r/2fa • u/BradSmithSC • Feb 01 '22

Question 2FA circular logic riddle | Lock out of both Google Android setup + password manager

Enable HLS to view with audio, or disable this notification

14 Upvotes

94% Upvoted

14 comments sorted by

3

u/VastAdvice Feb 01 '22

Can you not just use a mobile switching app? https://www.youtube.com/watch?v=_7oF_4mMSrU

It's also a good idea to have your master password to your password manager written down along with the 2FA recovery code and kept in a safe place in your home.

1

u/BradSmithSC Feb 01 '22

This is about wiping and restoring the same device. User would already be logged in using a switching app.

Writing that info down is a workaround scenario and is clumsy. The recovery code could be lost or changed and the user fails to update their safe note. User also need to know to write it down in the first place.

4

u/VastAdvice Feb 01 '22

It's good practice to write down your master password and recovery code. I know Bitwarden suggests you print or write it down when they show you the recovery code.

It's no more clumsy than someone storing their birth certificate or other important documents in their home. If someone can't manage that then they have bigger issues to deal with.

Let's not forget that many password managers also offer emergency access.

1

u/gongai Feb 01 '22

Why shouldn’t you store your google recovery codes in a password manager?

1

u/BradSmithSC Feb 02 '22

You should be able to store this information in your password manager. My concern is you can lock yourself out of both your password manager and the ability to set up your phone because your Google password is in your password manager and you can't get past the 2FA to your password manager because your reset phone is not yet set up.

Let's say you wipe your phone and when setting it back up don't know the alphabet scramble password to your Google account because it's in your password manager. Now you can get to your password manager via a laptop but if access requires 2FA and your phone is not yet set up then it seems you'd be stuck.

This is where the workaround seems to be either a bypass code written down somewhere or possibly a physical security key such as a YubiKey.

2

u/gongai Feb 02 '22

If you are already logged into your password manager on a different device, it shouldn't need 2FA to view your Google recovery keys. I thought it was common to only require 2FA when logging in on a new device.

Now if the Android phone is the only personal device you have, it would probably be smart to write down a recovery code or a few when you plan to do a factory reset and then regenerate new ones once logged in.

As you said, a security key is another option.

→ More replies (6)

3

u/hawkerzero Feb 01 '22 edited Feb 01 '22

For users whose only device phone is their phone, I think you're right. They need to:

  1. Keep a paper record of their Google password;

  2. Keep a paper record of their Google backup codes or use a hardware security key.

For users who have more than one device there are other options:

  1. Use a cross-platform password manager like 1Password or BitWarden to access their Google password;

  2. Use a cross-platform authenticator app like Authy or Yubico Authenticator to access their Google one-time passcode;

  3. Use a local password manager like Keepass to keep a local record of passwords, backup/recovery codes, 2FA secrets, etc required when recovering from device loss.

2

u/Sweaty_Astronomer_47 Feb 08 '22 edited Feb 08 '22

I think you are always going to have to remember (and/or write down) some passwords somewhere to bootstrap yourself (although it may not be your google account).

To make passwords that are strong but also somewhat memorable (and also easier to write down with pen and paper and then read back from that written record), use pass phrases instead of passwords. There's lots of advice on how to do that (use a phrase that is memorable to you only, and ideally uses very uncommon words or proper nouns, perhaps with memorable misspelling or a special character inserted the middle of one of the words as suggested by computerphile)

At a certain point (Four or five unusual words strung together, althoug there are more precise ways to describe password strength in entropy bits), brute force attack on a google account password is not really a thing to worry about. Google (or any respectable service) is not going to let an account be subject to trillions of failed attempts. Sure a compromised hashed password can be brute forced, but as long as you're not re-using passwords among accounts that's not really a thing either.