Forget 2FA codes and recovery

[Asjad-Ali]

Forget 2FA codes and recovery but remember email with pwd. How can access account again?

[JavesPotato]

There is no other way. You need those codes. Without it, you will lose the account forever.

[dan3008]

yikes. I need to back up my codes… I didn’t realise there wouldn’t be a way to recover it at all

[JavesPotato]

@Admin has a pretty good reason why he does not disable two factor authentication on any account by a mere request.

Forget authentication and backup codes

From a technical level, I can disable two factor authentication. Remember: I wrote the client area code and have administrative access to the servers running it. So I can change whatever I want whenever I want it. However, I won’t disable two factor authentication on any account by request. The point of two factor authentication is that (drumroll please) you have two factors of authentication. The email address / password combination is one, and the two factor device / recovery codes are the …

If you want to read a tale about what happens when support staff bypasses critical security checks, just read what happened to the owner of the Twitter handle “@N”. I have no desire to get a similar story about InfinityFree.

[dan3008]

I agree with not just deactivating it for people. I had to field loads of requests like that when I worked in the complaints team at my job…

I just kind of assumed there’s be an account recovery method. Probably just me not reading everything properly

[JavesPotato]

I really wish that Infinityfree allows another backup recovery method. This issue is really problematic and very common.

[Admin]

I’m aware that this is unfortunately a common issue. And I’d be happy to implement a recovery method, but only if I can do it without undermining the security of 2FA.

Email+password is the first factor of authentication. So using email to bypass the second factor of authentication effectively eliminates the second factor of authentication. After all, anyone who would have access to your email account can both reset your password and disable 2FA.

Other websites can use phone numbers or government IDs to authenticate you. But we don’t collect either of those pieces of information, so we can’t use that.

I’m open to suggestions for secure recovery methods. Because I can’t think of any, except for the recovery codes.

So until then, make sure you backup both your 2FA app and store your recovery codes safely. If you don’t trust yourself to do that, then consider disabling 2FA.

[redsusvn]

it is kinda wild and a bit spooky if you can see almost anything that we done, we hide on your services