What are they supposed to do to fix your issue without compromising their security model?

What you describe sounds like 2FA working like it's supposed to.

If I cancel my phone service, and someone else later ends up with my phone number, does it make sense that that person can never use Uber with their new phone?

Phone numbers are less transitory than street addresses, but much more so than email addresses. You should expect some amount of re-use, and need to be able to handle that situation.

I nearly lost all my passwords with LastPass when something similar happened to me.

Is grandma supposed to file her 128 character recovery code in a safe vault when she just wants to get from the airport?

Stop blaming users for them not adapting to terrible authentication experience.

To me they're all terrible in one way or another.

Or else submitting a passport / drivers license to force unlock.

We have global identity systems. Why not use them?

Doesn't help if you lose the keys and you're the only one that held them. This happened to me with an SSD that I took out of an old laptop, without realising that But locker stored its key on a chip in the laptop. I didn't even know that I had bitlocker enabled.

But Uber shouldn't have your trip details behind end to end encryption, so they should be able to unlock it.

Security questions are often shared between services, so someone who's hacked any of the other services could get the answers to these same security questions and then use them to bypass 2FA.

No of course not. They're going to help you out. Because we live in the real world where people make mistakes.

I don't believe I have the capacity to reliably preserve, in a secure location, recovery codes from dozens of different services over many years.

I suspect I'm not the only one.

There is pretty much nothing else in my personal life I have to do something like this with. The closest might be my physical SSN card or birth certificate. But that's one thing to keep track of, not a new thing every week or month to add to the stash. And even those, if they get lost, there is SOME way to replace them, usually.

We are asking people to do something that is not a thing they have practice at or otherwise have to do or are any good at or have the capacity for. And then blaming them when they fail to pull it off, where you're constantly getting locked out of things and/or constantly getting hacked, probably both at once.

I understand passwords alone don't work. I don't have a solution. I'm just predicting a very painful digital future for most people.

(My own "solution" is using Authy TOTP, installing it on multiple devices, figuring I will retain working access to at least one of these configured devices, and not bothering with backup codes. I don't know how secure it really is, or TOTP is in general, but it lets me keep using services that require it, without living in fear that I'm going to lose my phone and misplace the backup codes and lose access forever).

And that the very same reason people can't be trusted with passwords is the same as why they can't be expected to keep backups of their recovery codes.

Passwords suck. But so does every form of 2FA.

If your house catches on fire while you're asleep, there's decent odds both your phone and any printed codes are gone.

Without 2FA someone can defeat your password and they're in.

I don't think the average home thief would know what to do with a printout of your 2FA recovery code especially if it's buried in other paperwork. The real risk is loss from negligence or natural disaster.

Fear is being locked out is exactly why I'm reluctant to enable 2FA. To enable it and then just store the password (err, I mean, recovery key) in my password manager seems to just get me more hassle for exactly no additional security.

What am I missing?

I mean where am I supposed to store the recovery key if not in my password manager? My dropbox surely isn't better encrypted than my bitwarden. I work with the assumption that my password manager is the least insecure piece of data storage I use.

I really don't get it. How isn't 2FA just security theater if we're all supposed to store the recovery keys "somewhere safe"? Can we really expect people to deal with recovery keys in a more responsible way than they do with passwords?

The average-case person is going to ignore the generated keys because they are deluged with nonsense every day and can't filter out what is important anymore. Lots of people will get locked out of accounts before they learn that there is now yet another unwanted tech bureaucratic layer to take seriously.

I'm guessing in 5 years it will be normal to set up security questions for 2fa recovery keys. Or we'll add another 2fa for 2fa key recovery. The adding of layers will continue until we are all "secure" and we'll all have to ask for our misplaced keys from the NSA.

My password manager (keepassxc) supports multiple databases. I store all TOTP recovery codes in a separate database (and with a different unlocking password) from the one that has regular passwords and the TOTP secrets.

All my databases are backed up on someone-else's-computer, but I only keep the regular-passwords-and-TOTP-secrets database synced to my devices.

In practice, 2FA is just another password anyway. What it really helps with is password reuse.

1. It's easy to start ignoring such notifications if you regularly log in to new devices (or if logins expire). I don't think this is true to the same degree with notifications of recovery code usage.

2. Devices can potentially be spoofed.

• there's no temptation for the user to use them on another website, where they could leak

• the server can ensure they are high-entropy (although AFAICS GitHub's recovery codes are only 40-bit…)

Moreover, if someone takes over your e-mail account, they can reset your password; but they can't reset the recovery codes.

That way it's easy to enroll a new laptop/phone/yubikey.

Once printed out, put in a plastic bottle and bury it in your backyard :)

Then again, people that use password managers at all usually have stronger passwords and less password reuse, so it can be an acceptable tradeoff.

Not everyone has the same risk profile/tolerance, but I just wanted to say that I don't think anyone should feel bad about doing the best they can, even if that stops short of the absolute best.

Years go by, I need a code, they don’t work. Github could do nothing but tell me to start a new account.

Same old story; Github does not exist for you. It exists to make its workers and owners money. Whether it works or damages you is irrelevant to them.

The future has no obligation to the past. Don’t expect the codes to work if they change something that deprecates the old system they used.