If you're wondering why there aren't any new UHub posts on Twitter, why, yes, there's a reason

By adamg on Tue, 03/28/2023 - 2:44pm

Update: Back in.

A really stupid, dumb reason.

Ye Idiot Editor got a new phone yesterday (a Pixel 7 Pro, for its better camera), and tried to log into Twitter on it, only couldn't remember the password, so tried to change that, but couldn't, because, you see, he'd earlier enabled two-factor authentication, which requires generation of a "verification code" but none of the verification codes generated by the new phone's "authenticator" app were to Twitter's liking and, of course, being an idiot, had lost the supposed emergency backup code he got when enabling two-factor authentication and had already wiped the old phone clean.

I was impressed I got a message from Twitter support (sent like 1:30 a.m. our time) that said they'd un-enable two-factor authentication on my account, but when I tried it, well, they hadn't, so I'm still unable to get into my account, let alone change the password. We'll see what happens.

Ad:

Like the job UHub is doing? Consider a contribution. Thanks!

Comments

Enjoy having your life back!

By U-Hub-Fan on Tue, 03/28/2023 - 3:08pm.

(n/t)

It's Twitter

By Ari O on Tue, 03/28/2023 - 3:16pm.

Of course it's stupid

Wish I could blame Twitter for this

By adamg on Tue, 03/28/2023 - 3:34pm.

Well, if they had kept their text-message two-factor authentication system in place for people who don't pay for a blue checkmark, I would be back in already, but, honestly, the alternative system is more secure than that, and I was sloppy with the data I should have put aside somewhere, so I can't blame them.

The lesson for everyone

By Kaz on Tue, 03/28/2023 - 4:11pm.

Use a single app for MFA authentication where possible (I prefer Google Authenticator). Once you setup your new phone and do whatever transfer method it gives you, see if Google Authenticator transferred over your MFA or not. If it didn't, the app can provide a QR code for your new phone to get all the same numbers going again. Then, do something to spot check that the numbers coming from the new app is giving you are what the sites are expecting.

If the new app is giving you the MFA that work, then it's safe to wipe the old phone.

Otherwise, it can be a much harder time getting each individual site/company to reset your MFA. Some require you to actually send in photos of ID cards and things to confirm your identity because emailing someone to reset your MFA violates the "multi" factor (what you have and what you know) that makes it secure.

I agree with you 100% on a

By Betty white on Tue, 03/28/2023 - 4:41pm.

I agree with you 100% on a single all for authentication. I use Microsoft Authenticator. So much easier - especially when moving from device to device.

Okay when everything goes well

By nathanw on Tue, 03/28/2023 - 9:21pm.

... but this plan falls to pieces when someone's phone breaks, is lost, or stolen.

(CW: nerding)

There isn't a terribly good answer. Authenticator apps that back up somewhere are one option (better really, really trust where they keep that backup). I keep all my TOTP 2FA in both a regular app and on a Yubikey, and pray that only one of them craps out at a time.

A fire safe or similar box is a pretty good place to put printed-out backup codes for everything.

Agreed

By Kaz on Tue, 03/28/2023 - 9:33pm.

That's why everything still does have a way to undo MFA manually. You can't always know why that might be absolutely needed. But for the 95% main use cases, you should switch MFA devices sequentially and confirm the new one is working before decommissioning the first.

Don't be fooled

By ChrisF on Tue, 03/28/2023 - 4:58pm.

SMS text 2fa is highly vulnerable for verification. Sim swapping and mitm attacks can easily go around sms verification. If you want to be very secure, if suggest you get a physical security key.

glad you didn't lose it on mastodon :)

By more reason to move to mastodo... on Tue, 03/28/2023 - 3:27pm.

Been following you on mastodon anyhow and didn't even notice

Sorry about the Twitter thing but happy about the Pixel thing!

By CopleyScott17 on Tue, 03/28/2023 - 3:29pm.

I love my 6a, and try to spread the good word about Google phones to everyone who'll listen.
Hope you enjoy your new rig!

Thanks

By adamg on Tue, 03/28/2023 - 3:42pm.

The size and weight are going to take getting used to (had a 4A before), but I'm hoping that new optical zoom lens will suffice as my increasingly cranky old actual camera slowly stops working. When we upgraded our service to some 5G contract (after I realized it would actually cut our monthly fee without any real changes), it came with a steep discount on certain phones, including the Pixel.

I have a Pixel 7 (Non-Pro)

By BostonDog on Tue, 03/28/2023 - 3:46pm.

I'm coming from a Pixel 3.

Gotta say I'm not too happy. The under-screen fingerprint reader is nearly useless. It gets my thumbprint only 20% of the time. (Yes, I've re-added my fingers several times.)

The camera is OK but honestly I think the photos on the prior Pixel were better. I really wish the Pixel 7 (non-pro) had a telephoto lens. I would pay extra for it but the Pro is just too big.

I hope you have better luck!

tip of my tongue

By anon on Tue, 03/28/2023 - 5:25pm.

Sometime 10-12 years ago there was a phone commercial on TV that ended with a little girl running in circles in her front yard telling her dad, "You got the wrong phone, dummy!!"

What commercial was that?

Went back to a Pixel 3

By SwirlyGrrl on Tue, 03/28/2023 - 8:17pm.

I had a Pixel 5a but it was as robust as a potato chip. Riding my bike with it in an otterbox in my pocket and the screen broke. This happened twice before I became so disgusted with it that I went back to something more durable. Looking at gripes on google shows that screen failure for no good reason is a common problem with the phone.

Going to have to find a suitable and durable replacement soon as the battery in the ancient gadget seems to be going, alas.

Careful

By Kaz on Tue, 03/28/2023 - 9:37pm.

The OS is out of support for Pixel3 (Google wanted to get away from supporting its unique hardware very quickly). Any exploits discovered in the past few years won't ever get patched leaving you more vulnerable on the 3 than newer Pixels.

But 4, at least for now, is OK

By adamg on Tue, 03/28/2023 - 10:37pm.

Google pushed out Android 13 to my Pixel 4a. And the camera is not that bad.

Oh

By brianjdamico on Wed, 03/29/2023 - 7:04am.

I didn't realize the screen was a common problem.

I liked my 5a, until the screen broke after a few months of having it. Then Google support told me I could send it to them for repairs but it would take a few weeks, or I could go to one of their authorized repair places for same or next day service. Drove to one of those stores at the end of a long work day only to be told there that they didn't have replacement screens, Google controls the supply of them and it would be at least a couple of weeks before they could get a new screen for my phone. That seemed to me like info that Google would have known when they told me I could get my phone fixed there same-day.

I also had an issue getting the phone, I bought it directly from Google, Fedex seemingly lost the package (on truck for delivery for over a week) and it took them way too long to agree with me that it was lost and send out a replacement through ground shipping rather than something expedited.

So they lost my business and I went with a different manufacturer.