Backup codes come from the service which is 2FA protected anyways, not from the 2FA authenticator itself.
Edit: oh, reading your message again, are you referring to SMS-based 2FA? I assumed TOTP 2FA in this submission. If you mean SMS-based 2FA, then yeah I agree, makes your account less secure than not having 2FA at all.
If your phone based code system is also available on other accounts, and you can access those other accounts without the phone then maybe. However many people only have a phone, and no other computer (or at least not a computer they use often enough that we can trust the 2fa isn't expired).
The 2fa I've seen mostly has a SMS based fallback, and thus is no more secure than SMS.
Well, you could if you want to. That you don't want to, is a failure on your part, not on "everyone"'s part, since most phones do offer you the feature of setting a sufficiently secure password.
> However many people only have a phone, and no other computer (or at least not a computer they use often enough that we can trust the 2fa isn't expired).
You don't need a second device in order to backup your codes. By leveraging "cryptographic splitting" you can divide a secret into N parts and share them with friends and family, and if you need to regain access, ask them each for their part back and then you can recover from there. Now I guess that's kind of advanced so most people won't/can't do that, but it is possible at least. You could try something like https://iancoleman.io/shamir/ if you're curious about the process, I've done this myself for some things.
Easier solution is to create a encrypted archive with your backups, and upload to various cloud services. As long as the encryption scheme is secure, you'll be safe.
> The 2fa I've seen mostly has a SMS based fallback, and thus is no more secure than SMS.
I'm using TOTP 2FA for 100% of every service I use and that offers it. I think only one requires SMS-based fallback, the rest are optional so obviously I'm not using that.
You mean that you specifically do not have a secure password on your phone because you chose not to. The rest of us use finger print sensors or facial recognition to make our devices as secure as can be. Your argument applies only to you and a handful of people.
The SMS fallback is always combined with your finger print in all applications I've used.
Disable biometrics when handing the phone to somebody else or even remotely (e.g. mark as lost via “find my”).
Good compromise of usability and security.
I never use biometrics to unlock my phone or computer for that reason.
thanks! i always wondered
If this situation happens you can rapidly press the home button with the wrong finger and the phone will demand a pin code. Or you could turn it off. I don't know what recourse people with face unlock have.
I think you’re overextrapolating from your experience. I‘ve used Face ID on my phone for 5-6 years now, and the fingerprint sensors on my recent devices have been very reliable.
The password itself was generated randomly and I managed to memorise it (it took a while).
Loss of a phone with a 2FA authenticator app isn't a security problem, unless one failed to make backups of the 2FA secrets for restauring.
... or re-initialize 2FAs from their original seeds, which are typically hidden under a "set up manually" option during the enrollment process.
I'm concerned about the online accounts for which I don't have backup codes.
Is this a bad way to do backup?
There are two possible outcomes from contacting support for a service, asking to regain control over a 2FA-protected account, both which sucks, but on different levels.
1. You write them, proving who you are, and they tell you to get lost unless you have the 2FA proper codes, or backup codes. This sucks because you still didn't get access.
2. You write them, proving who you are, and they give you access to your account, so you can reset 2FA. This sucks because this means the service is not secure and you/others can be "hacked" because customer support can be exploited.