Upgrading My 2FA Foo

By Manny Fernandez

February 13, 2018

Today I updated any account I could find that uses 2FA. I chose Authy since it allows me to backup my keys. The backup is locally encrypted on my device and once in the Authy cloud is salted and encrypted again. Not 100% where I can back up locally, but much better than most of the authetication methods used by some of these providers I enabled 2FA on.

Twitter
Amazon.com
AWS
ARIN
GoDaddy
IFTTT
Team Viewer (Although I barely use it)
Gmail

I know I am missing a few, but for now, I can rest somewhat easier. The problems I see today with other solutions:

Microsoft Authenticator – If you replace your phone, something I do ever year, you are hosed. I started using their 2FA or MFA for Azure and an O365 account. This is going to be painful when I replace my phone.

Google Authenticator – Suffers from the same issues as Azure and in addition, using the same seed code on all your devices (e.g iPhone, iPad, etc). Authy uses unique ones for each of your devices.

Recommendations:
Create a fake Gmail account or on an email server which does NOT have access to any of your domains. For instance, if you have registered infosecmonkey.com, do not use that email in your recovery password scheme. If someone hijacks your domain, they can easily recieve your emails. Set this account up and store the password in a secure location even if it is a physical vault. Use this account as your password recovery account. I have a Gmail account that is random letters and numbers. An example would be Lb5KkCQy4fgwTSlQ34@gmail.com. Do NOT use this account anywhere but the recovery accounts. That is, do not use it as the account username or email associated. If you need to have SMS validation/verification, get a Google Voice number associate with that account. That account should have 2FA enabled and you should use a burner phone with WiFi only if you want to house that 2FA app. This burner device should NOT be used for browsing etc. This is how I am set up. It may be over the top, but that is fine by me.

Authy is a simple application that runs on both Android and IOS. You connect to whatever site you want to enable 2FA, you generate the code and a QR code will show up on the screen

You tell Authy to “Add an Account” and you will see the following screen:

Choose “Scan QR Code” and boom. You are done. Usually, the site will ask you to enter one or two of the time based codes before you can continue. There is a backup code that normally gets generated. Save this in a secure location.

BTW: For those that thought I added an actual QR code from one of my sites…. think again. 🙂

Upgrading My 2FA Foo

Recent posts