Yes, but that's a highly technical solution. I've been trying to get my girlfriend to use Authy for 6 months now, and the solution we landed on is that my Authy app has all of her 2FA codes, and she just calls me if she needs one.

To you and me 2FA doesn't seem that complicated. But to less technical people it's just overwhelming and they don't want to bother with the learning curve.

What learning curve? Setting up the account in the first place? Sure, that’s a tad complicated, but I really don’t understand why your girlfriend finds it easier to call you when she just has to open the app and the code is simply there.

The issue is described further in the Tweet chain: Physical property retention is more or less impossible; these people typically end up getting their phones stolen every month to 4 months. The same would be true of IDs or other paperwork that could be used to prove their identity.

They get phones from a government program. Each new phone has a new number, and due to the above challenges, it'd be challenging to port numbers and keep a consistent number.

Authy accounts are keyed to your phone number, and to set one up on a new phone you have to receive a verification call/text.

How do you use Authy if you lose all of your possessions every few months?

> How do you use Authy if you lose all of your possessions every few months?

TLDR; Authy is like a password manager for 2FA tokens.

You set a master password in Authy and enable cloud backup.

When you loose your phone you can e.g. use Authy desktop and retrieve all 2FA tokens from the cloud with that password and just use that until you have a new phone.

This didn't occur to me until August when I smashed my phone screen on a concert and needed to give someone access to a private repo on GH the next day. It works flawlessly.

From what I remember when I used Authy briefly (Google Authenticator finally added the ability to mass import/export codes shortly after I ended up trying Authy), you create a login and set a master password, and then you have access to your codes on any device when you log into the app. Of course, this means that you have to trust Authy with your codes being stored externally, but this might be one of the sets of circumstances where that's preferable.

Authy recovery requires you to have access to the same phone number when you want to restore to a new device.

Oh, interesting, I didn't even realize that when I used it! I guess that goes to show how easy it is to take something like that for granted

I did some more research. It looks like there is a way to recover if you don't have the phone number or the old device. They have an online form you fill out with your old phone number and new phone number. Then they have some process to verify ownership of the phone numbers which they say will take several days for security purposes.

https://support.authy.com/hc/en-us/articles/115001953247-Pho...

Authy doesn't store your codes. They store encrypted copies. They are encrypted on your device and only decrypted with your password which does not leave your device. As long as their encryption is not broken your codes are secure.

There are various approaches to 2FA, from backup codes, to SMS, to external physical keys - none of them workable for the specific use-case OP defined: person is homeless and losses their stuff every few weeks.

For that situation no 2FA solution is going to work.

Of course there is. For instance a printed paper tan list. Yes, this is not as safe a proper 2FA device. But it's easy to access, cheap (just go to a copyshop and 10 cents to print it, then put in a plastic bag) and it's so small that it's easy to put it somewhere where you don't lose it and is hard to get stolen.

You're not arguing with me, you're arguing with the author of the twitter thread.

"Any solution requiring long-term retention of a physical 2FA key or high-entropy secret will not work."

No, I'm certainly arguing with you. :)

Maybe, on top of that, I'm also arguing with the author. But I assume he implicitly talked about Google (which doesn't provide that option).

>But I assume he implicitly talked about Google (which doesn't provide that option).

Google provides backup codes. You can print them on any kind of paper you want.

Regardless, OP argued that printed backup codes don't work because everything is lost every few weeks.

Oh really? I didn't see that option. Maybe it's new? If so, that's good!

Or maybe they don't exist any more because I still have mine on an index card from ten or so years ago.