My phone with 2FA codes has died… again… for the 3rd time in something over 2 years (average Poco X3 Pro experience).

I’ve used the Cisco Duo app, mainly for the convenience of automatic backups. After all, this has saved me the last time my main phone died. Connect GDrive, download DB, enter passphrase to decrypt, there you go.

I’ve turned on my still barely functioning 2017 Moto G5s Plus. There I had the Duo app. Upon opening it says something along the lines of “Device offline, showing on-device accounts only.”
How does that read to you? Auto-sync, I thought.
I connected to the internet, refreshed the app, nothing. I go to settings, check the backup… horror!
“Last backup: October 6th 12:06”
I opened the app at 12:06.

Why would you update the backup if it has more recent timestamp than current version?
“Hmm… this phone last backed up in 2023, most recent backup on cloud is 2024, yep, OVERWRITE IT WITH 2023 VERSION!!”

Hmm… this also means I’ve lost access to my Cisco NetAcad school account…

Welp, lesson learned, switching to Aegis.

Since disabling TOTP requires TOTP token, I have no way to disable it. I hope the instance admin can, but SDF has far more important shit to care about.


I am thinking on getting something crazy like Ulefone Armor 24 brick. Though it lacks things like 5G, stereo speakers, and 4K video recording, but I can afford it and have it shipped tomorrow morning.

6 points

Ahh i had this with a hungry shark world account. I was huge on the game, grinded insane from the start of the game so i had a ton of shit that was only available in older versions and when i moved to a new phone and wanted to restore the backup it overwrote it losing me years of data. Snorted copium for a few weeks but gave up after. Never played it since then.

permalink
report
reply
12 points
*

Sorry about that, but thank you for this post, I had no idea Lemmy finally implemented 2FA.

EDIT: On second thought, there actually is no way to generate a recovery code, so I think I’ll wait a little longer.

permalink
report
reply

OK, I recovered it. It seems Lemmy (at least 0.19.3) has no rate limiting for trying 2FA codes.

Edit: Fixed typo (seem -> seems)

permalink
report
parent
reply
3 points

Oh, this doesn’t sound very secure

permalink
report
parent
reply
5 points

recovery code tip: just save the secret it gives you and then you can put it in another app

permalink
report
parent
reply
2 points

That’s actually not a bad idea, thank you!

permalink
report
parent
reply
4 points
*

If you used GDrive, it might have kept the old backup but version controlled it instead of deleting it.

permalink
report
reply

Perhaps, but it seems this is a hidden portion of Drive that only the app itself can access.

permalink
report
parent
reply
2 points

Check to see if it’s an orphaned file. https://support.google.com/drive/thread/236647252/what-is-an-orphaned-file?hl=en What is an orphaned file? - Google Drive Community

permalink
report
parent
reply

Nope, but thanks.

It uses the hidden appDataFolder and it seems the files in it can only be accessed via those apps.
I found some more (but old) info here: https://stackoverflow.com/questions/22832104/how-can-i-see-hidden-app-data-in-google-drive

Maybe I could figure out something from those examples, but based on Google there’s just mere 4KB of data. That doesn’t sound promising.

permalink
report
parent
reply
4 points
*

@user224@lemmy.sdf.org Try either emailing the sdf membership email address or sshing onto one of their hosts and posting on BBOARD.

Edit: …if you haven’t already

permalink
report
reply

Already did, but thanks.

I remembered them resetting 2FA (per-request) when Lemmy used I think SHA256 instead of SHA1 and a lot of people got locked out.

permalink
report
parent
reply
3 points

Well, there’s no karma so if you’ve saved threads or comments, I’d quickly archive those somewhere. Then just link to this account in your new account bio

permalink
report
reply
5 points
*

Fun fact, lemmy does have a karma system, it’s just hidden from the interface! There’s even a public API method that you can use to check your karma.

permalink
report
parent
reply
-1 points
spoiler

i did the same thing but in reverse, the link text was the rickroll url, but it went to the api page instead

permalink
report
parent
reply
4 points
*

Thanks, good to know! I like how easy it is to check

permalink
report
parent
reply
7 points

Wow, mines much higher than I thought!

permalink
report
parent
reply