5

I have a web service that I set up which allows users to protect their accounts via two factor authentication via an authenticator app like Google Authenticator and Authy.

When enabling it, I mention to write down the authenticator secret in the event you lose access to your device.

Even so, I have users who email me asking to disable two factor auth on their accounts because their phone died, deleted the app, etc...

Are there any other options besides just telling them "sorry, no can do - you lost your account"?

Is there some set of information about a user that I could ask for to give me confidence that they really are the owner of the account (and not just that they have access to the email)?

The only information I collect about the user is their email, password and IP address.

Improve this question
6
  • 1
    uhh, I'm not sure we can answer that. Is this in a corporate environment where they can go to the help desk and show their ID badge? If it's a random internet service, what info do you know about them that you could use as verification questions?
    – Mike Ounsworth
    Aug 28, 2018 at 18:44
  • Clarified the question slightly -- I don't collect any personal information about the user besides their email address, password, and IP address.
    – Paul
    Aug 28, 2018 at 18:51
  • make it a long tedious process that takes 4 days to reset the 2facauth so they dread the moment they realize they can't access their google authentication app or whatever they're using because they can't find the secret they were supposed to write down. That'll teach em'.
    – xorist
    Aug 28, 2018 at 18:53
  • Hmm, sounds like you're stuck and have to choose between telling a user "Sorry, nothing I can do" or lowering your security for anyone who calls claiming to be a customer. If I were you, I would take the "Sorry, nothing I can do" route with this customer (you may lose their business) and then carefully think through and implement a proper account recovery mechanism that users can set up in the future.
    – Mike Ounsworth
    Aug 28, 2018 at 18:55
  • You could also have a look at how the big-name sites handle this. Google, github, Facebook, Twitter, etc. I expect they have published policies around recovering accounts with 2FA enabled.
    – Mike Ounsworth
    Aug 28, 2018 at 18:56

1 Answer 1

Reset to default
4

You can use a mix of time delay and backup codes. When the user activates 2FA, show him a couple Backup codes (like Google does) and ask them to save it somewhere, and ask one of the codes on the next screen. This will save you some trouble later.

From time to time, ask the user one of the backup codes when he logs in, even if he submits the 2FA token. If he does not know/don't have the backup codes, generate new ones, send to the user, ask him to save the codes, ask another random one in the next screen. User will be educated that the backup codes are special.

If user loses both the 2FA and the backup codes, create a very long process to retrieve the codes. Show him the necessary steps, how long they will take, and where he is:

  1. User asks for a 2FA reset, send him a link and state that the link will be available from 24h to 48h AFTER he clicks the link

  2. User receives a link telling someone with this IP/OS/browser asked to reset the 2FA, and if was him, he have to wait until next day and click the link.

  3. The next day, user clicks the link and receives another mail with a link and a reset token that must be entered on the site in 24h to 48h later. Add the same message that someone, maybe him, with this IP/OS/browser tried to reset his 2FA.
  4. Next day, user clicks the link, loads a page, enters your site, and enters the token. Tell him he will have to login in 24h to 48h again and 2FA will be disabled.
  5. User logs back in after 4 days, after receiving at least 3 emails telling him someone is trying to reset his 2FA.

I think 4 days is long enough for a hacker to lose interest in the account and a good timeframe to any user to detect and stop any account hijack. If 4 days is not enough, you can increase the time between each email. And any user really interested on recovering his account will follow the instructions.

Improve this answer
1
  • That seems like a VERY good idea. Any sites implement this? I think if potential breach is suspected and we don't know for sure, erring on make the suspect wait is a very good idea
    – user4234
    Oct 1, 2018 at 9:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .