What if I forget my passwords if I use two-factor
authentication?
Hi, everyone. Leo Notenboom here for askleo.com with what
feels like a pretty complicated situation. Two factor
definitely does feel more complicated. Before we go on,
if you're not a patron of Ask Leo, you might wanna consider
joining us. askleo.com/patron. Much of Ask Leo is
supported by the patrons and I'm really, really grateful.
Patreons get access to additional patron-only content
and an ad-free experience whenever they're visiting
askleo.com. So, the important thing to remember here is that
passwords and your second factor are essentially two
separate things. In other words, there's nothing special
about two factor when you lose your password. In some cases,
it actually makes a little bit easier to recover your password
but the point is that losing your password is still losing
your password. There's nothing that makes it any better or
necessarily any worse if you happen to also use two-factor
authentication on that account. It's a separate thing. It's a
second factor. In a lot of ways, it's important that they
be independent. Your password is your password, your two
factor is your two factor. If you lose either of them, there
are techniques for recovery either of them, they may
involve using the one you do have but they're separate.
That's the easiest way I can put it. Now, what's important
is to understand that you do need to set things up so that
recovery of either of them will work and that Means, kind of
stuff that I've been talking about for a long time already.
That means you need to establish all the recovery
information that your account allows you to establish. That
could be alternate Email addresses. It could be
alternate phone numbers that can take an SMS or voice code.
It could be backup codes that you print out when you set up
your account or when you establish Two Factor
Authentication. It could be a recovery code that you set up
when you decide to set up a recovery code that you keep in
a safe place to be used for exactly this scenario. That's
I'll call it two thirds of the problem. If you get all that
set up, you can recover losing either your password or your
second factor. The other third, the missing third, you gotta
keep that stuff up to date. The alternate Email addresses have
to work when you need them. The phone number that you set up
for recovery, it's gotta work when you need it. If they
don't, if you've set up an Email address as your recovery
Email address and over time, you no longer have access to
that account, you can't recover. If you set up a phone
number, as your recovery phone number, and over time, you lose
access to that number. Maybe you changed your number. Maybe
you lost your phone. I don't know. You just don't have
access to codes sent to that number anymore. You may not be
able to recover your account and again, this is the same
whether it's your password you've lost or your two-factor
authentication you've lost. It's critical that you keep
your recovery information current. It's critical that you
configure your recovery information and that you keep
it up to date. So, there are three things. The bottom line
here is that there are three things you need to do. One, use
strong, unique passwords for every site. This is best
practices, the easiest and simplest way to keep you secure
across all of your accounts. Use two-factor authentication
wherever it's offered. It's an amazing level of additional
security. It has it's flaws, don't get me wrong but it is
the best way to secure especially those most important
accounts from getting hacked. Even if a hacker knows your
password, they can't get in if you've got two-factor
authentication configured and finally, above all, keep the
recovery information configured and keep it up to date. That is
critical to being able to get back into your account whether
you lose your password or your two-factor authentication. I
hope that was helpful. For updates, for related links, for
comments, and more, askleo.com/134181. I'm
Leo Notenboom. This is askleo.com. Thanks for watching.