News for hackers. Stuff that matters.

A comment on Tell HN: It is impossible to disable Google 2FA using backup codes. Parent comment

Re:Tell HN: It is impossible to disable Google 2FA using bac... by gravitronic on Thursday January 19, 2023 @01:22PM (#34443636)
In this particular case I feel like it's a bug that backup codes are not treated as secure as 2fa codes, and that I need explicitly a 2fa code to disable 2fa is just broken (in my specific case)
[ Parent | on HN ]
Re:Tell HN: It is impossible to disable Google 2FA using bac... by vel0city on Thursday January 19, 2023 @02:26PM (#34444452)
Right? Backup codes should be considered the most secure overrides for the other resources. What's the point of them being "backup" codes if you'll need something other than the backup for a break-glass event?
[ Parent | on HN ]
Re:Tell HN: It is impossible to disable Google 2FA using bac... by beej71 on Sunday January 22, 2023 @01:15AM (#34474877)
It definitely seems like a 1FA backup instead of a 2FA backup in your case. :(

I used this horror story to move to Aegis from Authenticator and make an encrypted backup copy of the OTP vault, so thank you for posting. FWIW.

[ Parent | on HN ]