We use cookies to personalise your experience on Zonda Manage Cookies Accept Cookies As the name suggests, certain cookies on our websites are necessary. They are necessary for the storage of your settings during the use of Zonda (e.g., privacy or language settings) to protect the platform against attacks. You can reject, block or delete them, but this will not impact significantly your experience during the use of this website or even make it impossible to use some of our services. See details Marketing cookies We use such cookies and similar technologies for collecting information while users browse our website to learn more about how it is used and improve our services as necessary. Cookies are also used for measuring the general efficiency of our website. The data generated by them are used on an aggregate and anonymous basis. Blocking these cookies and tools will not affect our services, but will make it difficult for us to improve the experience of their users. See details My phone got stuck in bootloop a ways back so I am intimately familiar with this situation. The easiest way is: SAVE YOUR BACKUP CODES! When you created your 2FA sign on with most sites, including Google, they provided you with Store these like you do a private key. Do not save them to your computer or dropbox. Do not send them. Do not post them on reddit. Write them down or print them out and store in 2 physically different locations. The other option, which is actually way easier especially since my phone dies from constantly getting notifications, is to set up your 2FA on two devices whenever you enable 2FA or create a new account. Perhaps you can make use of that old, rooted, Amazon Kindle or iPhone 5. Factory reset & ensure it's not able to connect to the WiFi & turn on airplane mode. You can also print out the QR code itself that you use to add to Google Authenticator originally so that if you ever need to re-set up 2FA, you can do so. If you don't have a printer, you can typically click the "show code" or "can't read the qr code?" or something and get a text version that you can then write down. Protip: make sure you label what this QR code or text code is (e.g. "2FA for Poloniex"). How to be Secure while being able to recover your 2FA
That said: most 2FA is surprisingly insecure bc usability. It isn't inherently insecure, but it was surprisingly easy to regain access to all my accounts even though I had minimal backup codes stored in a multitude of locations over a few years.
For non-Google accounts, it's pretty easy to restore access in one way or another, either via the above methods or going through the process of bypassing 2FA with your email account. A pain, but not impossible. You can also break out that old computer and see if you are still logged in anywhere and can disable it. Or see if there are other access methods, like SSHing in or oauth where you can set up a new account via a Facebook or Twitter account that uses the same email address as the account you already have and see if you can sneak in that way. There are a few that you will not be able to get into. In those cases, you will need to reach out to the service itself and see what you would need to provide in order to get them to turn of 2FA for you or otherwise bypass. I would actually strongly encourage everyone to have a beer, turn off your phone, and see what accounts you can get into without your 2FA codes. If you can get it, you need to adjust your settings to be more secure AFTER you actually have viable, secure, offline backups of the recovery codes. |