Your Backup codes - Important

[Feek]

Google Authenticator now backs up your 2FA authentication codes so if you are using that app, your details will be transferred when you change device etc.

That's assuming you trust google with that sort of information.

 

[Feek]

where does one save your backup codes? I have 19 accounts/codes in Google Auth and a total mish mash of having saved some, not others etc. in varying locations. Do people chuck them in Google Keep or something and hope that their Google main account doesn’t get compromised? Or literally print them out? What is actually recommended?

I save them as notes against each account in 1Password. I would hope that most password managers have an option for notes against each account so it seems the logical place.

It does? I’m not seeing anything in my app (iPhone 13) How do you turn this on?

Dunno, I don't use it, even though I have it installed. The patch notes from the most recent version from a few hours ago say:

• Cloud syncing: Your Authenticator codes can now be synced to your Google Account and across your devices, so you can always access them even if you lose your phone.

 

[Feek]

The phone I have MS Authenticator took a swim, and is on its last legs. I have my backup codes. How do I set up OcUK on MS Authenticator again. I've forgotten.

Disable 2FA through the options above and reconfigure it with the different app. It should be as simple as that.

 

[Feek]

Use an authenticator app, don't use email!

 

[Feek]

is there a way to get more codes? every time i try to use authenticator it tells me there is a problem with the code i have entered

Yes, you go into your account, into the backup codes section and you can generate new ones.

If your authenticator isn't generating valid codes, check the time on the computer/phone you're using in case it's out.

 

[Feek]

I changed phones and my OCUK account didnt carry over to the MS authenticator. How do I add it back in, as it asks to scan a QR code or enter a code manually?

You use one of your backup codes, go into the 2FA settings in your account, disable 2FA and then enable it again.

 

[Feek]

Despite the sodding great notice that gets refreshed from time to time which points to this thread, we still get regular requests from members who have not saved their backup codes. And not only that, many of them have read this thread but still not saved them.

Do yourself a favour, do what we suggest. Take a copy of your backup codes.

Also check your DoB. If you need to recover your account and you can't tell us what your DoB is, you won't be getting your account back.

While you're at it, check your email address as well and make sure it's up to date. The same thing applies. If you can't tell us what it is, you're not getting your account back.

But of course, if you have your backup codes saved, you won't need to recover it

 

[Feek]

The session needing to re-auth with 2FA here every 30 days is too annoying, most services have a 90 or 120 day timeout which is much more sensible.

It is set to 90 days. It was originally 30, we increased it.

 

[Feek]

Then how do you explain the monthly prompts!

I can’t. I know for a fact that I only get them every 90 days because after it was changed, I started making a note of the date I get prompted so I could confirm the change had worked. I absolutely only get asked for my 2FA every 90 days.

 

[Feek]

Every 90 days this requirement for a confirmation code is such a needless bit of admin. Like, why? It's only my forum account.

It takes a few seconds, four times a year.

 

[Feek]

If someone hacks my Overclockers forums account, it probably won't affect my life

It might not affect yours but it could affect others.

As @b0rn2sk8 says, we've had instances where accounts have been compromised due to people reusing passwords and they've posted on the MM. Fortunately, in each case, they've been very easy to spot and nothing bad has happened but if your account was compromised and another member was defrauded, how would you feel?

We take security seriously, especially when money is involved and enforcing 2FA along with the recent changes for continued activity as a pre-requisite for MM access should have removed the chance for this to happen.