Two-factor authentification backup-codes

[Saltkin 0]

I'd like to use the two-factor authentification, as you suggest. However, I don't feel comfortable doing so, because I'd be screwed if I lost my phone then.

That risk would be eliminated, if you'd offer backup codes, like most services using 2FA do.

Let me know what you think! :)

Edit: Here's someone that already fell victim to this: https://forum.elysium-project.org/topic/33736-no-login-after-smartphone-crashreset2fa/

 

Edited January 19, 2017 by Saltkin

[ikkuranus 0]

This would be redundant as you can simply save the 2fa key hash that is provided in the email (when you enable 2fa) for later use in recreating your existing google authenticator (preferably in a secure password database such as keepass)

If you deleted that email simply deactivate the 2fa from your account and configure it for a 2nd time and this time save the hash for backup.

 

Edited January 19, 2017 by ikkuranus

[Saltkin 0]

Are you sure that code doesn't just last for a limited amount of time? If it doesn't, that solution would be sufficient.

[smokeit 26]

I don't get it, I recently (3 days ago actually) changed from my chinese doogee android phone to an lg one, google backup simply put back my files + authenticator app WITH all my connected accounts with it. Who needs a backup code?

[Saltkin 0]

On 23.1.2017 at 4:44 PM, smokeit said:

I don't get it, I recently (3 days ago actually) changed from my chinese doogee android phone to an lg one, google backup simply put back my files + authenticator app WITH all my connected accounts with it. Who needs a backup code?

Not a bad point. I didn't even think about app-backups. That's a sufficient workaround for me!

Since not everyone keeps backups of his apps, I'd suggest placing a note somewhere near the 2FA activating process, advising people to do so.

Edited January 25, 2017 by Saltkin

[Baakeer 0]

I personally recommend using the Authy application on both iOS and Android. It's easy to recover 2FA Accounts if you get a new phone or even a new number, just dont get a new number as you need to use a form and the team has to verify its you. :) But as long as you have the same cellphone number you will be fine. I personally have this application on my iPhone, iPad, and my LG G4 as well as my desktop so I will never lose access to these devices.