Hacker News new | ask | show | jobs
by jacobsenscott 2175 days ago
I've lost my phone and been able to re-connect to every 2FA service I use without any need for human interaction. For google I was saved because my laptop was still logged in and I could turn google's 2fa off.

Basically everyone else has an "I lost my device" thing and a fallback to SMS codes or email links. This certainly weakens 2FA in general, but strict 2FA is unusable in practice.

1 comments

Just store your 2fa totp key or qr code or backup somewhere that is either protected by 2fa (password manager, online storage) , or is available offline (file cabinet).

Some online storage services have secure areas requiring 2fa to open which would be suitable.