The two-factor authentication trap

Like most people, my phone is my key to everything. I use it for work, to manage passwords, access my bank accounts and so much more. So when my phone stopped working completely (an unfortunate incident involving a bathful of hot water), I did what I had to – I got a replacement iPhone.

If you’ve ever been in my position, you’ll know that Apple makes restoring a device feel like an almost magical process. I hurriedly downloaded my iCloud backup, and within just one hour, my new phone looked exactly like the old one. Yep, my photos, apps, messages were all back in place.

It felt like the crisis was over. Except it wasn’t.

Logging back in requires… logging back in

The real trouble started when I began to open apps that needed me to login again. Many of them asked for two-factor authentication (2FA), which is increasingly standard – enter your password… then confirm it’s really you with a second step.

So far, so good. But then I hit the trap.

To log into the app, I needed to confirm it was me, from within the app. The authentication prompt was essentially asking me to open the app to approve this login, but I couldn’t open the app until I approved the login. It was the perfect loop, the digital equivalent of Joseph Heller’s catch-22.

This feels like the solution has been made in isolation, with the UX planned for their own system, but without a real understanding of how users needed it to work. I would have expected this to have been something ironed out in their persona development and user testing, but perhaps not.

Two-factor authentication assumes you still have your old phone

Two-factor authentication is meant to protect you if someone steals your password. In principle this is a good idea, but in practice it assumes one thing: you will always have access to your old device.

That’s fine, unless your phone is:

Lost
Stolen
Destroyed
Upgraded unexpectedly
Your authentication app doesn’t transfer properly

Suddenly, the system that’s designed to protect you becomes the system that prevents you from accessing your own accounts.

My temporary fix

After a lot of frustration, I found a workaround.

I dug out a dusty old phone that had been languishing at the back of a drawer for who knows how long. It was barely functional and painfully slow, but crucially, it was just alive enough to open Gmail.

That old device still had access to two critical things:

My Google account
My authentication channel

Finally I was able to approve the login, but, frankly, it felt ridiculous. A years-old back-up phone became my lifeline to the modern digital world. And even then it only sorted one account. There are still other apps I’m completely locked out of, and I’m still trying to figure out how to regain access to them.

This is going to become more common

The thing is, this isn’t just some personal inconvenience that put a spanner in my Sunday afternoon. It’s actually a growing systemic issue we all need to be mindful of. As smartphone users, we are rapidly moving toward:

Mandatory 2FA everywhere
Device-based authentication
App-based approval flows
Reduced use of SMS back-up
More secure (but more brittle) identity systems

In essence, security protocols are improving faster than recovery processes, as we build stronger locks, but not enough spare keys.

Potential solutions that you need to know more about

This experience made me realise that everyone should plan for the day their phone disappears. So here are some real emergency solutions that should become standard practice when using two-factor authentication.

1. Backup codes

Many services offer one-time recovery codes when you enable two-factor authentication. Almost nobody saves them. This is a mistake. Instead, make an offline copy and store them somewhere safe.

2. Multiple trusted devices

If possible, keep authentication enabled on more than one device, such as your:

Tablet
Secondary phone
Work laptop

3. Authentication apps with cloud sync

Some authenticator apps now support secure back-up and restore processes. Not all do, so choose those that have it – that difference matters.

4. Hardware security keys

Physical keys (like YubiKeys) can act as a back-up authentication factor. They aren’t mainstream yet, but they solve exactly this problem.

5. Better emergency recovery design

This is the big one. Companies need to treat a lost or broken phone as a first-class, stone-cold critical scenario. It’s not an edge case that no-one can be bothered with.

Is two-factor authentication complete?

Let’s be clear, two-factor authentication is a very good thing (perhaps I should have led with this, but my escapade with the bath got the better of me). Passwords alone can be broken and account takeovers are real, so security does matter.

But the rollout of two-factor authentication has created a new category of failure, whereby the user is legitimate, but they cannot prove it.

As systems get smarter at blocking attackers, they are not always smarter at helping real, genuine people recover access when a problem happens. After all, phones fall in water, they get stolen, or upgraded. And when these things happen, security shouldn’t become a trap.

The takeaway

Two-factor authentication is like building walls around your digital life. However, what we also need are ladders for when we’re the ones locked outside. Subsequently, the next evolution of security isn’t just stronger authentication, it’s resilient authentication. Because the question isn’t if you lose access to your device, it’s when.

Find out how AI is affecting search engine traffic.

Photo by Shutter Speed on Unsplash