Hacker News new | ask | show | jobs
by _wldu 1981 days ago
Have one email account on your domain (example.com) and use that for everything important. Use a long random password for the account and don't 2FA it. Share that with your family. That's probably all they need to gain access and reset your other accounts.

If you 2FA the email account, you risk locking you and them out permanently for many services. I've written some about this. If you care to read it:

https://www.go350.com/posts/now-they-have-2fa-problems/

Also, if you 2FA other things and aren't really careful, you may lock them out even if they know the password and/or are able to reset it. That is by design.

This problem is growing larger every year as more sites enable or mandate 2FA. It's impossible for humans to manage this at scale.

1 comments

I don't buy the "don't use 2FA" argument.

My partner knows how to unlock my phone. She can read the eventual SMS (I know, it's insecure, but still the only 2FA method in many US bansk), she will receive the email with the eventual password reset on the phone, she can use my authenticator apps. She also knows about my Yubikeys and where they are stored.

She also has access to my laptop, where backups for the above are stored.

Even with TOTP, it's trivial to set up the same key on more than one device at the same time.
And what the manual unlock codes?
What manual unlock codes? You mean the TOTP backup? It's documented. But she won't need if she has the rest.