My phone with 2FA codes has died… again… for the 3rd time in something over 2 years (average Poco X3 Pro experience).
I’ve used the Cisco Duo app, mainly for the convenience of automatic backups. After all, this has saved me the last time my main phone died. Connect GDrive, download DB, enter passphrase to decrypt, there you go.
I’ve turned on my still barely functioning 2017 Moto G5s Plus. There I had the Duo app. Upon opening it says something along the lines of “Device offline, showing on-device accounts only.”
How does that read to you? Auto-sync, I thought.
I connected to the internet, refreshed the app, nothing. I go to settings, check the backup… horror!
“Last backup: October 6th 12:06”
I opened the app at 12:06.
Why would you update the backup if it has more recent timestamp than current version?
“Hmm… this phone last backed up in 2023, most recent backup on cloud is 2024, yep, OVERWRITE IT WITH 2023 VERSION!!”
Hmm… this also means I’ve lost access to my Cisco NetAcad school account…
Welp, lesson learned, switching to Aegis.
Since disabling TOTP requires TOTP token, I have no way to disable it. I hope the instance admin can, but SDF has far more important shit to care about.
I am thinking on getting something crazy like Ulefone Armor 24 brick. Though it lacks things like 5G, stereo speakers, and 4K video recording, but I can afford it and have it shipped tomorrow morning.
This is why more sites need to support multiple 2FA devices. Most of them support a fallback like SMS, but they restrict you to one key. I can’t think of any reason to restrict this other than trying to “keep it simple” for users, which is just silly.
Or implement backup codes. I have backup codes for sites like Google. They are some longer single-use codes that can be used to login and reset 2FA. A lot of sites have that.
But yeah, I never thought of multiple keys. I could simply enroll and un-enroll each device. Safer and more convenient.
I think everywhere I use 2FA they also have downloadable backup codes, but you have to store those securely somewhere also.
This is why i like physical hardware keys
I yearn for a day user agents can not suck. Backups and syncing should not be this hard!