News for hackers. Stuff that matters.
Re:Still locked out of my AWS account by cookiecaper on Friday July 07, 2017 @01:27PM (#14720222)
Google Authenticator is a bad 2FA app. Authenticator+ costs a couple of bucks but has many features that make it much easier to use, including the ability to back up an encrypted copy of your 2FA keys (standard disclaimers about risk of compromise to this file, yadda yadda yadda). When you change phones, you just download that, decrypt, and pick up where you left off; no hassle trying to replace the 2FA generators, which is a PITA when you have one 2FA, let alone going through that process for several accounts.

If you're going to use Google Authenticator anyway, at least unlock your bootloader before you initialize the identities. You can't get to the key database without being rooted, even if you're doing a full backup with adb, and unlocking/relocking the bootloader wipes the device.

Re:Still locked out of my AWS account by sipos on Friday July 07, 2017 @02:19PM (#14720725)
Mobile phone authenticator apps are not that great anyway. They rely on the security of a phone that is connected to the net to keep the keys secure. If someone can get code running on the phone and exploit a privilege escalation vulnerability to get root, they can read the keys. A hardware token like a Yubikey or similar is probably more secure.

Another problem with the Google authenticator, at least for Google accounts, is that you have to add a phone number to your account to use it I think and, they then allow access by SMS, which is not so hard to circumvent.

Re:Still locked out of my AWS account by sowbug on Saturday July 08, 2017 @03:15AM (#14724511)
You can remove the phone number once you add another 2FA method, such as U2F (Security Key) or TOTP (Google Authenticator or other TOTP app).