Hacker News Reader

Comment by PeterisP | Hacker News Reader

> especially with phones that are harder to backup than they should be.

That's interesting, my experience with a physically destroyed Android is that I didn't lose any data without any backups other than the default settings, since apparently all the apps that I use sync to cloud by default, without me needing to configure any backups, and use local storage only for caching, so all the apps, settings and data could be automagically restored.

View on HN

My fear is that your phone is also the primary MFA device, so losing that could mean you can't log into your account anymore (and therefore can't restore the cloud backup)…

Google offers to back up Authenticator, should you choose to do so.

Which defeats the purpose of MFA, since your Google account becomes your only factor.

Sorry, I should be clearer: to login to Google on a new device, you typically need to accept a prompt on an old device. But if your old device is dead, that's not possible. Authenticator does TOTP and things, which is typically not adequate for logging in (even though it _should_ be).

I'm not using Google Authenticator or anything like that but when my old phone dropped somewhere at the bottom of a river all my banking apps, which do 2FA, had a way to let me start again on my new phone. Services that don't assist their users in a disaster recover scenario are severely lacking.

Yes they are, and yet they exist.

The prompt on an old device is just one of the MFA options you can use. You can also use a security key (e.g. Yubikey, Solokey, etc.).

This was my worst fear but I had opted-in to backup Authenticator with Google. Opting in to backup your data with Google is seamless and it also restores stuff like SMS messages.

But I suppose this is one more thing the anti-trust case against Google should probably be looking into. Should Google be allowed this deep integration with their cloud services?

Handing your data over to Google's cloud is the sanctioned option, but I prefer an SD card and local backups to another device.

Reply on news.ycombinator.com