News for hackers. Stuff that matters.

A comment on YubiKey 4C. Parent comment

Re:YubiKey 4C by danjoc on Monday February 13, 2017 @12:24PM (#13636968)
Can you disable SMS on google? I've tried and have been unsuccessful. Phone is required to enable 2FA. Once that is enabled, I can add yubikeys. After adding yubikeys, I am unable to remove phone as a 2FA alternative.
[ Parent | on HN ]
Re:YubiKey 4C by pfg on Monday February 13, 2017 @12:40PM (#13637135)
It's possible to disable SMS-based 2FA. Perhaps you need another backup option before you're allowed to remove the SMS option. In my case, I was able to do it with two U2F keys, TOTP and backup codes enabled.

You might need to remove it as an account recovery number as well. Those can effectively downgrade your login to one factor.

[ Parent | on HN ]
Re:YubiKey 4C by danjoc on Monday February 13, 2017 @03:42PM (#13638581)
>you need another backup option before you're allowed to remove the SMS option.

This was the answer. Google prompt isn't allowed with hardware tokens. Backup codes evidently don't count. So the only way is to set up Google Authenticator on a phone. Authenticator from f-droid works. After I set up Authenticator, I no longer got the "Something went wrong. Try again" toast when trying to delete the sms number.

Edit: Just realized what Yubico Authenticator is for :)

[ Parent | on HN ]
Re:YubiKey 4C by tptacek on Monday February 13, 2017 @12:34PM (#13637066)
Yes: delete your phone number.
[ Parent | on HN ]
Re:YubiKey 4C by nickik on Monday February 13, 2017 @04:49PM (#13639091)
I was also unable to do this, but I tried earlier today and it worked.

You have to have TOTP and Backup keys. Maybe this is a recent change.

[ Parent | on HN ]
Re:YubiKey 4C by niij on Monday February 13, 2017 @02:10PM (#13637843)
You need a software token (Google Auth) or backup codes before removing the phone number.
[ Parent | on HN ]