Solved Backup Devices for MFA

Haydon · Nov 28, 2021

It is dangerous to have only 1 device for Multi-Factor Authentication (MFA) If you go out fishing and drop your MFA phone in the lake, you lose access to your MFA accounts :scream:

As a backup device for MFA, I use someone else's phone in my household. I have never actually needed that other phone for backup but every now and then I do try it out to make sure that the backup still works. Moreover, some but not all MFA accounts can send the security code by voice to an ordinary landline phone (I am too cheap to subscribe to a text-to-landline-phone service)

What backup devices for MFA do YOU use?

The-Hive · Nov 28, 2021

Beyond me

Quandary · Nov 28, 2021

Phone & PC running Authy.

Porthos · Nov 28, 2021

Haydon said:
If you go out fishing and drop your MFA phone in the lake

Buy a new phone when you get to shore.

cereberus · Nov 28, 2021

Porthos said:
Buy a new phone when you get to shore.

Yep - MFA is tied to the mobile number. I had a phone stolen - got it locked, ordered new phone and sim, problem sorted. Why would I bother having a backup when the (future backup device) is in the power of my debit card?

re. losing existing phone - buy a £5 neck lanyard.

Haydon · Nov 28, 2021

Folks, your sites must have really lax MFA that can be easily bypassed with a new phone & sim card. Would that not defeat the purpose of MFA, since it would provide no more security beyond a mere password.

More secure, and hopefully more common, is to configure MFA on better sites with with pre-arranged ways to authenticate yourself. If one way fails, then you can authenticate yourself with at least one other way. That's the backups that I am talking about (and that I have used over the years for banks and other important sites)

Makes sense?

Edit: I was thinking of buying a phone with dual sim cards with an office # and a home #. If I go on my famous fishing trip and drop that famous phone in the famous lake, then I would be in double trouble. That's the impetus for this thread, having backups in different physical media that you don't jeopardize at the same time.

Haydon · Nov 30, 2021

No more comments? At least someone understood the issue by tossing up Authy which is pertinent, especially with 2 devices (phone & pc)

A word of caution for people reading this thread, don't go overboard. For my most important sites, I use my max:

text or voice to mobile #1
text or voice to mobile #2
voice to landline

That's 3 devices and 5 MFA options, and issue is that the higher the count the bigger the attack surface becomes (something like an additional authenticator app adds to the tally)

FWIW, for unimportant sites, I don't even use MFA :scream:

cereberus · Nov 30, 2021

Haydon said:
Folks, your sites must have really lax MFA that can be easily bypassed with a new phone & sim card. Would that not defeat the purpose of MFA, since it would provide no more security beyond a mere password.

More secure, and hopefully more common, is to configure MFA on better sites with with pre-arranged ways to authenticate yourself. If one way fails, then you can authenticate yourself with at least one other way. That's the backups that I am talking about (and that I have used over the years for banks and other important sites)

Makes sense?

Edit: I was thinking of buying a phone with dual sim cards with an office # and a home #. If I go on my famous fishing trip and drop that famous phone in the famous lake, then I would be in double trouble. That's the impetus for this thread, having backups in different physical media that you don't jeopardize at the same time.

Who is talking about a new sim card? I was talking about a replacement with same number. You cannot easily get that from sim supplier without proof of identity. Anyway MFA varies from app to app. My work uses telephone call back, MS Autherlnticator or registered email. Others just use text messages/code.

I just am not worried enough about losing my phone to go to inconvenience of using a separate device. I can always recover with 24 hours or so even if phone was lost in worst case.

Anyway, that approach does not help you when out and about if using a text based authentication method to a set number on a phone left at home.

i prefer to use MSAuthenticator where possible. Email authentication is handy as next best option, or fingerprint etc. However, many apps still just text a code to your phone and yiu have no choice of doing otherwise.

To me the pros of using a secondary device are outweighed by the inconvenience..

Haydon · Nov 30, 2021

Well, you did say

new phone and sim

good that you clarified.

My work uses telephone call back, MS Autherlnticator or registered email.

Those are in fact 3 MFA backups, although it appears that you access all 3 with your phone, good if that works for you.

Anyway, that approach does not help you when out and about if using a text based authentication method to a set number on a phone left at home.

Ah, but having multiple devices does help reduce the downtime, e.g. a laptop to get the code in an email as in your work example, maybe important if you are in a meeting with a client.

It is of course handy to use devices that you already have, as MFA backups. I even think that you already do that, e.g. you do your remote work on a laptop that you can also use as an MFA backup device. So, with your phone, I think that you already have (at least) 2 MFA devices.

Sure, not all sites work with all MFA devices, that's what this thread is all about.

cereberus · Nov 30, 2021

Haydon said:
Well, you did say

good that you clarified.

Those are in fact 3 MFA backups, although it appears that you access all 3 with your phone, good if that works for you.

Ah, but having multiple devices does help reduce the downtime, e.g. a laptop to get the code in an email as in your work example, maybe important if you are in a meeting with a client.

It is of course handy to use devices that you already have, as MFA backups. I even think that you already do that, e.g. you do your remote work on a laptop that you can also use as an MFA backup device. So, with your phone, I think that you already have (at least) 2 MFA devices.

Sure, not all sites work with all MFA devices, that's what this thread is all about.

My point is if the MFA relys on phone number, it assumes you always have access to that phone. This rather vontradicts your fishing scenario as you would not have that spare phone with you to normally use it with those apps when not at home.

This you would have to take the spare phone with you to use such apps when not ar home. If you did, you would just as likely lose it as your main phone anyway.

There is no credible scenariosI suppose you could use an app to remote access the spare phone, but then you are making things very complicated.

In any case, if you lose your main phone, you still have to go through hassle of getting a replacement SIM and possible a new handset. So there is no scenario where have a secondcphone helps you unless the spare phone is also configured like the main phone.

In simple terms - do not lose main phone, second phone is superfluous.
Lose phone, you still need to go hassle of replacing SIM to access second phone.

Quandary · Nov 30, 2021

cereberus said:
My point is if the MFA relys on phone number, it assumes you always have access to that phone. This rather vontradicts your fishing scenario as you would not have that spare phone with you to normally use it with those apps when not at home.

This you would have to take the spare phone with you to use such apps when not ar home. If you did, you would just as likely lose it as your main phone anyway.

There is no credible scenariosI suppose you could use an app to remote access the spare phone, but then you are making things very complicated.

In any case, if you lose your main phone, you still have to go through hassle of getting a replacement SIM and possible a new handset. So there is no scenario where have a secondcphone helps you unless the spare phone is also configured like the main phone.

In simple terms - do not lose main phone, second phone is superfluous.
Lose phone, you still need to go hassle of replacing SIM to access second phone.

That is not the complete situation.

Authy is setup and tied to my phone number, but I also have Authy installed on my Desktop that provides access to the MFA codes for my accounts. If the phone and SIM could not be replaced in reasonable time then the MFA linked accounts could then be deactivated using the code from the Desktop app, and then setup again with a different phone/number.

Haydon · Nov 30, 2021

Yeah, nimble and yet secure access to accounts can be more important than any devices that you have to replace.

I have been using a multiplicity of backup MFA devices that I already have (or have access to) for the 'nimble and yet secure access' thing, but Authy apparently achieves the same thing with software.

... and you can't say accidents shall not happen!

Bastet · Dec 1, 2021

Most if not all MFA suggest to create backup codes so a user can access their accounts should they lose their phone.
Also if you use a phone & a tablet then you can install an authenticator app & the 2FA will still be available on the tablet if you lost the phone.

Haydon · Dec 1, 2021

Bastet said:
Most if not all MFA suggest to create backup codes so a user can access their accounts should they lose their phone.

A word of caution about backup codes (that you can use only once)

I had quite a few lists each with about 3 or 4 backup codes stored in my password manager. And like everything else, I like to test things out once in a blue moon, but it happened that I corrupted a particular list (I usually recreate the entire list after using just one of the backup codes, but I must have messed up something) So I tried one backup code after the other and I got locked out of that particular site for a day :scream:

It's not the site's fault, but I gave up on backup codes altogether, because I decided that I am not meticulous enough in maintaining my lists of backup codes

Backup codes are a good and simple solution, though, provided you can be meticulous over the years

Also if you use a phone & a tablet then you can install an authenticator app & the 2FA will still be available on the tablet if you lost the phone.

That's a good example for the title of this thread

Haydon · Dec 3, 2021

I think that there will be an excellent solution with W11 being able to run Android natively. Then you will have your work computer and your phone (2 devices and only 2 devices) both running the whole MFA gamut (SMS, authenticator app, email, voice, digital certificate, etc) to cover just about any site on the net.

If your work computer happens to be a tablet (like in the previous posting) then that and your phone can be the happy MFA couple. If you like running emulators on your work computer, then Android emulators will run on W10 and earlier. If you like utility apps, then Authy (like in a posting further up) will fit the bill.

I myself plan to move towards the streamlined approach of the first paragraph from my present hodge-podge of approaches to provide redundancy before the fact, wish me luck

I will mark this thread 'Solved', thanks

Winuser · Dec 3, 2021

Haydon said:
Folks, your sites must have really lax MFA that can be easily bypassed with a new phone & sim card. Would that not defeat the purpose of MFA, since it would provide no more security beyond a mere password.

More secure, and hopefully more common, is to configure MFA on better sites with with pre-arranged ways to authenticate yourself. If one way fails, then you can authenticate yourself with at least one other way. That's the backups that I am talking about (and that I have used over the years for banks and other important sites)

Makes sense?

Edit: I was thinking of buying a phone with dual sim cards with an office # and a home #. If I go on my famous fishing trip and drop that famous phone in the famous lake, then I would be in double trouble. That's the impetus for this thread, having backups in different physical media that you don't jeopardize at the same time.

They send the code to the phone number you supply. It doesn't matter what phone it is as long as it has the same number.
So where is the problem?

cereberus · Dec 3, 2021

Winuser said:
They send the code to the phone number you supply. It doesn't matter what phone it is as long as it has the same number.
So where is the problem?

Yep, OP is flogging a dead horse totally ignoring many sites just only have one method i.e. send a code to a specified phone number.

OP has refused to acknowledge that if you use a second phone for authentication and need to use it to verify a code whilst out and about, you need access to it, it means you have to carry it with you if out and about, negating whole point of his initial post about losing phones..

Equally if at home, you do not need a second phone anyway as you wil not lose phone (temporarily mislay at best), but if you do, how can you run apps that need mfa anyway!.

I give up trying to explain to OP the flaws in their argument!!!

Haydon · Dec 3, 2021

Well, besides myself, there are 2 people on this thread who value a backup device for MFA. If one MFA device fails, then the other MFA device can still be used to access the site and edit the MFA specifics for the site if needed.

The first person uses phone and pc as his MFA devices. The second person uses phone and tablet as his MFA devices. I myself presently use 4 MFA devices, because unfortunately not all my (important) sites work with all my devices (and I want to have at least 2 MFA devices to work for each site as per the first paragraph)

It does not matter if you don't value a backup device for MFA, just don't use it. Some people don't value data backup either :scream:

Edit: ALL better sites provide MFA backup, SMS to mobile PLUS at least one other medium, usually PC- or tablet-based (such as backup codes) but also landline voice, etc. A site without MFA backup is one to be avoided, IMHO.

One more example: one of my most secure sites use a digital certificate that I store in my password manager, so password and MFA are very conveniently stored in one secure place. Of course the site works with SMS to mobile too. And upon login, the site lets me select which one of the two MFAs (SMS from phone or certificate from computer) I want to use that day. The site has in fact a 3rd MFA that I don't use, but I certainly would not use that important site if it had only 1 MFA!

swerd · Dec 3, 2021

I have two Yubikey 5's. One I keep in a safe location and another in my wallet. I also carry on my phone copies of my QR codes for 2FA (in an encrypted 7-Zip file), and another copy on an encrypted USB stick.

Haydon · Dec 4, 2021

Well, that makes 4 of us in this thread that value MFA backups. Of course, we all do the loss-of-access prevention in different ways and to different extents. Moreover, the sites themselves provide the loss-of-access prevention in different ways and to different extents.

This thread shows that there are hardware and software products on the market to deal with many combinations of permutations of MFA backups.

I don't want to annoy anyone, but I have always been in favor of doing prevention, MFA backups and otherwise. As my old doc said 'exercise is better than liposuction' :scream:

(I am everything else but obese, but my old doc said that to everyone)