I have 2FA set up on three dozen different and important online accounts, and it's all through the Google Authenticator app on that iPhone.
Is there a recommended way to go about this problem?
Or have I locked myself out of my entire life?
There are two possible outcomes from contacting support for a service, asking to regain control over a 2FA-protected account, both which sucks, but on different levels.
1. You write them, proving who you are, and they tell you to get lost unless you have the 2FA proper codes, or backup codes. This sucks because you still didn't get access.
2. You write them, proving who you are, and they give you access to your account, so you can reset 2FA. This sucks because this means the service is not secure and you/others can be "hacked" because customer support can be exploited.
Backup codes come from the service which is 2FA protected anyways, not from the 2FA authenticator itself.
Edit: oh, reading your message again, are you referring to SMS-based 2FA? I assumed TOTP 2FA in this submission. If you mean SMS-based 2FA, then yeah I agree, makes your account less secure than not having 2FA at all.
If your phone based code system is also available on other accounts, and you can access those other accounts without the phone then maybe. However many people only have a phone, and no other computer (or at least not a computer they use often enough that we can trust the 2fa isn't expired).
The 2fa I've seen mostly has a SMS based fallback, and thus is no more secure than SMS.
Well, you could if you want to. That you don't want to, is a failure on your part, not on "everyone"'s part, since most phones do offer you the feature of setting a sufficiently secure password.
> However many people only have a phone, and no other computer (or at least not a computer they use often enough that we can trust the 2fa isn't expired).
You don't need a second device in order to backup your codes. By leveraging "cryptographic splitting" you can divide a secret into N parts and share them with friends and family, and if you need to regain access, ask them each for their part back and then you can recover from there. Now I guess that's kind of advanced so most people won't/can't do that, but it is possible at least. You could try something like https://iancoleman.io/shamir/ if you're curious about the process, I've done this myself for some things.
Easier solution is to create a encrypted archive with your backups, and upload to various cloud services. As long as the encryption scheme is secure, you'll be safe.
> The 2fa I've seen mostly has a SMS based fallback, and thus is no more secure than SMS.
I'm using TOTP 2FA for 100% of every service I use and that offers it. I think only one requires SMS-based fallback, the rest are optional so obviously I'm not using that.
You mean that you specifically do not have a secure password on your phone because you chose not to. The rest of us use finger print sensors or facial recognition to make our devices as secure as can be. Your argument applies only to you and a handful of people.
The SMS fallback is always combined with your finger print in all applications I've used.
Disable biometrics when handing the phone to somebody else or even remotely (e.g. mark as lost via “find my”).
Good compromise of usability and security.
I never use biometrics to unlock my phone or computer for that reason.
thanks! i always wondered
If this situation happens you can rapidly press the home button with the wrong finger and the phone will demand a pin code. Or you could turn it off. I don't know what recourse people with face unlock have.
I think you’re overextrapolating from your experience. I‘ve used Face ID on my phone for 5-6 years now, and the fingerprint sensors on my recent devices have been very reliable.
The password itself was generated randomly and I managed to memorise it (it took a while).
Loss of a phone with a 2FA authenticator app isn't a security problem, unless one failed to make backups of the 2FA secrets for restauring.
... or re-initialize 2FAs from their original seeds, which are typically hidden under a "set up manually" option during the enrollment process.
I'm concerned about the online accounts for which I don't have backup codes.
Is this a bad way to do backup?
Similar functionality can be had from 1Password[5], if you're into the more fancy experience. As a bonus this approach makes it very easy to store all those backup codes that totp services often give you. Won't help your current predicament but will prevent it from happening again :)
3: https://github.com/PhilippC/keepass2android
I carry a backup with me strapped to my wrist. It is a cheap digital watch with a strap modified to securely hold a microSD card with all my really important, must have data ---encrypted with Bitlocker. This data is as safe as I am.
I leave a copy of this card in a fireproof safe at home. A trusted family member has the combination. A friend has the Bitlocker decrypt key. My will brings these two people together to obtain access to the data in case of my demise.
Twice a month, I swap the two cards and update the one I will carry with only the changed info using a xcopy batch script.
My Android phone also has my 2FA keys using FreeOTP+ with an access code and backup capability.
I keep the backup from FreeOTP+ on the memory cards along with a little Windows CLI utility of my own making that can read this backup and generate 2FA codes as needed.
I'm fairly confident I won't ever be totally locked out of my accounts.
If you are locked out without a backup, your only realistic option is to contact each service provider and follow their instructions.
curious, how long have your microsd cards been working for, and have you experienced any bit-rot / bad blocks yet?
The first thing I do with any new memory card is reformat it. Many (if not most) cheapo, off brand, Chinese cards won't even format properly. Either the stated capacity is being faked outright or the card was a factory reject with bad blocks that shouldn't have been sold. Do not buy --- end of story.
In any case, my xcopy update script will totally rebuild the backup from network source if I decide to replace one of the cards with a new empty one. I replace at the first sign of trouble but this has only occurred every few years.
Insert a microSD card into a USB port (using a card reader) and Windows will prompt for the decrypt key if encryption has been applied. Once the correct key is provided, the drive can be accessed just like any other.
As for the strap, the card holder is a 3-D printed extension inserted inline with it. I'll try to upload a photo someplace and post a link to it.
https://link.shutterfly.com/isWBFWNm0xb
This shows two views --- the normal outside and inside/back with a microSD card partially inserted. The card latches in place using the notch built into every microSD card.
I've toyed with the idea of selling this completely assembled as a "data watch" for say $30 as a practical geek toy --- but there probably isn't enough demand to justify the effort.
This includes things like switching from github to sourcehut for me (though MS+copilot didnt help either)
For services where you cant avoid it (e.g. your company email), download a local OTP app, effectively converting back to 1FA, for each device you use to access that service.
2FA is a cancer and needs to die. Mandatory-phone-based 2FA doubly so. The only thing mandatory phone 2FA has done for me is it gives websites an excuse to make a phone a "necessary" field, so now I get spam/scam on my phone as well as my email.
I completely agree about the phone authentication, it's bullshit meant to get your phone number in your profile. SMS is obsolete as a security measure.
FWIW, this is the reason I use Authy, it works nicely with backup/restore. Beware that Authy has a cloud backup/multi device function that I personally keep off. Another option would be 1password, though I’d personally won’t mix passwords and 2fa codes in the same app.
Assuming the worst case where you can’t recover the codes, and assuming it course you never stored the offline codes, you have to go through the process of recovering 2fa.
This usually requires submitting documents that prove who you are, and waiting 1-2 weeks. So the only recommendation is to begin this process asap.
And while you re-setup 2fa make sure you either keep a backup or use an app that works when you backup+restore your phone, Im sure others will provide more options. Good luck!
My old phone died and I had no way of getting into some of my 2FA secured accounts a while back and it was a wakeup call that eventually led to using Authy.
I'm not sure what avoiding Google Authenticator has to do with that. You can store the keys separately for any TOTP app. That's kind of inherent in the way TOTP works.
https://www.protectimus.com/blog/google-authenticator-backup...
If you really want to be superstrict, you can have one KeePass database with your passwords, and another, with a different master passwords, for your TOTPs. It's less convenient, but it still stays completely under your control.
Except for Apple, which rolled their 2FA in their own, incompatible way... for your convenience and safety, of course.
"Go back in time and save the raw secrets" might as well be a certain-fingered emoji to basically literally everyone.
At this point, the only hope is getting webauthn everywhere and train people to always enroll a primary and backup token.
If you don't have the backup codes or the one-time codes, you're going to have a problem and you'll need to contact the services to somehow let you in or take off 2FA. Depending on what the service is, it might get very tedious.
sqlite3 /data/data/com.google.android.apps.authenticator2/databases/database \
'select email,secret from accounts'
Does it block you from taking a screenshot? Maybe you could screenshot it and then zoom in the gallery app.
If you can get a copy of that QR code off of the small device using the photo trick, besides using it to import your accounts to Google Authenticator (GA) on your new device you might consider extracting the codes from the backup so you can store them someplace secure separately. That way you can use them to set up TOTP apps other than GA.
Here's how you could do that. First, you need to get the QR code from GA to something that can read the QR code and display its contents. The text in the GA code is otpauth-migration://offline?data=... where the ... part is apparently a base64 encoded Google protocol buffer.
Once you've got that otpauth-migration URL this program that showed up when searching for information on those URLs can help: otpauth [1].
otpauth --link otpauth-migration://offline?data=...
otpauth -qr --link otpauth-migration://offline?data=...
Going forward, save those PNGs somewhere secure (I use an encrypted tar file). Any new accounts you set up save the QR codes for those as PNGs and add them to your collection. If you keep that collection up to date you will be able to readily handle any device updates or replacements readily or adding new TOTP apps.
That it has become standard makes me think the inventors/providers have not thought it through.
My solution, trust in 1Password and it's encryption, I have access to my 2fa anywhere I need but it a computer, phone, tablette.
Soon it will be passkeys and they'll be safe in the 1Password vault, no worrying about losing the device w/ the keys again.
Putting second factor material in password managers is terrible advice. For reasons unknown to me, it might be the right solution for you. But in general, it defeats the two factor authentication purpose if you reduce the factors again to knowledge alone.
The whole point of tfa is, that the second factor is something you possess and not something you know (which is the first factor).
For the more common attacks I expect to encounter, namely a single password being leaked, a password manager is still based on something I "possess" (to an extent) - the decrypted password vault. It's separate from the single password that's likely to have been compromised in the most common scenario.
Of course, if my whole vault is compromised, then yes, storing my 2-factor in there made my life worse than the alternative. I just don't see that as anywhere near as likely a scenario as an individual account being compromised. Having 2-factor enabled in a less secure method is still better than not having 2-factor enabled at all.
Basically, there's nuance to this, it's not the extreme you present - a more in-depth comment on this: https://security.stackexchange.com/questions/150448/is-it-se...
Little did I know, backing up the Google Authenticator app doesn't preserve the config, so all my codes were gone.
Apparently most services don't mind and will let you disable MFA via email confirmation.
One notable and unlikely exception was OVH - luckily I had backup codes, so I didn't have to present them my id.
You do have those backup codes, right?
Backups, password managers, now 2fa backups, all things that people just cannot seem to care about until it's too late
iPhone has a built in 2FA code generator.
HTTP://TOTP.app is a web app that stores 2FA codes. Awesome to use. But you have to remember to download and back up the codes stored in TOTP.
Microsoft Authenticator used to be my favorite because it would sync phenomenally well.
In the following order, I would rank the 2FA code generators:
1. iPhone (especially if you are using iCloud password manager).
2. totp.app (you can use it even on desktops and every device you possibly have)
3. Microsoft auth (it only backs up to iCloud on iPhone. On android it backs up to an MS account. Can’t be used on desktop).
Depending on the service, you have locked yourself out of that service. I screenshot and store 2FA codes on paper because too often I lost my codes because of Terrible unreliable apps.
Also: Didn't you backup the 2FA codes somewhere else where you can "sync" them in?
I use Bitwarden Authenticator for 2FA (part of Bitwarden Pro) and it syncs my 2FA codes to all devices where I log on to Bitwarden. That way I avoid a single point of failure. Consider that the next time around :)
As a meta-comment on this thread itself... That even people here on HN can enable and make use of 2FA incorrectly is the reason it will never be a viable way to protect accounts for "everyone and their grandmother".
It's too complex, and we need something better.
The recovery codes as implemented are not useful backups for most people. Telling people to use them is the wrong answer.
Sadly I know the above, but I don't have a better solution. It is a hard problem.
I'm concerned about the online accounts for which I don't have backup codes.
How does one securely restore their secure measures once their devices are lost?
Assume you lost your phone, laptop is also gone and your house burned down and your papers are gone with it.
I personally symmetrically encrypt my ssh keys and send them to my wife every six months or so. I also send them to a burner gmail account I use basic password auth with.
In a chaotic moment I can just ask my wife to download the file from her email and I can decrypt and ssh into my server where I store all files and important things encrypted.
curious, how do you store that key?
If I don’t or can’t recall it then I’m dead or may as well be.
Google's doesn't have an export AFAIR. If rooted you might be able to import to Aegis.
Oh right, an iPhone. And you lost the phone? You're screwed
You can only try to to get the 2FA removed, but for AWS this process is hard, others might be OK... Or unreachable, like Google. Ive been through this, but luckily kept backups in another accounts, just had a hard time remembering the password under stress. My devices were stolen from my home.
With adequate proof and justification I think you should be able to get back your accounts, that is if your service does allow you to get back your account. One tip is to have multiple phones for 2fa and then just not using the other phone, if you don't use it how can you lose it? (that's what I did since I lost it once).
We really need a third party service that allows you to walk up, have some DNA taken, verify you are who you say you are, and then unlock accounts in these cases. We can have the government do it, they have all our DNA anyway!
I always register new authenticator accounts on all 3 of them.
If you have to use TOTP codes be religious about saving your backup codes. Otherwise, using multiple security keys means you can recover from losing one, with the bonus of phishing protection (since they can't be tricked into supplying your codes to the wrong domain).
It was in my hand one second and then I got out and it wasn't.
I've had to contact each organization I have 2fa with and get 2fa reset through personal identification measures.
For my company that meant a quick zoom call. For banking that meant driver's license scans and photos of me.
You'll have to work with your 2fa providers.
If you have the recovery codes and got access again, then you can get a bit more redundancy in your system by also setting up security keys such as a Yubikey. These keys can be added next to your authenticator app(s).
Low-tech compared with all the other suggestions here, I should look into how to extract/store the actual seed values instead, etc... but it works for me and has done for years.
Google authenticator is great, until it wipes out all your entries. It did that a few years ago for reasons unknown, so I moved to 2STP (which is now unavailable).
Also, the app you use should have an apple watch app, so at least if your phone dies you can use your watch to authenticate.
Providing any services that I don't have backup codes with identity documents solve the problem. Never had issue with any service but it's annoying.
You can prevent this for the future by pretend you can read the QR codes and getting the secret string allowing you to set up across multiple devices.
Your best best would be contacting support for individual accounts and hoping you have enough historical information to be approved access.
Without those options, now that you lost the only second factor, you have to reach out and convince the service providers that you're you. Good luck.
If not, you can try reaching out to customer service after you get a new SIM card.
For banking and everything else IRL, you can just walk up to the teller with your ID.
Not a single point of failure.
Restore the backup of your phone which you have locally in iTunes, or in iCloud.
(And, before you lose it, take a backup)