I lost my phone with my second factor for authentication.
How do I recover?
Hi everyone, Leo Notenboom, here for AskLeo.com. This was me. First,
my laptop, which I talked about about a couple of weeks ago.
It had a problem and died suddenly on me.
And now all of a sudden my phone, my Google Pixel Four XL,
which is about three years old, used fairly heavily, used daily for sure.
I was taking some pictures with it of the dogs, of course, and it crashed.
It just crashed hard.
There are ways to a simple power on. Did not work.
There are ways to force a power
on by holding the power button down for like 30 seconds or so.
And sure enough, that got the phone running again. Then I
was looking at the phone and it started to all of a sudden crash again.
And this time it was squealing and making all sorts of noise.
So I was able to force it off again,
got it back on was using it and it just died.
And there was no coming back.
As I point out in the article,
I was now the proud owner of a Google Pixel Four XL brick.
However, here's the problem.
As you might expect, I use two factor authentication heavily.
What did that mean?
It was all on my phone.
How did I recover?
Now, one of the things that made this more complicated than it might have been
otherwise is I was traveling while this happened.
So what that means is that the devices I
had with me weren't always set up to be trusted as well.
When you use two factor authentication,
you are most commonly allowed to say after you've entered your two factor
authentication correctly the first time, you're allowed to say, you know what?
This device is trusted.
This device does not need two factor authentication every single time.
And that's what I do here on my desktop.
That's what I do sometimes on my other devices.
It depends on how I'm going to use the device.
My phone is not one of those devices.
It's portable by definition.
It's probably the device I'm most likely to lose, which means it's the device
that I want to have the highest level of security on.
So for any site that required two factor authentication, at least on the phone,
it required two factor authentication every single time.
I didn't have my phone, I had my laptop.
Laptop is exactly the same scenario. By definition.
The laptop is the thing I'm traveling with.
It's the thing that I'm most likely to lose next to my phone.
And it's where I use my phone very often to provide two factor authentication codes
for what I'm using or what I'm doing on my laptop.
All of a sudden that was gone.
I tried to log into certain things on my laptop.
They required two factor authentication.
I didn't have it.
Or did I?
Well, it varies.
I was mostly successful.
Now, I want to be clear.
Some services do make this very easy.
Gmail is the one that was trivial for me.
Now, I realize that Gmail is also one
of the ones that a lot of people seem to have trouble with when they lose their
authentication, when they lose their password, or whatever.
The key to Gmail, and honestly, to any other account, is that
you need to set up the alternate methods of authentication before you need it.
In other words, when you set up two factor
authentication, hopefully Google will have prompted you to set up additional recovery
codes, additional phone numbers, additional email addresses, whatever.
But the point is, you need to have those in place before you need them.
And I did.
Here's an image from the article that is a companion article to this,
where I go through this in a little bit more detail that shows what I was looking
at whenever I needed two step verification on Google.
As soon as my primary method wasn't
available or couldn't be used, there's a link that I don't have this.
This isn't going to work.
It presents me with this list.
And I've got different devices I could use.
I've got a security key I could use.
I could use different email addresses.
I could get text messages to different numbers.
You get the idea.
There are a lot of alternatives here that I could use.
So logging into Google was simply not an issue without my second factor.
I simply used one of the other second factors I had available to me.
Now, one of the other methods of two
factor authentication uses SMS text messaging on my phone.
I rely primarily on Google Authenticator whenever I can.
That unfortunately died along with my phone.
We'll get into Google Authenticator in a little bit more detail in a second.
But many of the services I use don't offer that, they only do SMS.
Now, SMS is kind of controversial because apparently there are ways to hack it.
And I still claim that SMS two factor authentication is way,
way better than having no two factor authentication at all.
But it also shines in this example.
Because my phone was dead.
Sms is actually not associated with the phone.
It's associated with the phone number.
Which means that all I really had to do
was replace my phone and have my number ported to the new phone.
And all of a sudden, SMS would work again.
Now, as I said, I was traveling.
I opted not to do this immediately.
I could have run over to my local mobile
provider's store and probably swapped a phone within a couple of hours instead.
Because I knew this wasn't a disaster for me, I opted to wait until I got home.
In fact, I ordered my replacement phone so
that the replacement phone would be waiting for me when I got here.
But the point is that simply replacing the phone solves the problem.
The SMS messages go to your number, not to your device.
Your number may be associated
with the device, and that's great, but you can change the association.
And that means that when I got my new phone, my old number was still working.
All of those SMS two factor authentication notes would work as well.
That, again, was a simple one.
Now, there were some situations.
In fact, there was at least one situation
where I was traveling, where the service that I was attempting
to use supported only SMS two factor authentication.
And I didn't have my phone,
so I had no way of getting the two factor authentication code.
Like I said, I could have run over
to the phone store, got the replacement, and done the thing.
And again, in this case, I simply elected to wait until I got home
to do whatever it was I was trying to do with that service.
After my phone had been replaced, after I had gotten the new SMS capable
phone and I was able to receive SMS text messages again.
And it did.
Within a few minutes of setting up my new phone and getting it all turned
on and configured, I was able to go to that site, login,
get the SMS code, enter it, and log in successfully.
So those are the kinds of trade offs that one might make.
Now, I mentioned Google Authenticator earlier.
I use Google Authenticator heavily.
In fact, that's my preferred, and in fact
my recommended, approach to using twofactor authentication
if you have a smartphone of any kind.
I will admit I don't use Google Authenticator.
I use a Google Authenticator compatible program called Authy.
Authy.
And the reason I use it is for exactly this situation.
Authy allows you to install
on your phone and generate the codes that you need to use for two factor
authentication, but you can install it on multiple devices.
So I had it installed on my iPad that I had with me.
I had it installed on my computer at home, which I didn't have with me.
I did not have it installed on my laptop, and I'll explain why in a moment.
But I did have it on the iPad. And because
it is associated with my number my account, if you will, with Authy,
then I could generate two factor authentication codes
for Google Authenticator from either my phone or my iPad.
I didn't have my phone, but I had my iPad.
So anything that used Google Authenticator would just work.
And work fine.
Now, I mentioned I didn't have it on my laptop.
I'm kind of reconsidering that because it
would have been handy to have it on my laptop.
And in fact, if I hadn't brought my iPad,
then I kind of would have been stuck here too.
The reason I didn't have it on my laptop is because loss, right?
If I were to lose the laptop, then Authy would be with it.
But the same is true for my phone authy is on the phone.
That's what I use for Google Authenticator.
The trick is that on my phone Authy itself is further protected with a pin code
and you can't just fire up off the and see all the codes.
You actually have to have the pin code to be able to access the contents.
I'm going to probably set that up on my laptop as well.
But the important thing here is to realize
that when you're using something like Authy a Google Authenticator compatible
generator, you can have it on multiple devices so that if you happen to lose one
of your devices as I lost my phone, you've got it on other devices.
You haven't really lost your ability to provide the two factor code.
So what does this all boil down to?
The single most important takeaway here is that you need to set this up before you
need it. Be it alternate two factor methods. Be it alternate recovery
addresses, phone numbers or whatever or using a program like authy for your
Google Authenticator compatible two factor authentication.
These are decisions and things that need
to be made before you need them because when you do need them it's too late.
But if you have them in place then like
me, this can be an annoyance instead of a disaster.
Hope that's helpful. For updates,
for related links, for comments and more, visit AskLeo.com/145351
I'm Leo Notenboom and this is Ask Leo.com. Thanks for watching.