News for hackers. Stuff that matters.
Re:Tell HN: I can't login to Gmail due to phone cannot be us... by Eric_WVGG on Monday November 21, 2022 @09:47AM (#33693054)
This phone verification shit is so awful. I have two friends who moved overseas and disconnected their cellphone plans without thinking about their MFA situation.

Today I have to enforce MFA at the small company I'm working at, and just a month prior I held a cybersecurity seminar for them and explained that "phone MFA is… okay… but you should really use verification apps." But I didn't realize that you can't even enable authenticator-app-MFA with Google without doing it through a phone first… just infuriating.

Re:Tell HN: I can't login to Gmail due to phone cannot be us... by ghusto on Monday November 21, 2022 @10:38AM (#33693739)
Yup. You have to enable it, add property MFA, then disable it.

Because Google knows best.

Re:Tell HN: I can't login to Gmail due to phone cannot be us... by pc86 on Monday November 21, 2022 @10:12AM (#33693415)
I moved across the country a few years ago, and just a few months ago got a new phone on a new carrier. For a brief moment, I considered getting a new number. No more spam texts and calls (or at least different ones)? Having an area code matching where I lived? Seemed like positives, and it'd take me about 10 minutes to email or text my new number to the relevant parties.

I hadn't considered MFA because I use Authenticator and have most of my TOTP seeds in 1Password anyway, but man I'm thinking I dodged a bullet because there are a handful of things that use SMS only.

Re:Tell HN: I can't login to Gmail due to phone cannot be us... by hdjjhhvvhga on Monday November 21, 2022 @10:38AM (#33693749)
> just infuriating.

I just bought a prepaid card only for this - Google, Facebook, Twitter, Instagram. I don't use it for anything else. I took it out and hope to remember to top it up for another year to keep it in service. It's so stupid.

Re:Tell HN: I can't login to Gmail due to phone cannot be us... by joncrane on Monday November 21, 2022 @09:51AM (#33693089)
So I have used Authy, which apparently is somehow protocol compatible with Google Authenticator, and you can back up your tokens with a password. I got a new phone, installed the app, entered the password, and all my tokens were there.
Re:Tell HN: I can't login to Gmail due to phone cannot be us... by iosjunkie on Monday November 21, 2022 @09:57AM (#33693187)
which apparently is somehow protocol compatible with Google Authenticator

Nothing mysterious. Authy and Google Authenticator simply implement the same standard, RFC 6238.

https://datatracker.ietf.org/doc/html/rfc6238

Re:Tell HN: I can't login to Gmail due to phone cannot be us... by kitsune_cw on Monday November 21, 2022 @10:14AM (#33693436)
I've moved from using Authy to Aegis Authenticator [0], it's open source and allows you to export an (optionally encrypted) backup of your OTP secrets offline. I trust that more than a cloud backup. Plus you can more easily migrate if Aegis ever goes unmaintained.

[0] https://getaegis.app/

Re:Tell HN: I can't login to Gmail due to phone cannot be us... by throwanem on Monday November 21, 2022 @10:02AM (#33693272)
TOTP ("Time-based One-Time Password") isn't exactly a "protocol", just a big random number as a pre-shared key plus a method for hashing that with the current time to produce a six-digit number. Whatever you're authenticating to does the same computation with the key and, if the result you provide matches the one it got, it knows you have the same key it does.

SMS 2FA is a different proposition, in that the authentication provider sends you the intended response directly. This is a little easier for nontechnical users in that it doesn't require an app that can compute TOTP responses, but it's markedly less secure in that anyone receiving or intercepting the SMS can immediately respond to the challenge, and less resilient in that you can't authenticate at all if you don't receive the SMS - which is the failure mode under discussion here.

Re:Tell HN: I can't login to Gmail due to phone cannot be us... by hobo_mark on Monday November 21, 2022 @09:57AM (#33693194)
So now your second factor is... the Authy master password?
Re:Tell HN: I can't login to Gmail due to phone cannot be us... by throwanem on Monday November 21, 2022 @10:06AM (#33693334)
Which is still strongly preferable to getting locked out of everything because Google Authenticator refuses to participate in device backups. Lucky for me I found out about that well before I moved to "2FA wherever possible", but I still had to send some vendors scans of my driver's license to get back into my accounts with them.

Maybe they've fixed that since then, but I don't care. I'd rather risk a theoretical flaw in Authy's E2EE than risk getting screwed again, and by now much more thoroughly, by the flaw I know about in Google Authenticator.

Re:Tell HN: I can't login to Gmail due to phone cannot be us... by ROARosen on Monday November 21, 2022 @10:09AM (#33693374)
Ha. Happens to be there is a script out there somewhere which allows you to extract the private key of any of your MFA codes from Authy through Chrome DevTools (it's an Electron app) so you can use it in whichever MFA solution you want.
Re:Tell HN: I can't login to Gmail due to phone cannot be us... by Freak_NL on Monday November 21, 2022 @10:04AM (#33693299)
And the private key material Authy has in its database.
Re:Tell HN: I can't login to Gmail due to phone cannot be us... by Nostrada on Monday November 21, 2022 @09:57AM (#33693189)
That is the answer. Authy can be used on several machines at the same time. Totally rocks - and is free
Re:Tell HN: I can't login to Gmail due to phone cannot be us... by Eric_WVGG on Monday November 21, 2022 @12:37PM (#33695391)
The problem is that one has to enable phone MFA before they can enable Authy/other-app MFA. I have no idea why, only theory I can come up with is the value of tying accounts to outside marketing databases using phone numbers as IDs.
Re:Tell HN: I can't login to Gmail due to phone cannot be us... by pan69 on Tuesday November 22, 2022 @02:17AM (#33703011)
I just installed Authy on my other Android phone and I need to login with my "phone number".... WTF...?
Re:Tell HN: I can't login to Gmail due to phone cannot be us... by pieter_mj on Tuesday November 22, 2022 @05:58AM (#33704391)
use aegis or keepassXC/Keepassium/Keepass2Android. These apps allow to keep (backups of) your (T)OTP secrets offline and don't require additional PII info to set up.