Hacker News Reader

Comment by bogomipz | Hacker News Reader

Interesting. Was your 2FA setup to use Google Authenticator or regular SMS? It's been a while since I used Google services but from what I recall from a previous company where we used Gmail was that the only way to do 2FA with Google Authenticator if you lost access to the phone was with a backup code you are given at 2FA setup time. Is that no longer the case?

View on HN

2FA with authenticator. As someone correctly points out, Google appears to keep SMS as a recovery option unless you specifically opt out?

Edit: I can't actually find a help article, but it's under "Try another way to sign-in" and they'll text you a verification code to your registered account phone number.

Just noticed that Authy’s answer to the FAQ of “ Is the Authy App Susceptible to a SIM Swap?” does not have the word “No” in it.

Does anyone know if Authy uses SMS for any kind of recovery? I don’t see an option in the security settings

https://support.authy.com/hc/en-us/articles/360012427914-Is-...

SMS is just used to sign in. Everything is encrypted, and you can't access any data without a password. If you don't have the password, you don't get the data. There is no recovery.

Your OTP secrets should be e2e encrypted if you set up a backup passphrase. Worst case: someone can download your encrypted seeds.

I’ll agree though that Authy’s docs are really ambiguous about account recovery.

Reply on news.ycombinator.com