Ask HN: What are the risks of 2FA?

Re:Ask HN: What are the risks of 2FA? by moasda on Sunday June 13, 2021 @03:27AM (#27490547)

Thanks for the question, I have similar concerns. If you enable 2FA on a website it mainly asks you to scan a QR code and confirm it with a OTP value. This works fine until you lose you phone and have no full backup accessible without 2FA. This could be a time bomb for security oriented users.

I know, when activating 2FA the website also shows some recovery codes etc. But I can imagine that most non-tech users don't know what to do with them and ignore them.

I fully agree that you should understand how 2FA basically works and how you can recover. For me it works like this:

- KeePassXC / KeePassDX file synced on several devices + backup

- andOPT App with an encrypted backup of the exported JSON data, accessible without 2FA

This setup is easy to understand for me und I know how to recover if I lose my phone or my PC SSD gets damaged. I do not trust Google or other cloud services with fancy sync features.

[ Parent | on HN ]

Re:Ask HN: What are the risks of 2FA? by 1MachineElf on Sunday June 13, 2021 @05:15PM (#27496572)

You mentioned not trusting Google, but FWIW, Google Authenticator added support within the past year for multiple devices: https://www.theverge.com/21410260/google-authenticator-2fa-h...

[ Parent | on HN ]