Hacker News Reader

Comment by umvi | Hacker News Reader

Logging into an online account on a computer you don't normally use when you don't have your phone. This can range from "had to jump through a bunch of extra hoops" to impossible if you haven't saved backup codes ahead of time (Google).

My wife lost her phone when we were on vacation and it was literally impossible for us to login into her Google account in order to use find my Android.

We were trying to login on a relative's PC to use find my phone, but it was a catch 22 because we need a phone to login to Google on a relative's PC.

I pity the fool who loses their phone in the age of 2FA.

View on HN

I try to be disciplined about having critical information printed out, especially when traveling internationally. I expect more so than most people. And I do still carry a separate (small) wallet. But we're pretty much all increasingly dependent on our phones for more and more things.

ADDED: And thank you for mentioning that. I just realized I never transferred my Google authenticator setting to the new phone I got last year.

> I pity the fool who loses their phone in the age of 2FA.

This keeps me awake at night. Especially as it is no longer possible to contact humans at a lot of sites to prove who you are. I went to jail for eight years, when I got out I could only access two of the thousands of accounts I had made over the previous 20 years.

> My wife lost her phone when we were on vacation and it was literally impossible for us to login into her Google account in order to use find my Android.

This is a really frustrating situation.

My phone screen suffered a bad accident, to the level of unusable. 4 weeks for a repair.

I needed 2FA to access company services. Email, chat, VPN etc. Which of course, was on my phone.

I emailed IT Support from my personal email to request a temp token. My ticket was closed, with a message saying "Email tickets are no longer accepted, use the service portal."

I needed 2FA to access the service portal.

Luckily I had a co-worker on a non-company chat service, so they opened a ticket on my behalf...

I agree. My SO is nowadays so frustrated by all the security hoops and pseudo-security hoops like Gmail regularly stopping to work with her Thunderbird (she regularly needs to setup a new app specific PW). Other spps/sites sending SMS, others forcing you to use their app for verification and not one standard to get used to.

I am used to this from work but even there MS pesters me to install MS authenticator while I clearly always just use my regular 2fa solution.

And because I think the state of 2fa is not user friendly my own solution is not very secure by using Authy with a client on every device. So there is no second factor. I just copy paste from the app on my computer and don't need to grab my phone.

I can't really see this as the negative you imply it to be. This seems like complaining that you might get locked out of your house if you lose your keys. There are certainly better and worse forms of 2FA, but I would like more pervasive (well-implemented) account security, not less.

The main key is the password, and we didn't lose the password. What we lost is the secondary, rarely-used-key that you only need when logging in on a new device or at new location. So if you don't leave home much, it's easy to forget that your online account access is totally screwed without your phone anywhere else. My wife's Google account doesn't require TOTP to login, so she never needs her phone when logging in at home, yet the phone is mandatory when logging in for the first time on a new device or at a new place. This creates catch-22 situations for people unaware of this behavior like it did for us ("we need to login to find the phone but we need the phone to login").

We learned our lesson, but I'm sure there are tons of other people that haven't learned this the hard way yet (but will eventually). I could see this becoming an easy way to sabotage/get revenge on people - steal their phone while they are on a business trip/vacation and then they are locked out of all their online accounts with no way in unless they had the foresight to keep physical copies of backup codes in their wallet/purse.

A better analogy would be the locksmith refusing to let you in because you can’t produce the deed, which itself is in the house.

That's why Google often prompt you for backup information - backup phone number, email address, which can be used to recover an account if you've lost your phone.

There are ways to provide backup factors without tying them to more personal information, however.

There's always a tradeoff though. With more secure backup factors, the more likely it is that you could end up locked out with no recourse.

That's why you always copy the secret recovery codes for the 2FA(which may not be helpful if you left your notebook in your home country during vacantions).

Reply on news.ycombinator.com