Beyond Passwords: 2FA, U2F and Google Advanced Protection

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by fyfy18 on Thursday November 15, 2018 @06:00AM (#18458359)

This is my biggest concern about 2FA. On Google I have TOTP 2FA enabled, with my phone number as a backup. But everything goes through my phone - I'm not really worried about some stealing my phone to gain access, but what happens if I break or lose my phone.

A few years ago I was travelling abroad and had my suitcase stolen - which had my laptop (with FDE) and passport inside. Fortunately I had my phone and wallet on me, otherwise I really don't know what I would have done - I probably wouldn't even have remembered the name of the hotel I was staying at that night.

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by andyjohnson0 on Thursday November 15, 2018 @06:32AM (#18458469)

Google allows you to print a set of codes [1] that can be used to access your account if your device is lost. I printed a set and have them stored in a secure place at home. Some people keep them in their wallet/bag/similar.

[1] https://support.google.com/accounts/answer/1187538

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by michaelt on Thursday November 15, 2018 @07:19AM (#18458640)

According to [1]

  Advanced Protection uses a stricter implementation than
  Google has offered in the past: Only those physical 
  keys—along with a password—will unlock your account. If
  you lose them, you can't use a printed out backup code

So, no printed backup codes for Advanced Protection users!

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by andyjohnson0 on Thursday November 15, 2018 @08:02AM (#18458906)

(Presumably your [1] reference is this: https://www.wired.com/story/google-advanced-protection-locks... )

Good point, although I think the parent comment was about Google's existing 2FA rather than the new advanced protection setting.

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by arkh on Thursday November 15, 2018 @08:01AM (#18458899)

That's the text making me want a follow-up article.

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by fyfy18 on Tuesday November 20, 2018 @01:33AM (#18492185)

Yes I have those printed and stored securely, and also my landline set as a backup phone number, but that doesn't really help alleviate my concern of "what happens if I'm abroad and no longer have access to my phone".

I guess keeping the codes with my at all times would work, but doesn't seem like that great an option (paper is easy to lose and easy to destroy). Maybe I should memorize some of them?

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by greenleafjacob on Thursday November 15, 2018 @06:54AM (#18458541)

When setting up TOTP you can copy the private key (basically the QR code) to a secure storage so you can restore it if your device gets lost or stolen.

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by michaelt on Thursday November 15, 2018 @08:52AM (#18459189)

However, Google Advanced Protection uses only U2F, not TOTP, so that isn't an option if you're using the advanced protection.

[ Parent | on HN ]

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by xrisk on Thursday November 15, 2018 @05:05PM (#18463895)

I'm using an alternate OTP app called andOTP that lets you make AES encrypted backups. I save the backup file inside my password manager.

[ Parent | on HN ]