Hacker News Reader

Comment by verandaguy | Hacker News Reader

I'm not defending this, but this could be seen as a way to increase usability — if you lose your 2FA token but you're still logged into a session, you can still disable 2FA and potentially re-add the token.

Obviously though, that excuse becomes an exploit the moment you change your tone of voice, so there's that.

View on HN

That's what backup codes are for, or backing up your 2FA app. Enabling 2FA is an acknowledgement that you expect to be responsible for maintaining access to your second factor: It's reasonable to require you still have it when you shut that off.

That being said, Google is far from being unique in this issue.

> Enabling 2FA is an acknowledgement that you expect to be responsible for maintaining access to your second factor.

On the other hand, articles all over the place increasingly recommend it to everyone.

> Enabling 2FA is an acknowledgement that you expect to be responsible for maintaining access to your second factor

Maybe to you and me, but to everyone else it's just a recommended (and in many cases forced) method to gain access to your own account.

My mum isn't making a pledge to always have her phone with her, she just doesn't want her email stolen

In theory, yes, and I think most people here would store their backup codes properly. However, there are many people who don't store them properly, and don't think about it until it's too late. They lose their token, break their phone, or lose access in one of the many other ways.

Sure, you can say "tough luck", but then people will complain, reasonable or not, and Google probably doesn't want that to happen. I think this is a reasonable compromise when it comes to security and usability.

If I have 15 sites in google authenticator is it such a win that 1/15th of them will allow me to reset without needing the second factor? Backing up the app or backup codes seems needed to scale to widespread 2FA use.

i know my life was flashing before my eyes when i logged out of my old phone and then my new phone asked for 2FA coz like a dumbo i stored the 8 codes in google drive...

Reply on news.ycombinator.com