Re:Ask HN: Carrier “lost” my number in a port request
by jobigoud on Wednesday November 02, 2022 @08:07AM
(#33434390)
You can already do backups with Authy but I think OP's issue is for SMS-based 2FA which is still very common.
Re:Ask HN: Carrier “lost” my number in a port request
by OJFord on Wednesday November 02, 2022 @08:15AM
(#33434482)
> SMS-based 2FA which is still very common
It's not like it's showing any signs of going away either, financial institutions even are newly implementing it.
Re:Ask HN: Carrier “lost” my number in a port request
by realgeniushere on Wednesday November 02, 2022 @08:13AM
(#33434464)
Don’t you need your phone number to authenticate with Authy to get into the backups?
Re:Ask HN: Carrier “lost” my number in a port request
by OJFord on Wednesday November 02, 2022 @08:16AM
(#33434491)
No. That might be a possible backup, but the usual way is any current logged-in device + password.
Re:Ask HN: Carrier “lost” my number in a port request
by realgeniushere on Wednesday November 02, 2022 @08:17AM
(#33434508)
Uhh, if you need a currently logged in device to bypass the phone number login, then I wouldn’t say it’s a “possible backup”. Phone number is the primary authentication mechanism for Authy.
Re:Ask HN: Carrier “lost” my number in a port request
by n0mn on Wednesday November 02, 2022 @08:47AM
(#33434845)
If you have “Allow Multi-Device” enabled, your keys are stored on Authy’s servers. You simply download Authy on a new device, sign into your account and you are done.
Re:Ask HN: Carrier “lost” my number in a port request
by realgeniushere on Wednesday November 02, 2022 @10:23AM
(#33436266)
How do you sign into your Authy account? For me, it asks to send an SMS to my phone.
Re:Ask HN: Carrier “lost” my number in a port request
by alanbernstein on Wednesday November 02, 2022 @09:17AM
(#33435238)
Huh? I use Authy because it allows me to use TOTP codes, from multiple devices, including devices without cell service. I switched to it from Google Authenticator specifically for that reason.
Re:Ask HN: Carrier “lost” my number in a port request
by realgeniushere on Wednesday November 02, 2022 @11:20AM
(#33437282)
Okay, so how do you sign in to Authy if you don’t have another signed in device handy? I believe the only options are phone call or sms.
Re:Ask HN: Carrier “lost” my number in a port request
by jandrese on Wednesday November 02, 2022 @11:15AM
(#33437178)
SMS is not suitable for 2FA. It has a massive "help desk" hole that is obnoxiously easy to exploit. SMS is only useful as a proof of stake, IE something you do to initially set up a second factor to prove that you have some skin in the game, but not as the second factor itself. Honestly, even that proof of stake stuff is separate from setting up 2FA, it's mostly about slowing down botnet signups.
There are times where SMS 2 factor is worse than no 2 factor at all. Common number porting attacks allow an attacker to be far more convincing to the support staff when they call to say that they forgot the password but still have access to the second factor.
Re:Ask HN: Carrier “lost” my number in a port request
by tsol on Wednesday November 02, 2022 @09:10AM
(#33435111)
>Most will require two government IDs to be sent in to remove 2FA and 1-2 week process to review & confirm.
I've never heard of this. If I lose my number, can I still regain Google account access by mailing my info in?
Most will require two government IDs to be sent in to remove 2FA and 1-2 week process to review & confirm.
Moving forward you should look at Yubikey where you can with the backup being your phone via Authenticator app.