Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Take the following scenario: John is using GMail for his primary email account and LastPass as his password management system. Both of these accounts are using the Google Authenticator mobile application as the second factor authentication for login. John loses his mobile phone and as such is unable to log into GMail as he does not know his password. John is also unable to login to LastPass as while he knows the master password, he does not have the second factor, nor is he able to disable the second factor as he does not have access to his email account. John is now locked out of his accounts.

Current solutions that John may have made use of to stop the loss of account access due to the lack of his second factor device include setting up mitigations such as:

  • Backup codes/Master code
  • SMS/Phone Call
  • Alternative Email

However, the viability of these solutions vary on many factors.

While the above scenario is specific, I ask generally what can be done to mitigate the effects of losing a mobile phone used as a second-factor device?

share|improve this question

2 Answers 2

up vote 10 down vote accepted

What I can say, generally, is that you should not have a single point of failure. Be it your mobile phone (can be lost, damaged, stolen), some other computer or device (can be damaged), a piece of paper (can be lost, damaged) or even your memory (can forget things, especially if not used too often).

Just like passwords usually have fallbacks for recovery (ex.: having a password reset link sent to an alternate e-mail address), your 2nd factor authentication should also do the same, and if there's nothing built-in you'll have to make your own. Easier said than done, true, since every additional "step" solves one problem but introduces a new one (ex.: if I forget my e-mail password, I can reset it using an alternate one, but now I also need a fallback for my alternate e-mail password).

Your problem, IMHO, is that you created a "closed loop" in your fallback strategy: to access your e-mail you need your password manager, and to recover access to your password manager you need your e-mail. When planning the recovery of LastPass, you can't count on things that are dependent on having access to LastPass...

I don't think there's a one-size-fits-all solution to mitigate this problem, and all your suggestions are valid ones depending on the circumstances. Personally, here's how I protect my GMail account (I don't use password managers yet, so the e-mail password is commited to my memory):

  • My personal (desktop) computer is marked as "trusted", so it doesn't require codes and only asks for my password once in a while (each 30 days, I think);
  • My Android device has Google Authenticator, but to open it (or to open the GMail app itself, for that matter - or the whole 2-factor thing would be pretty pointless...) I need to provide a PIN for an App Blocker (so even if someone gains access to my phone he can't read my e-mail).
  • There's an alternate phone number registered, so an SMS can be sent to it if I can't use mine.

That protects me from most "catastrophic" scenarios:

  • If I forget my password and my phone is lost at the same time, I can still access GMail from my desktop (recovering administrative access is a bit trickier).
  • If I forget my password and my desktop is broken at the same time, I can still access GMail from my phone (assuming I can still remember the PIN - something I use often).
  • If my desktop is broken and my phone lost at the same time, I can still use my password and the SMS to the alternate phone to access GMail from another machine.

While retaining the 2-factor property at all levels:

  • To access my desktop, I need physical access to it and my login credentials;
  • To access my phone, I need physical access to it and my PIN;
  • To access my e-mail from somewhere else, I need physical access to a phone (either primary or alternate) and my password.

(Note: strictly speaking, only physical access is required in the first two cases, if a skillful and silent/quick attacker is involved, but that's beyond the scope of this answer)

share|improve this answer
1  
Lastpass also offers a feature to generate One Time Use passwords for situations like this. You should be able to log into the LastPass account and disable the authentication. –  Ramhound Apr 25 '13 at 15:11
    
@Ramhound OTPs still require the second factor to be able to login successfully. –  Luke Apr 26 '13 at 0:51
    
@Luke - You sure about that? That defeats the purpose of OTP they are suppose to be the extreme case of death, lost authenticator, that sort of thing. –  Ramhound Apr 26 '13 at 11:06
2  
@Ramhound Indeed, I am. Your idea sounded plausible so I tested it out: I created a new OTP, logged in to LastPass and still received the Authenticator prompt. I then checked the help page regarding OTP, it states this is a feature, "You can even use OTPs with another form of multi-factor authentication" –  Luke Apr 26 '13 at 22:52

Google two factor authentication supports the use of one time passwords.

The user is supposed to print off the list (contains approximately 10 one time use passwords if I recall correctly) and keep them in a safe place, in the event the scenario you described above takes place.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.