2FA is a maintenance nightmare.
I have 2FA turned on for Github. Since they refuse to recover accounts that have 2FA enabled if you lose your second factor, I have many alternative ways configured: TOTP, U2F, recovery codes, recovery phone number.
I have the recovery codes stored in a secure location, and several U2F tokens enrolled (one of them is also off-site at a different location).
But I didn't back up my TOTP seed. I still have the old phone with Google Authenticator, but it's too old to accept the version that lets me export my keys.
Getting a new TOTP seed requires me to re-setup 2FA, which will invalidate the recovery codes and possibly unenroll my security keys (it says "This will invalidate your current two-factor devices and recovery codes.")
It's also apparently impossible to set up Github 2FA with "only" a set of security keys + recovery methods - you have to first set up an authenticator app or SMS 2FA as a primary method.
So now my options are:
- Leave the dead TOTP on the account, and don't have a working TOTP setup
- Re-setup from scratch, invalidating the recovery codes and possibly U2F tokens, requiring me to visit two distinct off-site locations to re-setup everything, one of which is currently locked down and inaccessible due to Coronavirus.
And Github is one of the better sites when it comes to 2FA!
I have 2FA turned on for Github. Since they refuse to recover accounts that have 2FA enabled if you lose your second factor, I have many alternative ways configured: TOTP, U2F, recovery codes, recovery phone number.
I have the recovery codes stored in a secure location, and several U2F tokens enrolled (one of them is also off-site at a different location).
But I didn't back up my TOTP seed. I still have the old phone with Google Authenticator, but it's too old to accept the version that lets me export my keys.
Getting a new TOTP seed requires me to re-setup 2FA, which will invalidate the recovery codes and possibly unenroll my security keys (it says "This will invalidate your current two-factor devices and recovery codes.")
It's also apparently impossible to set up Github 2FA with "only" a set of security keys + recovery methods - you have to first set up an authenticator app or SMS 2FA as a primary method.
So now my options are:
- Leave the dead TOTP on the account, and don't have a working TOTP setup
- Re-setup from scratch, invalidating the recovery codes and possibly U2F tokens, requiring me to visit two distinct off-site locations to re-setup everything, one of which is currently locked down and inaccessible due to Coronavirus.
And Github is one of the better sites when it comes to 2FA!