Hacker News Reader

Comment by ocdtrekkie | Hacker News Reader

That's what backup codes are for, or backing up your 2FA app. Enabling 2FA is an acknowledgement that you expect to be responsible for maintaining access to your second factor: It's reasonable to require you still have it when you shut that off.

That being said, Google is far from being unique in this issue.

View on HN

In theory, yes, and I think most people here would store their backup codes properly. However, there are many people who don't store them properly, and don't think about it until it's too late. They lose their token, break their phone, or lose access in one of the many other ways.

Sure, you can say "tough luck", but then people will complain, reasonable or not, and Google probably doesn't want that to happen. I think this is a reasonable compromise when it comes to security and usability.

i know my life was flashing before my eyes when i logged out of my old phone and then my new phone asked for 2FA coz like a dumbo i stored the 8 codes in google drive...

If I have 15 sites in google authenticator is it such a win that 1/15th of them will allow me to reset without needing the second factor? Backing up the app or backup codes seems needed to scale to widespread 2FA use.

> Enabling 2FA is an acknowledgement that you expect to be responsible for maintaining access to your second factor.

On the other hand, articles all over the place increasingly recommend it to everyone.

> Enabling 2FA is an acknowledgement that you expect to be responsible for maintaining access to your second factor

Maybe to you and me, but to everyone else it's just a recommended (and in many cases forced) method to gain access to your own account.

My mum isn't making a pledge to always have her phone with her, she just doesn't want her email stolen

Reply on news.ycombinator.com