Many services seem to offer one-time codes for storage offline in case this happens. Authy can working across multiple devices, but that probably has some security ramifications. Based on https://apple.stackexchange.com/questions/305372/will-my-goo..., you are able to restore Google Authenticator from iCloud.

This is the usual security versus convenience problem. The site is forcing you to use an additional factor, but there is flexibility in how that is serviced. Choosing convenience may open paths for attackers, but the impact depends on your threat model.

I agree but how many people who have 2FA from Google for example have a printed out list of numbers? You can have multiple authentication devices but, again, how many people have this? And it's certainly very easy to be traveling and not have backups with you.

One solution with Google at least is that they basically hardly ever require you to reauthenticate on a given device but that obviously doesn't help if the device in question breaks or is lost and is also your soft token.

As you say, not an easy problem. The happy medium depends on the threat model and is somewhere between being able to easily social engineer new access and having to show up in Mountain View with a sheaf of notarized proof of identity documents.

> And it's certainly very easy to be traveling and not have backups with you.

It's also "very easy" to be traveling, lose your passport or ID and not have a backup with you. Or to accidentally leave your house and forget your keys inside. Or any other number of comparable scenarios.

When that happens to you, it sucks, and you will have to jump through hoops. But still that doesn't mean that passports and keys aren't valuable in terms of security.

Of course, the difference is that people understand the value of passports and physical keys, but by and large they fail to grasp the importance of IT security or how to protect themselves. This is, ultimately, an education problem. But we don't have the same internet anymore as 20 years ago, and the problems associated with identity theft, unauthorised access, etc. are much bigger than they were, so we can't afford to be too cavalier about it anymore.

Maybe, if people get locked out of their google account because they lost their recovery keys, they will in fact learn that, yes, they should have printed out their recovery keys (something which you are prompted to do), or stored them in an otherwise safe location (e.g. password manager).

> When that happens to you, it sucks, and you will have to jump through hoops. But still that doesn't mean that passports and keys aren't valuable in terms of security.

Except there may not be any hoops to jump through with MFA if it is "too secure". See "I've locked myself out of my digital life" (a thought experiment):

* https://shkspr.mobi/blog/2022/06/ive-locked-myself-out-of-my...

* https://news.ycombinator.com/item?id=31652650

> Maybe, if people get locked out of their google account because they lost their recovery keys, they will in fact learn that, yes, they should have printed out their recovery keys (something which you are prompted to do), or stored them in an otherwise safe location (e.g. password manager).

Except at that point it could be too late and they've lost all access to their digital life/assets.

> It's also "very easy" to be traveling, lose your passport or ID and not have a backup with you. Or to accidentally leave your house and forget your keys inside. Or any other number of comparable scenarios.

The difference is I can physically show myself at the embassy or consulate. I can ask a locksmith to come to my place.

I can't do either when I lock myself out of my Gmail account.

Passkeys (the new thing from the FIDO Alliance that Apple, Google, and Microsoft all support) will help with this a lot.

Apple is going to start rolling this out in iOS 16 and I expect many sites and platforms to implement support relatively quickly. It’ll take time for this to work its way through the ecosystem and there will still be some trade-offs that will lake someone complain, but this is one of the more promising initiatives in the “passwordless” world that many security professionals have been striving for for quite some time.

I do think that when it comes to software/package maintainers, the heavy lift of having to have an MFA solution is much smaller than for a regular user. Yes, you need to store your one-off keys somewhere safe (I use a password manager and store it in an encrypted file there whether that counts as a second factor or not is debatable, but I think the fact that my 1Password account requires an account key as well as my password when accessed from a new device helps protect against unauthorized access at least), but I do think this is an acceptable trade-off (for now) if you’re maintaining a popular OSS package.

Maintainers have to do a lot of janitorial work, it’s true. And it does often fee unfair. But I don’t think asking people who maintain popular projects to use MFA for their package system is too much.

I would like to have the option of only needing the password and no password reset unless you visit an office somewhere in person. For like Google, banks, brokerages, etc. But maybe that is less secure than two-factor online systems? Seems like it wouldn't be.

It is, in fact, less secure than what we should have been doing for at least 5 years.

You are able to give away your password to bad guys, it's really easy because it's exactly like just using the password normally except whoops this was my-bank-login.example and not my-bank.example/login or login.my-bank.example or whatever the URL usually was.

WebAuthn fixes that, everybody should implement and use WebAuthn. To their partial credit RubyGems apparently noticed they ought to do this, and so this message says they're working to implement it.

Having to present physical, hard/expensive to reliably forge, government-issued ID at a reputable institution is a pretty good filter against most fraud. It's also a headache even if you live somewhere with a local branch of your bank.

I tried to do this during the pandemic and the local bank branch didn't have anyone who could give me the right authentication so I had to spend a couple hours going to my local brokerage office to complete a transaction.

>> More and more services are moving towards 2FA/MFA. The 2nd factor is in a phone app. What happens if I lose my phone? Without my old phone I cannot log into the services. How do I get access to my accounts again? How do I move the 2FA setup to new phone again? Do I have to do this one by one for all 50 2FAed services I use?

> Many services seem to offer one-time codes for storage offline in case this happens.

Adding on: even password managers like 1Password [1] and Bitwarden [2] offer support for TOTP 2FA now.

[1] https://support.1password.com/one-time-passwords/

[2]https://bitwarden.com/help/authenticator-keys/

The irony is of course that you're now back to a single factor if you store your TOTP secrets in your password manager.

But a good single factor is probably fine.

It's only a single factor if your password manager login is compromised. If you're instead the victim of a phishing attack or you somehow spill the password + an MFA token for a single service, then you still get some of the protections you would expect from MFA (e.g., the leaked login will be time-boxed and non-renewable).

To be honest, the most likely surface of attack for a user are database leaks. So long as your password manager is uncompromised, even if someone does manage to get ahold of your username/password for a specific site they won't get anywhere.

Oauth would fix this...

If only everyone would use Oauth rather than hiding it behind 'enterprise' plans...

How exactly is OAuth a solution to MFA? You want everyone to run their own OAuth provider? Will the OAuth provider support MFA?

Note that TOTP is not limited to a single authenticator. You can, for example, scan the same TOTP setup QR code once with an app on your phone and again with a different app on your laptop (or scan in one and paste the code in the other).

I use this approach with Yubico Authenticator, which stores its data on Yubikeys, so I have all 2FAs on at least two keys even with TOTP-only services that seemingly allow only one authenticator per account, e.g., AWS.

Thanks for sharing that, I did not know it.

You can also screenshot the barcode and use it years later if necessary.

Other people have given a lot of options, but I'll throw my solution in the ring.

I have a _separate_ KeePassXC database where I store the original OTP secret (if you click "add manually" or "can't scan", etc when the QR code pops up... it will give you the secret that's in the QR code) and recovery codes.

If I ever lose my phone/yubikey/etc, I can go unlock my "break glass in case of emergency" database and access accounts directly or recover from there.

I keep this in a separate database versus, say, just putting the password + OTP secret + recovery codes all in the same Bitwarden vault because I want to maintain the full security of the second factor. If my e-mail and password for Bitwarden is enough to get you the username/password/otp then I figure it's really only protecting against credential stuffing.

Funny thing that happened to me recently.

I'm having a prepaid plan with att, and I did not pay it for a while. Recently I needed to get a text message so I went on the att prepaid website to reactivate the plan for the month so that I could get the text message.

Guess what. The att website wants to send me a text message to ensure that I am the owner of the account... to my phone... that has no plan... fun times!

Did you try it? You might be able to receive messages from certain numbers.

Needing to pay to receive texts is utterly alien to me.

What? You can get texts to a phone without paying your phone bill?

In most countries outside North America, if you don't pay the phone bill you can still receive texts and calls. You just can't make calls, send texts or use internet.

The same applies to prepaid cards - if the balance hits zero, you can only do incoming calls and texts.

Obviously, the provider will still send debt collectors if you were on some fixed price per month plan, and those debt collectors will still try to collect moneys for the months the service didn't allow outgoing calls... I always thought it odd that a company was allowed by law to collect money for a service they didn't provide.

In Germany at least you (can) buy a prepaid sim card and activate it. That gives you a phone number and you usually get the price you paid for the sim card added to your account balance. From then on you don't have to pay anything to keep using that phone number to receive calls/SMS. Calling/sending SMS costs are coming of your balance. You can buy packages (usually good for 4 weeks) with e.g. 300MB data volume or unlimited calls.

There's also the model where you pay a monthly subscription and receive a new device every few years or have some other benefits.

Yes, if I'm on a prepaid plan? If I didn't top up, my phone would still have an active SIM and phone number. I would still be able to receive calls and texts.

They're talking about being able to receive texts without having a phone plan. Also, the (now) norm of texts being free in the US with most phone plans is 1.) relatively recent and 2.) not the case everywhere else. (Hence, the popularity of Whatsapp etc. outside of the US--where it's uncommon for those who don't text internationally.

Maybe they completely deactivated the sim card, I don't really know. The phone just doesn't even connect to a network anymore.

In which case, I wonder if I actually just lost my phone number altogether(?)

The weird part about this, as somebody outside of the US, is that you need to pay to receive a text message.

You keep saying this, but it makes no sense to me. How do you receive text messages with a phone that's not active? How does the phone have service?

SMS is part of the service frame - every time your phone talks to the cell tower to go "here I am, I am IMEI 12345 and I have sim ABCDE!" there is a 160-character frame for it to send a SMS message, and every time the tower goes "hello IMEI 12345/SIM ABCDE, I see that you are in cell ZXCV!" to track your equipment's location, there is a 160-character frame for it to send a SMS message to your phone.

Well, we can't just trust your phone that its plan is valid, so there is also a service frame where the tower says "Sorry 12345/ABCDE, your plan is inactive!" that uses the same frame... and it has a 160-character frame for SMS too.

SMS is literally free for providers to implement, it is just an inherent part of the phone's ping/pong process of talking to towers. So there is certainly no requirement for an active plan of any kind. As long as your phone is on the network it is notionally capable of sending or receiving an SMS, the provider just won't let it... but usually service messages ("your plan is inactive, go to this website to top up!") will be allowed.

This is on top of emergency service - 911 calls (or local equivalents) will work regardless of plan status. Actually I'm not even sure you need a SIM card at all, or if that can be done simply by IMEI...

Basically: just because a sim doesn't have an active plan, doesn't mean the SIM or the phone isn't active itself. There is still information interchange happening, and that carries SMS frames.

But you don’t have a phone number. Who does the sender send the text to? How exactly this work in other countries where an inactive account can receive a text?

Typically a person has a phone number and they were paying but stopped. They can't make phone calls or send text messages but they can receive both.

The account is still active (say, for six months since your last payment) and there will be even more time before the phone number is recycled.

This is all very confusing because you're mixing up your definitions of what precisely is "inactive" here.

It's like the OSI model, there are multiple layers here representing different things. An IMEI is a representation of piece of equipment. A SIM is a representation of a subscriber (or, to be more precise, it's a cryptographic 2fa token that a subscriber carries), so a piece of equipment may have multiple SIMs and a subscriber may have multiple SIMs each associated with at most 1 piece of equipment (at a time). A SIM may be associated with a phone number, and may be associated with a plan which may be active or inactive.

The data model is really:

user <-one to many-> SIM token <-many to one-> IMEI

And a phone number is an at-most-one feature of a particular SIM token.

The fact that you didn't pay your bill this month doesn't mean your phone number is inactive - someone who dials that will get a "call cannot be connected" message because the phone network still knows it's you. The carrier just chooses not to connect your call, the phone number is still actually mapped underneath.

And even if your number eventually gets reallocated, the fact that your SIM doesn't have a number associated with it is irrelevant - the network still knows you by your SIM and knows your phone by its IMEI.

The phone number is really like a domain - it's a human-readable abstraction for the physical reality of the routing layer (SIM/IMEI). And the SIM is a representation of what user-token (a user may have many tokens, but a token has at most 1 user) is using a particular IMEI.

At the network level, they don't care about your phone number - that's just used for a "DNS lookup" of what equipment needs to ring. And they can send a message to that equipment even if there's no actual phone number associated with it. You can also have a IOT SIM where there is no actual 9-digit phone number to ring it (although that's a US-specific routing scheme, other countries do it different) and the network just talks to it via its SIM.

And even if you don't have a SIM (subscriber-token) the phone still talks to the network, and can still make e-911 calls and similar, you can initiate outbound traffic too, because your phone is still connected to the network even if there's not only no phone number, no plan, but even without a SIM. It's still an IMEI in a cell talking to some particular tower even if there's not a SIM in it, and can both send/receive metadata traffic or even real traffic (e-911 calls).

I'm probably getting the finer details wrong here too... it's a very complex model with a lot of entities and relationships.

For some fun tangential stuff on the topic, especially surrounding the SIM card, check out this DEFCON video. It goes into the 2fa nature of the SIM - actually the SIM is a full security processor (javacard) that can execute arbitrary javacard applets sent by the network, and push/poke stuff into the SOC or baseband directly, it is like an "Intel management engine for phones" and it has a huge amount of power over what the SOC can do and see on the network.

https://www.youtube.com/watch?v=31D94QOo2gY

The phone has a SIM card, and a phone number, as evidenced by the fact that he "did not pay it for a while" rather than never having had a plan. So the phone is active and can connect to the network and authenticate with a base station and attempt to make outgoing calls. Those attempts will be rejected by his phone provider.

Incoming texts will also be rejected and not delivered. In other countries (I know about Ireland, anyway) this isn't generally true.

Receiving messages is free, so as long as you have a prepaid card that hasn’t been deactivated (not using it for a year is usual with my provider) you can receive text messages without paying.

If I were on a prepaid plane, and I didn't top up, my phone would still have an active SIM and phone number. I would still be able to receive calls and texts.

Everyone is just giving anecdotes and hypotheticals. How exactly does inactive accounts receive texts in other countries?

This is bizarre to me. I wouldn’t expect an inactive gmail account to receive email. Why texts?

That may be true but it's not obvious it would be. Certainly in times past in the US receiving calls/texts could incur charges.

> Certainly in times past in the US receiving calls/texts could incur charges.

That's why I originally said it was weird to me as somebody outside the US.

It dated to mobile calls being expensive especially outside of a very bounded home area and being either a business expense or a relatively luxury thing. In that context, it didn't really make sense to hit a landline with a big charge for calling a mobile number--perhaps unwittingly. And that general thinking carried over to SMS.

As somebody else outside the US - where is this different? Without a connection you can only make emergency calls, receiving anything is impossible when your phone doesn't have a number without an active sim card.

Except they did have an active SIM on a prepaid plan, that hadn't been topped up. In a situation like that I would still be able to receive calls and texts, just not make them.

What country do you live in, and what's the process for being assigned a phone number that can receive text messages without paying anyone for a phone plan? Does the government have an office where you can show your ID and get a SIM card for free?

Steps to reproduce:

1. Buy a sim card from ALDI for 10€ 2. Activate 3. Use the phone until the balance is down to 0€

At this point you've got an empty balance, are unable to make calls or send texts, but you can receive calls or texts still just fine. You can also visit zero-rated websites (in the past e.g. 0.facebook.com).

When I was a child my parents would give me a phone with a SIM card in this state, they could still call me if they needed to tell me to come home, and I could still call the emergency services, and given WiFi I could surf the open web as well, but I couldn't waste money on paid services or calls.

Every service that I've seen that uses TOTP 2FA will also give you a list of fixed backup codes and strongly encourage you to keep them somewhere safe. There are also TOTP apps that will let you make a backup of your codes, to also be kept somewhere safe.

Of course it's the user's responsibility to actually keep backup codes somewhere where they can definitely be accessed in case the phone is lost and also can't be stolen easily. Ditto for a app backup. Sounds straightforward, but easier said than done.

Check out the Authy app. It lets you have an encrypted backup with which you can restore the MFA codes on another device. Another option is using a password manager with MFA capabilities, like 1Password.

I've used Google Authenticator, Authy, and 1Password. 1Password has been far superior in my experience, the only downside being that it is a paid subscription, which won't work for everyone. My 2nd choice would be Authy.

Entertaining related story... a few months ago, I tried signing up for Celsius, the crypto exchange that went bankrupt. Their sign up process required MFA, and for some reason the only app they supported was Authy. Unlike most any other site, instead of giving you a QR Code to scan, Celsius would do something weird where they have some sort of push message mechanism that's supposed to initiate the MFA setup process from within the Authy app. I never did get it to work. I have a personal rule that if the signup/signin process for a service is too arduous, I simply won't use that service if I have viable alternatives. So I didn't lose any crypto in the Celsius bankruptcy because their MFA signup processes sucked.

I have 1password too but that seemed a little incestuous to have the password and the TOTP in the same app, it's not exactly MFA. I use Authy, personally, with backups and encryption.

I have the same 1Password / Authy setup, for the same reason. But I have my Authy password in 1Password, so it is kind of an illusion of extra security. I’m strongly considering moving it all into 1Password at this point.

Thankfully I can just about remember 2 passwords :)

Also you can use biometrics in Authy, fwiw. Then write down the password and put it in a safe. Then there's only 1 to remember but you can use biometrics in 1password too, so unless your threat model includes someone using your freshly chopped thumb then it should be ok.

I use the OTP Auth iOS app. I store encrypted backups of my 2FA code secrets in iCloud, and also in Dropbox. I save recovery / backup codes in LastPass (whenever a service provides them.) When possible, I will set up two or more 2FA options. I always have a small Yubikey plugged in to my laptop, and some services allow me to set up a Yubikey as well as OTP codes. I also have a backup Yubikey that I set up for all the services that support it, and keep this off-site in a safe deposit box. I also store some printed copies of critical 2FA code recovery codes, mainly for my Google and Apple accounts.

What I'd like to see is for sites to allow setting up two different kinds of 2FA, one of which is TOTP and the other is something hardware-based.

TOTP has some limitations which make it not as secure as the better hardware-based approaches. For example if you get fooled into trying to login to a phishing site and the real site uses TOPT, all the phishing site has to do as ask you for the TOTP code. TOTP in this case only protects you from getting phished if the phishing site is just logging credentials for use later use. If they are going to use your credential right away it is no protection.

If a site allows both TOTP and a hardware-based system though you can use the hardware-based system normally, and only resort to TOTP if the hardware is lost or broken, and stop using TOTP as soon as you can get replacement hardware enrolled.

For TOTP when you are setting up and the site gives you the QR code, scan that in TOTP apps on your phone and if you have one on your tablet. Also save a copy of the QR code somewhere safe. I save an encrypted copy on my desktop computer. If you ever change phones or tablets, you can scan the QR code again.

Some sites will also give you the TOTP key in text form. Save that somewhere safe and you can use it with command line TOTP tools such as oathtool [1].

[1] https://www.nongnu.org/oath-toolkit/oathtool.1.html

> What I'd like to see is for sites to allow setting up two different kinds of 2FA, one of which is TOTP and the other is something hardware-based.

This is exactly what we did for PyPI: we allow the user to enroll as many 2FA factors as they'd like, of both supported types (TOTP and WebAuthn).

The post is dated 2019, but the summary of practices we wrote here[1] is still relevant (and IMO, correct).

[1]: https://blog.trailofbits.com/2019/06/20/getting-2fa-right-in...

You got lots of answers about proactive approaches to the issue. In cases where you didn't do those, you'd contact support. If it's a bank account, they ask you security questions and then reset/remove MFA. I've done that over the phone while out of the country once. If they don't have support, or their support doesn't have an alternate authN approach, you could be locked out.

Your second factor could be whatever you want it to be. Phone app, keyfob, TOTP program running on your machine. Many services allow for multiple options.

Most 2FA apps have a convenient "move all of my codes to another device" function, offer online sync, whatever.

And even if they didn't, every service provides recovery codes that you could use in case of an emergency, should you need access to some service and all else fails.

Genuine question - Which keyfobs support scanning QR code presented by an online service to add the TOTP seed and then generate TOTP codes?

Any cross-platform recommendations for TOTP program that works on Windows, Linux, Mac?

QR code scanning is intended for mobile phone cameras as a way of communicating a TOTP secret.

When presented with a TOTP secret, every website I've seen has presented the option to show the TOTP secret as text, which can be copied across.

A password database like KeepassXC can store the TOTPs.

FIDO / U2F hardware like Yubikeys (or various alternatives) are also a convenient second factor.

You type the seed in. Services almost unilaterally give you the option to get a seed code instead. Even if they don't, you can scan the QR code and get the seed out of it.

I use a password manager to store my credentials, TOTP codes and stored secondary codes. Yes, that does make my password manager more of a risk, but for that reason, I use a strong and unique password for the password manager, have a password manager that has its own security key that is required for access from new devices, etc.

When I transfer phones, all that stuff comes with me.

For worst case scenarios, I have a few spare YubiKeys setup that I can use in the event that something goes haywire. And in a safe deposit box, I have a YubiKey and a printed out copy of my 1Password emergency kit. So that if someone drives into my house and it burns down, I do have an option.

But I agree that this is a lot of stuff to keep track of. That’s why I’m glad that Passkeys are being adopted by the big players (Apple, Microsoft, Google) and that we’ll see consumer rollout of this sort of thing, which should make this a lot better.

There’s no such thing as a system without a threat model — and biometrics can be imperfect, but I’m much more comfortable with that or even relying on my current MFA setup than I would be using SMS 2FA or no 2FA!

Services usually offer a tokens which should be saved somewhere in order to reset 2FA. I agree, requiring users to keep tokens for every service is painful (see how many people had trouble not losing their btc keys when btc wasn't particularly valuable)

I've only gotten a new phone once. Was android to android. I was able to transfer everything from the old phone to the new phone as part of setup process

Granted, yesterday I had some trouble: my phone service failed to process a payment, so they disabled my service. Meanwhile I couldn't go in & review my bank info because I needed 2FA in order to login.. To make matters worse, the bank told me I needed to call a number for Loss Prevention Services to reenable sending money out of my account, & made me run around a bit looking for pay phones (surprise, they were out of order) before they let me use their phone

> Services usually offer a tokens

In my experience, ”rarely“ is more accurate than ”usually“.

For SMS 2FA maybe, but I've gotten between one and ten codes for every service I've enabled proper TOTP 2FA on.

what can you do now to prevent this from happening again?

I've tried putting an extra 2 months of payments on my phone plan so that if a payment doesn't go through service won't expire. Hopefully the automatic payments continue so I don't have to think about it

I recently migrated all of my 2FA logins to Raivo [0]. It's iOS-only but open source and very nicely built. The key feature that made me switch is that it can export the 2FA tokens as a backup.

I got worried when I started thinking about this scenario, and realized Google Authenticator offers no way to back up the tokens. The only way out is to transfer to a new device using a QR code. They pretty much lock you in to using Google Authenticator.

And, crucially, backing up the phone DOESN'T SAVE THE TOKENS.

I almost learned this the hard way when I got a new phone, restored from backup, and right before I wiped my old phone I decided on a lark to check that Google Authenticator was working on the new one. The app was there, but the tokens were not.

0: https://raivo-otp.com/

Apps like the Microsoft authenticator and freeotp+ allow you to backup your codes. With freeotp+, you can export the codes as a json file and import them in another phone in case something happens. With the Microsoft one, you save the codes in the cloud (your Microsoft account).

Are there any good and not ugly TOTP apps on iOS that have export/import functionality?

For RubyGems:

1. You get given recovery codes when you enable MFA. Each is a single-use code that stands in for an OTP code. If you kept them, you can use these to login and then change your device.

2. If you lost those too, there's a manual reset process. As you can imagine it's slow and requires careful scrutiny to guard against social engineering attacks on the rubygems.org maintainers.

In future it will be possible to use WebAuthn[0] for rubygems.org and, ideally, you will be able to bind multiple hardware tokens or biometric devices to your account, so that you have backup options.

[0] https://github.com/rubygems/rubygems.org/pull/2865

I recently (few days ago) had to do 2. None of my gems are super popular but I have enough that there are some serious production workloads behind. It felt scrutinized enough. I can imagine if I had more popular libraries that it would have been much more so.

Most services should have a fallback. Often it is just emailing you a code, or texting a code to a phone number. This is because true, strict MFA would become a customer support nightmare - half your users would be locked out from day one.

Also realize you can use more than one 2fa device. At the step where it asks you to scan a QR code, you can scan it on multiple devices.

Also, you don't need to use a phone to store your codes. 1password can do this for you, and then your codes are available anywhere you are logged into 1pw.

The google authenticator app allows you to transfer your codes to another phone, but you need to remember to do that before wiping your old phone.

It’s a good question. A lot of 2FA apps have manual backup/restore functionality. Some have cloud sync (e.g. iCloud sync so your new iPhone has the same app and codes, or 1Password/Bitwarden which has you log back into the app on the new phone with their service login.) These 2FA syncs can be a point of weakness so not everyone uses them.

The services themselves (rubygems etc.) also provide a short list of one-time account recovery codes. You’re supposed to essentially print them and put them in a safe. I wonder how many people both keep those codes and keep them somewhere secure…

Authy for example enable you to have a cloud backup - https://authy.com/features/backup/

1Password offers MFA and would still be available on your other devices if you lost your phone. As to if storing passwords with MFA codes is fine or a problem, I’ll let smarter people than me decided what’s best practice.

Ah, yes. Authy was the iCloud one I was thinking of. IIRC they provided plenty of warnings about the tradeoffs of enabling that.

As others are saying, you can store your TOTP code in a password manager, and if you lose you phone re-add it. You can also use something like oathtool do generate these one time passes at the command line.

I had a similar question and wrote up how I'm doing it here:

https://earthly.dev/blog/multi-factor-auth

Oathtool:

https://www.nongnu.org/oath-toolkit/oathtool.1.html

You probably get recovery codes you have to store somewhere. Major 2fa code apps support migration between phones, and backing up the encrypted database to the cloud.

I use andOTP on Android and it has a backup feature that exports all your registered 2FAs into a file which you can import to another andOTP install. You can also export with a password on that file so it's encrypted.

Other 2FA apps have backup options like Google Authenticator or Microsoft Authenticator. Bitwarden, if you pay for premium, gives 2FA as a feature and they just handle those codes. Just don't register Bitwarden 2FA under itself :D

Two-factor reset is usually a slow manual process where the service provider checks that you are who you really claim to be. It is not automated so that it cannot be abused.

If you have 50 two-factor authentication tokens you can use apps like Authy that allows you to do a local or remote back up of the tokens. TOTP is an RFC standard and you will find lots of apps for advanced users.

Services often give recovery codes too.

All the answers here boil down to “you’re right, it’s complicated, so a normal person will just completely lose access”.

I use the TOTP feature of Bitwarden! It syncs across all my devices including desktops. It's very nice.

Google authenticator allow you to export codes as qrcode now.

You can backup it to other phone or even print it and lock it somewhere if you want.

I personally just put them in my bitwarden, which syncs with all logged in devices.

> What happens if I lose my phone?

Backup code (very long, one-time-use password.)

6 digits is very long?

No that’s the normal codes, which are time limited. A backup code could be 40 digits or something like that.

Most I've seen are 6 digits for both the TOTP and the recovery. Who is using 40 digits for an MFA recovery code?

Most services I use give several 6~8 digit recovery codes, I've never had discretion with them. I have no idea what they're talking about.

> Most services I use give several 6~8 digit recovery codes

Well RubyGems itself, subject of this post, has 12 for a start.

The most you've seen for a recovery code is 6 digits? Where have you seen these "never more than 6 digits" codes ?

GitHub's codes are 8 alphanumerics,

Dropbox 8 alphanumerics,

Live.com offers a 25 alphanumerics

Google 8 numeric

Facebook 8 numeric

Nintendo 8 numeric

Login.gov 12 alphanumerics

Gitlab 16 hexadecimal

I'm sure some fool somewhere used a six digit numeric "recovery code" but the usual, while it isn't 40 is certainly more than 6.

I must be mistaken, looks like 8, those are the sites I use.