This is my biggest fear. Even if I use 2FA completely safely, using a physical chip, for 10/10 sites I care about, someone could spoof my phone number, call tech support with the right attitude, and remove my 2FA.

I'm so over the phone system and the credit card system. We have superiors but we are stuck in the past culturally.

Good providers have a deliberately slow and onerous process in place - send proof of identity, multiple notices to the account owner, sometimes even documents mailed to a physical address. It needs to be possible to recover high value accounts - what else would you propose as a better solution?

Yeah, that's exactly the point.

If the process takes couple of days and they do a lot of communication, there is a good chance the real owner of the account will get notified and have time to react before the attacker gets access to the account.

Also, the commenters are completely wrong on that it is enough to have the email or ID to get through the process. The AWS people who contacted me required a lot more information that only the owner of the account would know.

> Well, not. I called them and with a procedure that took some 3 days and numerous phone calls, id photos, etc. But I finally got the access to my account back.

And the point of 2FA in the first place is thought by many to prevent social engineering.

All you needed was an id photo and be able to talk on the phone?

That and account history etc. will probably be in many peoples email. Thus access to the email only would allow you to get access to 2FA services too.

For me that was a reason to 'only' use a static 50 char password on my yubikey thats combined with a short password I can remember as a kind of simple 2FA.

Just feels safer to me to have a printed backup of both stored away in case the tech breaks or gets lost.

You can't have multiple yubikeys associated with your AWS account! And you can't have a yubikey as primary and a software authenticator as a backup, for example. It's a huge hole in their operation imo. Even comparatively unimportant apps such as Facebook allow you to associate as many hardware tokens as you like, fallback to authenticator or SMS, etc.

Yeah the whole setup is completely broken, which forces them to build backdoors for when it breaks which completely defeats the purpose of 2FA to begin with.

No, it is not broken.

You just make cloned yubikeys. You can't read data from the key, but you can initialise it with your own data and you can initialise more than one with the same payload.

And how do you do that with U2F?

You can. You make clones.

> a procedure that took some 3 days and numerous phone calls, id photos, etc. But...

We're disagreeing over semantics then. I'd call this "being locked out of my account semi-permanently".

I have to say I don't fully understand your perspective. In a sibling comment you admit that free customers ought to be subject to this misery because they are using the service for free, and here you suggest that requiring numerous phone calls and numerous days of non-access to services is not an inconvenience. I suspect we simply have different life priorities. For me, those three days could be critical in my relationships with customers, clients, employers, etc.

It is inconvenience, but necessary one.

Would you like your bank to make it convenient for you to get your money if you forgot your ID? It is double edged sword -- convenient for you is also convenient for somebody who might want to steal your money.

So no, I do not object to AWS doing due diligence when I recover my password because I know this hopefully makes me a bit more secure from somebody else doing the same.

On the other hand, a family member set up facebook with 2FA, but using a TOTP built into facebook (is this really a thing? It seems to be) -- such that when he switched computers and facebook decided he needed to re-auth, he couldn't get to the TOTP anymore.

If this doesn't make any sense, it probably is because I have the details quite right, but the end result is I was unable to help him make any more sense of this, and there appears to be literally no way to regain access to his facebook account.

>and there appears to be literally no way to regain access to his facebook account.

a blessing in disguise perhaps?

> I called them and with a procedure that took some 3 days and numerous phone calls, id photos, etc. But I finally got the access to my account back

One could argue that your accounts were never secured to begin with.