you export the lot as a single QR

TOTP can also be used from a PC with something like KeePassXC, and you can have the DB sync to other devices with SyncThing (including your phone where you can access them with KeePassDX). Much better than SMS which really is tied to your phone (or SIM, rather).

There are authenticator apps that backup up your 2FA accounts. I've been using Authy for years and have switched phones at least 5 times with it. I believe the Microsoft authenticator app also backs everything up to your Microsoft account.

Wait. make a photo of QR code and send it to your spouse. Put it on her Google photos or facebook (make it private). Very unlikely both of you lose phones on the same day.

Reply on news.ycombinator.com