The LTB Network Forum

PSA: Backup Your 2FA Google Authenticator!

Back to Bitcoin & Beyond

Comments

jamesmm

Offline
Posts: 131
Location: Texas, Block #301130

Well, looks like I've lost access to a few accounts and about .15btc, uhg :(

I use Google Authenticator 2FA when possible, try to stay safe. My phone was running very slow, battery draining in a few hours, so I did a factory reset. I was happy because it seemed to fix the problem with my phone........ but I made a horrible assumption.

I assumed Google Authenticator entries would just be saved online. Well, they are not.

Apparently when you first setup an account in GA you should also save the code in a safe place. Something I just didn't realize.

In the future I will opt to use 2FA with SMS when possible.

Google Authenticator has a process to move or add GA to a 2nd phone, but that doesn't help in the case of wiping or even loosing your phone.

But I wanted to share, make sure you were aware and get you others that use GA to make some kind of backup.

Stay Safe!

Posted on January 29, 2015 at 2:21 AM

0 likes

• Disengage

  

  Offline
  Posts: 31

  If you have an old Android phone sitting around that still works, you can use that as a backup device.
  Also, maybe dont use Authenticator for every 2FA. I use sms for some even when authenticator is an option.

  Posted on January 29, 2015 at 6:56 AM
  Permalink
  0 likes
• Rob

  

  Offline
  Posts: 604
  Location: California

  Thanks for making this point. Can I ask what accounts were lost? Many sites have ways to recover, even if you lose your 2FA…

  BTW, I liked the following suggestion… sort of…

  When you get a 2FA QR code to scan, print it out. Then scan from the printed paper (to be absolutely sure your 2FA and the paper print are exactly the same), and keep the paper somewhere save as your backup. I've never done this, but seems like a good idea.

  Posted on January 29, 2015 at 2:28 PM
  Last Edited: January 29, 2015 at 2:30 PM
  Permalink
  0 likes
• jamesmm

  

  Offline
  Posts: 131
  Location: Texas, Block #301130

  Well, that's another issue I realized with this whole situation I got myself into. I had many entries/accounts in my GA and I can't quite remember all of them.

  I do of course know the places where I had the ~.15btc, which was Bitfinex and Cryptsy.

  With Bitfinex I was able to have them reset the 2FA on my account. At first I was happy, because I was able to get my meager .05btc back, but then I started question the whole 2FA. I had just sent a simple email asking if it was possible from the same email as my account, and they did it. Pretty darn quick too.

  I did however include in my email an approximate amount/balance I had, so maybe they used that as verification. And there is also a 5 day suspension of withdraws, so that's a good feature too.

  The other account that I have not been able to reset is Cryptsy. I sent an email to support and got a reply back, but it seems to be a standard GA response. It's very short and just give a link to the support page on Google for GA. Just last week I sent .1btc and got some Ripple coins, but had failed to move the to my Ripple wallet. :( I actually tried at the time but it was giving me an error and I didn't investigate. I just gave up and said I would come back soon and get it moved over.

  This got me thinking, it would be a neat to see sites and services offer a 2of3FA, kinda like multisig.

  Posted on January 29, 2015 at 2:51 PM
  Last Edited: January 29, 2015 at 2:54 PM
  Permalink
  1 like
• rafabit4000

  

  Offline
  Posts: 32

  This verification conditions is very safe to have accounts on websites. But it will only work on some sites if you have the iPhone with Android installed or another compatible platform. This can be a problem since it is advisable you write down the codes that are generated randomly. Store in a safe place for later need.

  Posted on January 29, 2015 at 3:46 PM
  Permalink
  0 likes
• jamesmm

  

  Offline
  Posts: 131
  Location: Texas, Block #301130

  It looks like I'm able to reset the 2FA at Cryptsy too. They using security questions that I luckily filled out.

  Which is yet another thing I realized. Most of these accounts I created several months ago with no intent on using. I was just looking/learning. Since I've become interested in other coins and have now used these accounts to acquire them.

  Lesson be learned, inventory your accounts! Security questions, backups, codes, etc

  Posted on January 29, 2015 at 3:53 PM
  Permalink
  1 like
• dpc

  

  Offline
  Posts: 191
  Location: Central California

  Two suggestions:

  Authy.com - not quite as secure as google auth since you can use it on multiple devices, but it's more convenient and you won't lose your 2fa when one device goes down for the same reason.

  OR

  Backup your google auth app/data regularly.

  I had a similar experience as you. I was able to reset 2fa on all the accounts, but it was a pain.

  Posted on January 30, 2015 at 12:19 AM
  Permalink
  0 likes
• Rob

  

  Offline
  Posts: 604
  Location: California

  @dpc Backup your google auth app/data regularly.

  I think the Google Auth app doesn't allow it's data to be backed up in many standard backups (and in cases it does allow backups, is the backup securely encrypted, with a very strong password?). My worst fear would be someone hacking my computer, and also scoring my 2FA backup. I prefer the idea of printing the initial QR code, and keeping it offline.

  Posted on January 30, 2015 at 8:08 PM
  Permalink
  0 likes
• dpc

  

  Offline
  Posts: 191
  Location: Central California

  @rob

  @dpc Backup your google auth app/data regularly.

  I think the Google Auth app doesn't allow it's data to be backed up in many standard backups (and in cases it does allow backups, is the backup securely encrypted, with a very strong password?). My worst fear would be someone hacking my computer, and also scoring my 2FA backup. I prefer the idea of printing the initial QR code, and keeping it offline.

  Good point. It's a tradeoff between usability and security. Just having 2fa will guard against most attacks, so using it with unencrypted backups is still better than not using it at all. But I like your solution for as a best practice for the most sensitive logins.

  I use authy for most of my 2fa (which is admittedly way less secure, but way more convenient). For senative logins I use a different 2fa. I think I'll use your backup solution for that. Thanks.

  Posted on January 31, 2015 at 8:33 AM
  Permalink
  0 likes

Post Reply