A lost second factor tale of woe and how to avoid having your own.
Hi, everyone.
Leo Notenboom.
Here for Askleo.com. As you probably know, I talk about password security
and password vaults and the importance of two two factor authentication as being
a very important part of your overall account security.
One of the questions I get, of course,
is what happens when you lose your second factor?
There was a post from another tech journalist, Bob Sullivan.
Link will be in the companion article
to this video, which is linked down in the description or nearby
that described a scenario that he had an experience he had when he lost his
phone, his mobile phone that had his second factor software on it.
He ran into several problems,
and I wanted to go over what some of those problems are,
how we can sidestep those problems with a little bit of preparation,
and ultimately how customer service really failed him.
So I want to be clear before we dive in, this isn't about the journalist.
He did a fine job.
He did everything he was supposed to do.
He set up his two factor authentication.
He had recovery codes.
He had all the things you're supposed
to have to presumably not only keep your account secure, but be able to recover
from the scenario that you lose your second factor.
Needless to say, he had a rough time.
He actually had two accounts,
both with Instagram, one of which he was unable to recover,
at least at this recording, that if you go and read his article,
you'll understand why it's basically his dog's account and things get confused.
But bottom line here is that there were
several steps along the way where stuff happens.
It just does.
I know it'll happen to me sometime,
and you can prepare for it, but you need to know to prepare for it,
you need to make a few slightly different choices than what the common path down
twofactor authentication might have you do.
Now, to be clear, he didn't lose anything.
Like I said, he was doing things right.
He had stuff backed up.
But here's his quote.
I didn't really lose anything except my sanity as I tried to lock back
into sites where I had employed Google Authenticator.
You see, there is no way to restore that.
That right there, that's the problem.
He's absolutely right.
Google Authenticator isn't I'll say portable.
By that I mean Google Authenticator is set
up to display your second factor random number on your device, period.
If you lose the device, you have lost that instance of Google Authenticator.
You have lost your second factor.
Now, we'll get into recovery mechanisms in just a moment,
but if you lose your second factor like that, that's when the trouble starts.
We can avoid that trouble.
There are at least two different approaches you can take to prevent losing
your Google Authenticator from being a problem.
The number one solution,
the solution that I used for many years, honestly, is to take a screenshot
of the QR code when you set up two factor authentication,
the mechanism usually involves displaying a QR code on your computer screen.
That you then take your mobile phone, running the Google Authenticator app,
and using that app to basically sync that QR code with Google Authenticator.
If you take a screenshot of that QR code
first before you use it and save that file somewhere secure so you can use it later,
you now have a safety net if you can't do a screenshot.
In Google's case, there's an alternate,
and this is true for many I won't say all, but many of the folks that are using
Google Authenticator compatible QR codes and twofactor authentication.
When the QR code is displayed, there may be a link,
or there just may be textual information that says, here's the key in text format
usually looks like a long, random string of random characters.
That's fine, save that it's the same thing.
Ultimately, that string,
that list of characters, is what the QR code represents and makes
easy for you to get into your Authenticator app.
You can alternately type very carefully that long, random string of characters.
But of course, it's going to be much easier to take a picture of the QR code.
Nonetheless, before you sync your Authenticator app
with that QR code, either take a screenshot of it or save
that code that gets displayed, that random string.
Here's why.
Let's say you do that some days, months,
even years from now, you lose your phone, you lose your Google Authenticator app.
You lose your ability to provide the code you need to prove you have your second
factor, because you don't have your second factor.
Great.
Replace your phone.
Install the Google Authenticator app.
Go get the image of the QR code that you saved when you first set things up.
Scan that with a Google Authenticator app. You're done.
You're good to go. You have your second factor again.
You've got the QR code that was given
to you months, days, years ago, and you've used it to establish the exact
same second factor pairing that you had originally.
Like I said, problem solved.
You're done another approach, and honestly, the approach that I've moved
to, for the most part, is I use an app called Authy.
A-U-T-H-Y Authy is one of several Google Authenticator compatible apps,
which means that essentially, it does the same thing.
You can set up a pairing, you scan a QR code,
and Authy then presents you with the number that you're supposed
to type in when you are requested to prove you have your second factor.
Authy has two features that I think make it much preferable to Google Authenticator.
One, you can apply what they call a backup password.
What happens when you do is Authy does two things.
One is it encrypts all the information
about your two factor pairings and two stores.
It in the cloud.
That means it enables item number two.
You can have Authy installed
on multiple devices with the exact same twofactor codes.
So, for example,
when I'm asked for a twofactor code here at my desk, I have a choice.
I could reach into my pocket, pull out my phone, launch the Authy app,
and find the twofactor code I need for whatever I'm signing into.
Or I can launch the Author app
on my desktop because I have it installed on Windows as well.
That makes it very easy, that's flexibility.
But here's the interesting scenario.
What happens when you lose your mobile device?
What happens when you lose your phone?
With just Google Authenticator,
you no longer have your second factor with Authy.
You still do.
Your recovery process looks like this.
You replace your phone, you install Authy, you sign in to Authy.
All of your twofactor codes reappear
because Authy saved them for you, and you're good to go.
And in fact, even while you're waiting for your
replacement phone, you can still sign in using twofactor
authentication because you've got Authy installed on a different device.
Maybe you've got it installed on Windows.
Maybe you've got it installed on a tablet.
Maybe you've got it installed on your spouse's device as well.
Either way, you've got multiple ways of getting the second factor.
So those are ways to basically prepare
for this kind of scenario being a complete nonevent.
What if you didn't prepare?
What if, like this journalist, you didn't do these two steps or either
of these two steps to prepare for potentially losing your second factor?
Well, then we enter what's called what I call recovery mode.
Again, to quote the journalist.
So every site which required
an authenticator code now required an alternative sign in process.
Yeah, this is the standard safety net for losing your second factor.
It's very much like password recovery.
It's the I forgot my password line
of questions where you say, okay, I don't have my second factor.
They go into a mode where they start asking you for different information.
They might ask you for a code that they text to your phone number.
Well, that doesn't help. If you have lost your phone,
they might ask you for a code that they email to your alternate email address.
They might ask you for recovery codes that you were instructed to print and save
when you originally set up two factor authentication.
Any of those should, in theory,
prove you are who you are and should be allowed back into your account.
Now, in the case of our journalist, that didn't work.
He actually was relying on recovery codes.
He did the right thing.
He saved his recovery codes.
He had them available, and they didn't work.
And that's where the service he was using fell flat on its face.
Again, to quote,
When security isn't accompanied by customer service, it's a failure.
Absolutely, 100% in this case, instagram failed and failed hard.
But you're not going to like this.
I've been saying this for years.
When you're using a free service, you get what you pay for.
You should go in with the expectation of there being no customer service.
It's the only pragmatic answer,
because in many cases, what customer service there is, is basically none.
It's very close to none.
It's certainly not a person you can talk to.
It's not an email address you can email, it's not a phone number you can call.
It's none of the above.
If you can't get the problem resolved
on your own, you can't get the problem resolved.
And that's kind of where he found himself now.
So what do you do in the face of this?
How do you use security if you can't rely
on there being somebody to save you when things go wrong?
Well, like I said, this does mean taking
the extra steps, like I talked about, for things like Google Authenticator.
But it also means just being realistic about what to expect.
It may mean you use the service differently.
It may mean you treat security differently.
It may mean you use a different service completely.
Not always an option if you're trying to connect with people on services
that they decide are to be used, like Instagram in this particular case.
But the bottom line is you need to be
aware that there may not be that safety net of customer service.
You need to create your own safety net.
And that's what I hope we've done here,
is given you a couple of ideas, ways to protect yourself from potentially
losing your second factor and ultimately then having it be a complete nonissue.
For updates, for comments,
for related links and more, visit askle.o.com/149975
I'm Leo Notenboom.
And this is Askleo.com.
Thanks for watching.