The bank's bureaucracy advised her to unlock it she needed to go in person to her home branch in Ukraine (which has a decent chance of being a pile of rubble given her neighbourhood was hit by shelling in the time after she left).

This was... ~ 6-7 months ago. I'm unsure what options are left, or... if my wife sorted it out (she did recently get a newer iphone, and that may have been able to get it sorted).

My bank in my country of origin also used to use a token, but they changed to a "token app" in the phone about 10 years ago.

However to authorise this app I had to use an ATM. Since this bank only has ATMs in one country, this means I couldn't lose or trade my phone.

After I moved I kept a super old iPhone in a drawer only for this bank, but at some point the app kept threatening me to upgrade, otherwise it would stop working in the next version. But I couldn't upgrade because my decade-old phone was too old for the new version.

Since even blocking my debit card via phone required using the "token app" (something incomprehensible to me), it became too risky to keep this account.

At this point I had no recourse but to close the account.

If a service does not allow the use of "generic" TOTP ala Authy or Google Authenticator, AND it does not allow for one time use backup codes, then I do not use 2FA with that service unless required. My main bank forces the use of their own built in 2FA (Symantec VIP on the backend) which pisses me off. My work uses Okta and RSA. Oh well.

All the banks I know of require 2FA in the form of either a physical, battery-powered RSA token (sometimes in the form of a EMV card reader) or a valid BankID.

The assumption is you live in the country and can just visit a branch if you have any trouble, which works for 99% of customers. But not for me.

I wish there was an exam you could take that would get you a "computing license" that you could show to bypass a lot of this stuff.

With 2FA, almost all of the traditional attacks are impossible and the only one left is specially crafted fake login pages.

You're right when you're dealing with large groups of people which is exactly what I said in my original comment. If you understand these issues passwords on their own are fine. 2FA has some nasty edge cases that make it very easy to lose access to your account (which is what everyone in this thread is talking about.) So as always you're balancing security and availability. For some people the proper balance means just password authentication makes sense.

The best IMO would be client side certificates but no one except maybe Github supports those.

I don't claim 2FA is perfect, it has its own host of issues as is being discussed. But it isn't just for "the masses that don't understand how to make strong passwords or how to be secure". Certs are good, but they need to be made simpler than they are now for the very people you claim 2FA is for or they won't be adopted (one of the reasons they aren't more ubiquitous, IMO). And some certs implementations have issues with account recovery as well if you lose access to them.

It's a really hard problem that you do a bit of disservice to when you dismiss it as "just a problem of the plebes".

Any service that is storing passwords in plain text is probably not implementing 2FA in an safe way, either.

Can you explain why that is an issue?

Can you elaborate on the specific risk here?

If someone can convince the human at the other end of the line that they are you and that they lost their phone, in most countries and with most telco's, they will be able to get up and running with a new SIM with _YOUR_ number.

Resettting your Authy password via SMS is then just a step away.

>Can I reset my Backup Password?

> Yes, it is possible to reset your Backup Password by tapping on Change Password in the Backup Password area of the Settings menu within the Authy app. You will have to ensure all 2FA account tokens are decrypted on your device (No red lock icons). Once a user resets their Backup Password on a device, all other devices with the Authy app for this user’s Authy account will require entering this new Backup Password.

https://support.authy.com/hc/en-us/articles/360036077534-Aut...

The fact that they disable SMS authentication for accounts that they deem "high profile" says it all.

Last time I looked, I don't recall there being a backup password (essentially a local encryption). If you SIM swap someone, you'll pull down their OTP seeds, but won't be able to read them without that code... so that's a slight improvement at least.

BUT! They have a recovery process. So the risk profile is convincing the telco to SIM swap + lodging a support ticket with authy (that takes 24 hours to complete).

If someone tries to use SMS/Voice to activate Authy on my account it just gets rejected.

https://support.authy.com/hc/en-us/articles/360036077534-Aut...

“How do you derive encryption keys from a Backup Password?

We use the National Institute of Standards and Technology (NIST) recommended algorithm PBKDF2.”

https://support.authy.com/hc/en-us/articles/360036077534-Wha...

>If you lose your Backup Password, you will not be able to decrypt your 2FA tokens from Twilio Authy servers and access them within the Authy app on any other device (Eg: If you bought a new phone to replace an old or lost device). If you still have access to the original device on which you set up the Authy app with your 2FA account tokens for the first time, you can follow these steps to re-configure your Authy app on a new device.

Authy admins cannot reset this password. It looks like they can disable encrypted backups, but not decrypt your shit.

So basically all an attacker should be able to do is gain control of your account, delete your old 2fa codes and then add his own.

>5 – 2FA Recovery

>Imagine this scenario: You installed Authy, lost your phone, your laptop is broken, and the bitcoin price is climbing like crazy. You need to login to your crypto wallets, but you either enabled multi-device and all the devices with Authy are not working or accessible, and your account has been tagged high-risk, and you can’t use SMS to install a new Authy app. What are your options?

>Authy has a 24-hour account recovery process. By providing your phone number to Authy Support, we can go through a set of security processes to re-enable your ability to install Authy. Some users may question why account recovery isn’t instantaneous, but our goal is to 100% protect our user’s accounts against an attack or hack, and that includes our recovery process. This 24-hour period allows us the time to perform the necessary due-diligence to verify that you are who you say you are. We’d be doing a disservice to all if we were to rush this process.

[1] https://authy.com/blog/understanding-2fa-the-authy-app-and-s...

When you enable encryption, they derive an encryption key off the passcode you provide, encrypt the tokens, then store them on authy's cloud storage. The encrypption key is never sent to authy's servers, and only stored on device. When you add a new device, you're prompted to enter the passcode, which generates an encryption key and decrypts the tokens.

How is support going to decrypt the tokens for you? They need the password, which they don't have.

You use support to add a device to your account, and then you use the password to decrypt your tokens.

Granted, an attacker could gain access to your authy account and then delete all your tokens, but that's different from being able to log in and start using your TOTP 2fa codes. You should also have recovery codes written down somewhere in the case this happens for all your services.

I literally just restarted everything from my previous post with more words.

>You installed Authy, lost your phone, your laptop is broken, and the bitcoin price is climbing like crazy. You need to login to your crypto wallets, but you either enabled multi-device and all the devices with Authy are not working or accessible, and your account has been tagged high-risk, and you can’t use SMS to install a new Authy app. What are your options?

Other people's threat models will certainly differ though, and whether mine is well chosen is certainly open to question.

(I don't know much about authy, I only use it to access m sendgrid account, but I didn't like the fact that it used SMS for setting up or restoring an account.)

I also have Authy, because that seems to be the only one that SendGrid will work with, but exactly because of this I thought that was non-standard. But as I can see now, they probably also support standard TOTP. But they rely on SMS for initial authenticaion (when you install or re-install the app) and I don't trust that. On a side note, Microsoft also has an Authenticator app, which also supports the TOTP standard. (So it can work wherever you would use the Google Authenticator.)

It's been a long time since I installed it, so I'll take your word for it. They have my email address displayed in the app, so maybe I can do authentication on a new device over email, too. But regardless of how you initially authenticate a reinstall (email or SMS), as long as you are using the Authy cloud backup -- which is password-protected and cannot be reset over SMS or email -- what is your concern (genuine question)? I do not see the security risk, but I'm no expert.

Also, as I have already been using the Google Auth app, I was somewhat ignorant to check out Authy more in detail. Up to know I thought it wasn't using standard TOTP but some in-house developed algorithm by Twilio (or maybe a lesser known/less standard one) because SendGrid specifically tells you to use Authy. Which in itself seemed like a red flag.

An alternative is debit card bankid (as a smartcard, then add Mobile BankID back), but it's being deprecated soon.