Don't Use 2FA Without These! What Are 2FA Backup Codes?

[@xileets]

Users ALWAYS gotta remember that their account is only as secure as the weakest login option. If you cannot disable SMS, for example, this is the strongest your account can get. Personally, prefer OTP apps because I always lose dongles, but still love the use of hard passkeys.

[@shegocrazy]

I have 2 yubikeys but unfortunately too many places don't support setting up two yubikeys.

[@jeff_9074]

What about in the event a user has its email hacked. The attacker browses the email, and finds an email from a website the user belongs to. The attacker navigates to the website and changes the email address and password. Should backup codes be a method of account recovery? If so should a user be able to recreate them on their own? In this case the attacker can just reset them negating their use..

[@TomO-nx1bd]

I have often worried about this too. But I wonder if somebody breaks in and resets the codes it may not go into effect until later. I know Microsoft accounts are like that with recovery emails. For example my dad passed away and I had his password but his recovery email was another email which I changed to be my email, but the change took 30 days to apply. Maybe it's the same with recovery codes? So if you get locked out, as long as use the recovery codes within 30 days they will still work, regardless of what the hacker does to change them. Not sure if that's how they work though.

[@jeff_9074]

@@TomO-nx1bd Thanks for the feedback, and Sorry to hear about the passing of your father. That's a good process to have a waiting period for changing an alternate email. I still haven't really found the answers I'm looking for, as it seems there really isn't a sure fire way (yet) to easily gain back control of an account from a malicious user when a user's email was compromised. Some say, to allow verification with security questions and answers, and ID, some disciplined in security say not to allow work arounds, as that defeats the purpose of the backup codes. Which I believe for example, Gmail only allows a one time creation of. I ask 4 different security "experts" and get 4 different answers...

[@jeff_9074]

@@TomO-nx1bd And the person in this video never even responded.

[@person-fy8kd]

Lost my main secret key glad I listened to this advice and had 2fa backups

[@ShannonMorse]

whew!!

[@shgysk8zer0]

I keep mine on an encrypted flash drive. So, in a sense, there's 2FA in getting them (the physical thing + a strong password to decrypt everything).

[@TylerAlderson]

Wouldn't it be more secure to erase all the backup codes in order to prevent a brute force? To overcome the lack of backup codes use just an other app/key instead?

[@MaxPower-11]

Yubikeys keys are cool and all, but once passkeys are adopted more widely I can see their utility diminishing greatly since their function can be replaced by TPM or TEE elements in existing devices. These elements provide the same type of “something you have” factor but without having to carry around extra hardware. I guess Yubikeys might still be useful for physical device access (vs. logging into online resources) although technically I guess one could setup say a mobile phone as a required factor for logging into a PC in place of a Yubikey.

[@kg4tri]

When it comes to Business accounts and company owned devices Passkeys are going to be useful. I have had an account hacked several times and the only thing I trust is something that doesn't rely on wireless technology. Anything wireless is more hackable then something in your pocket . A physical device that I can take from one device to another is better then one installed on a single device . I don't like or trust cloud serves either for a few reasons. Passkeys can be used on Devices with TPM or TEE elements for added security. The more walls and encryption you put up the harder it is to be hacked. The TOR network works this way.

[@ShannonMorse]

I'd rather have a physical passkey than one that's tied to a phone - even if I'm not uploading that passkey as a cloud backup, a phone is more likely to get stolen than a little flashdrive I've hidden somewhere.

[@jeffhale1189]

Thanks for sharing…great information. Blessings on your day!

[@Melker63]

Having your old phone fully functional even after you bought your new phone, seems to me to be more practical. The installed app authenticator on the old phone works as backup to the installed app authenticator on your new phone. Always have two fully functional app authenticators installed and working at any given time.

[@ShannonMorse]

Great idea! I definitely don't find carrying two phones to be practical every day but do keep authenticator apps duplicated on my old phone. However, since time based codes can be stolen, the hardware tokens are still stronger since there is no human-readable code to be typed in.

[@ColoRadio6996]

GM Shannon, always has great content... J

[@FluffriousCorgii]

Hi! I have terrible decision bout backup codes. I never use them because I not trusted it but I’m conflicted rn

[@janokartal5690]

Nice one Shannon

[@jsleezy914]

i tottally am in love witrh Shannon 🥰🥰🥰🥰🥰 look are cool and all but an intelligent mind is everything!! great content for us tech peeeps!!!!!!!! 🙃🙃🙃

[@Godisgood-p9v]

I re install roblox when i went back on 2fv and i never pit it on 😢😢new 😭😭😭😭

[@bernie.avtechnician9120]

So once I have used the backup code, how do I disable my 2fa in say my crypto exchange, so I can start from scratch and then activate the 2fa again

[@ShannonMorse]

This entirely depends on the crypto exchange. I would suggest going into your security settings and checking if there's a way to turn off 2fa, remove your key or authenticator app, then start over.

[@jamiebury1807]

i prefer to just write them down safely but ofc its handy they saved them, but i dont see it being great, i mean if u have lost your password and cant get in to get the codes what good is it?

[@crc-error-7968]

Hello Shannon, I just bought 2 keys, is it possible to use one as primary and the other as "backup"?

[@ShannonMorse]

Yes!! I'm working on a video tutorial!

[@crc-error-7968]

@@ShannonMorse Thank you! Can’t wait to see it! 👍👍

[@DixonLu]

Any 2nd factor device (like Yubikey) is one more thing to remember to bring on a trip that can be lost. Where can I put it that is less vulnerable than my phone?

[@MaxPower-11]

Well, the whole point of 2-factor authentication is that one of the factors is something that you *physically* have to have with you. As such, you are going to need to carry that *something* with you. Now once passkeys become prevalent then your physical phone or PC can act as that second factor and conceptually replace a Yubikey for logging into online resources. This is more secure than 2FA SMS authentication because although SMS authentication does require that you have physical possession of your phone to receive the SMS, the SMS itself can be redirected to different phone through a SIM swap attack. With passkeys though, your phone is immune to SIM swapping attacks because the cryptographic key is securely stored on the device itself, rather than being associated to your phone through your line with your wireless carrier. Passkeys are a pretty ingenious invention and hopefully they become more widely used.

[@ShannonMorse]

This is a solid reply, thanks Max!

[@reefhound9902]

@@MaxPower-11 SIM swaps are rare, much rarer than youtube experts would have you believe. And new FCC rules now require all carriers to support Number Lock. Authenticator apps are not "something you have". If you have the seed value or QR code, you can set up 2FA in as many apps or devices as you want. You could have your auth codes being generated by many different people on many different devices at the same time. And you wouldn't even know it. At least with SIM swap, you will know it because your phone quits working.

[@MaxPower-11]

@@reefhound9902 I was clearly talking about Passkeys (specifically, device-bound Passkeys), not TOTP-based authenticator apps (which is what you are reffering to).

[@MaxPower-11]

@@reefhound9902 I am clearly referring to device-bound Passkeys, not Authenticator apps (which is what you’re referring to).

[@jamesedwards3923]

2 FIDO keys? I have way more than that.

[@ShannonMorse]

Technically I have like 12 :P