News for hackers. Stuff that matters.

A comment on YubiKey 4C. Parent comment

Re:YubiKey 4C by pfg on Monday February 13, 2017 @12:40PM (#13637135)
It's possible to disable SMS-based 2FA. Perhaps you need another backup option before you're allowed to remove the SMS option. In my case, I was able to do it with two U2F keys, TOTP and backup codes enabled.

You might need to remove it as an account recovery number as well. Those can effectively downgrade your login to one factor.

[ Parent | on HN ]
Re:YubiKey 4C by danjoc on Monday February 13, 2017 @03:42PM (#13638581)
>you need another backup option before you're allowed to remove the SMS option.

This was the answer. Google prompt isn't allowed with hardware tokens. Backup codes evidently don't count. So the only way is to set up Google Authenticator on a phone. Authenticator from f-droid works. After I set up Authenticator, I no longer got the "Something went wrong. Try again" toast when trying to delete the sms number.

Edit: Just realized what Yubico Authenticator is for :)

[ Parent | on HN ]