<story><title>Tell HN: It is impossible to disable Google 2FA using backup codes</title><text>I would like to inform the HN community, if your plan to recover your Google account in the event of losing your phone is to use a 2FA backup code, or SMS recovery, to remove the old 2FA setup and set up a new 2FA code, that that may not be possible.&lt;p&gt;My situation:&lt;p&gt;I had 2FA set up with my Google Account through Google Authenticator.&lt;p&gt;I lost my Google Authenticator settings when I broke my phone.&lt;p&gt;I have 2FA backup codes.  These successfully log me into my Google Account.&lt;p&gt;In order to disable 2FA, or generate new 2FA backup codes, I need to access the 2FA settings page under the Security tab.  When I try to load the Two-factor authentication page, I am forced to re-authenticate with Google.&lt;p&gt;When re-authenticating to access the 2FA page, there is no option to enter a 2FA backup code or SMS verification to pass the 2FA challenge.  The only option under &amp;quot;Choose a way to verify&amp;quot; is to enter a 2FA code.  Entering a backup code instead of a 2FA code returns an error.&lt;p&gt;What am I supposed to do in this situation?&lt;p&gt;Yes this is a classic &amp;quot;maybe I can get support through public shaming&amp;quot; attempt.  Thanks in advance.</text></story><parent_chain><item><author>arduinomancer</author><text>How does that work? Do you have to carry around a Yubikey&amp;#x2F;Dongle everywhere with your phone?</text></item><item><author>loriverkutya</author><text>Instead of SMS, get a pair of yubikey recommended by some other posters, so you are not depending on your mobile provider as they own the number and it is just &amp;quot;rented&amp;quot; to you.</text></item><item><author>nicoburns</author><text>This is why I use SMS as my second factor for my Google account. Much harder to lose. It could be vulnerable to sim swapping attacks, but I consider Google locking me out of my own account a more likely threat (and frankly I&amp;#x27;m probably not a high-profile enough target for anyone to bother with that, and in any case they&amp;#x27;d still need my password).</text></item></parent_chain><comment><author>vel0city</author><text>For my phone, I&amp;#x27;m already logged in and never get any future challenges. I needed the Yubikey when I first logged into my phone, but after that the phone has been authenticated. If I unlink my phone to my Google account I&amp;#x27;ll need the Yubikey again, but I don&amp;#x27;t normally do that. So normally I don&amp;#x27;t carry a Yubikey with me, like when I go to the store and what not.&lt;p&gt;That said, I do keep a Yubikey with me in my bag when I travel in case my phone breaks and I need to authenticate into a new device. I do take a Yubikey with me going to and from the office as there are other services and platforms which do challenge my Yubikey more often.</text></comment>
<story><title>Tell HN: It is impossible to disable Google 2FA using backup codes</title><text>I would like to inform the HN community, if your plan to recover your Google account in the event of losing your phone is to use a 2FA backup code, or SMS recovery, to remove the old 2FA setup and set up a new 2FA code, that that may not be possible.&lt;p&gt;My situation:&lt;p&gt;I had 2FA set up with my Google Account through Google Authenticator.&lt;p&gt;I lost my Google Authenticator settings when I broke my phone.&lt;p&gt;I have 2FA backup codes.  These successfully log me into my Google Account.&lt;p&gt;In order to disable 2FA, or generate new 2FA backup codes, I need to access the 2FA settings page under the Security tab.  When I try to load the Two-factor authentication page, I am forced to re-authenticate with Google.&lt;p&gt;When re-authenticating to access the 2FA page, there is no option to enter a 2FA backup code or SMS verification to pass the 2FA challenge.  The only option under &amp;quot;Choose a way to verify&amp;quot; is to enter a 2FA code.  Entering a backup code instead of a 2FA code returns an error.&lt;p&gt;What am I supposed to do in this situation?&lt;p&gt;Yes this is a classic &amp;quot;maybe I can get support through public shaming&amp;quot; attempt.  Thanks in advance.</text></story><parent_chain><item><author>arduinomancer</author><text>How does that work? Do you have to carry around a Yubikey&amp;#x2F;Dongle everywhere with your phone?</text></item><item><author>loriverkutya</author><text>Instead of SMS, get a pair of yubikey recommended by some other posters, so you are not depending on your mobile provider as they own the number and it is just &amp;quot;rented&amp;quot; to you.</text></item><item><author>nicoburns</author><text>This is why I use SMS as my second factor for my Google account. Much harder to lose. It could be vulnerable to sim swapping attacks, but I consider Google locking me out of my own account a more likely threat (and frankly I&amp;#x27;m probably not a high-profile enough target for anyone to bother with that, and in any case they&amp;#x27;d still need my password).</text></item></parent_chain><comment><author>sjf</author><text>I have a yubikey on my keyring. It&amp;#x27;s superior to sms 2fa in everyway. Its almost impossible to damage a yubikey- phones can easily be broken or stolen. You can have multiple keys linked to your account- Google only let&amp;#x27;s you have one phone. Yubikey can&amp;#x27;t be sim swapped. Never needs to be charged or have cell reception, no problems with sites not accepting international phone numbers.&lt;p&gt;The only downside is that Google is the only site I used that supports it.</text></comment>