Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

2FA includes fallback methods, at a minimum a small set of one-time codes. There are paths out of the problem, at costs such as carrying the codes, or having somebody guard them for you (yes, obvious risks)

It is possible to train another device to be Google Authenticator, its a QR exchange. So, selection of which second factor is material here: it can be the device you own, or it can be the TOTP. Its not either/or, it can be both, you pick which.

(not a googler btw. Just a happy 2FA adopter since S/Key)



I don't have 2FA for my secondary Gmail accounts. So Google doesn't offer a Google Authenticator app option to use QR exchange to recognize the new device.


I don't understand this sentence. the account you DO have 2FA on should offer more than one 2FA mechanism, and the printout of the backup security codes.

I also don't understand why you don't have 2FA on your secondary gmail accounts, but that isn't material to the point: Any google account which does have 2FA should (as I understand it) support multiple modalities of 2nd factor simultaneously so you don't get cut off simply by losing a phone, if you enable the alternates. I mentioned two, there is the third, the yubikey type option which I think is now in general release, but comes at a $cost.

Maybe I misunderstand something in the points you're raising. Maybe its a nuance of the loss of the primary device and the use of backup recovery accounts, but the way I read it, the backup account recovery path is AFTER you explore alternate 2FA paths to account recovery.

I have my TOTP on two devices because I kept the QR code to bootstrap and also used the migration tool in google authenticator. I also have them in BitWarden. And I have the security one-time codes printed out. At this point, loss of a single device in the two I have to authenticate with is an irritation. This kind of feels like a 3-2-1 story: three forms of authentication, two online, one offline.


> any google account which does have 2FA should (as I understand it)

Are you talking from experience (with Gmail) or just talking "best practices"?


From personal experience. I have two @gmail and a hosted by google and all of them show me both device and totp enabled. afaik it came for free. Admittedly I turned 2fa on as soon as it was GA years ago and did not have it automatically applied so maybe the backup codes and TOTP thing is different.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: