3

My ISP give the option of applying 2FA to your account and setting your level of security (from ‘normal’ to ‘paranoid’). However, none of the levels provide 2FA recovery codes.

This is the only service I have so far encountered that offers 2FA but not recovery codes. Before I contact them to ask if they could implement this feature, are there any security reasons not to offer 2FA recovery codes?

This Motherboard article says that without them ‘your security system may do more harm than good.’

This SE answer which says ‘if you print the code and keep in your wallet for example you maintain the secure properties of 2FA.’

  • 1
    What 2FA options do they provide? – Conor Mancone Oct 30 '19 at 12:59
5

There are several implementations to bypass MFA in case you lose control over the "token" of one of the steps in the authentication.

I've seen the use of master passwords, recovery tokens, SMSs or phone calls to a backup phone number, emails, even postal messaging or faxes believe it or not, although the most frequent still remains to have a call with the operations team so that they can reset your account.

There are different problems with every one of them, I don't personally prefer one over the other as long as they are implemented in a right way and you also use them rightfully, so I'd advise you to first know what process your ISP uses to allow for account recovery and if it's secure then enable MFA.

| improve this answer | |
  • 2
    The problems with phonecalls is that they are usually answered by customer service, who's priority is to help the customer, not to be secure. As a result, you can often fool customer service with just rudimentary knowledge of your victim (e.g. birthday, current address, etc.) – MechMK1 Oct 30 '19 at 12:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.