Box.com and 2FA headache...

[B. Diddy]

This isn't crucial to me, but just very annoying -- I'm having a lot of trouble logging into my personal Box account because the 2FA I used through Google Authenticator was lost when my Pixel 3 XL died. The only way to transfer Google Authenticator accounts requires the old phone to be functional. Now Box won't let me log into my account because it absolutely requires 2FA, with no other option (like sending an authentication code to an email). Their support site is screwy, saying that for optimal help, I need to sign in first -- but I can't because they require 2FA which I can't access. There was an option in the help site to type in my phone number so that they would supposedly send an SMS with a code, but it doesn't send the SMS. So I had to send a request while not signed in, which they warn can take longer. Stupid.

 

[mustang7757]

Oh man B. Diddy
I remember a member awhile back had similar situation ill try to dig up that thread

 

[B. Diddy]

Not a huge deal, since I essentially never use Box. But I like to maintain those accounts, in case I do need some extra cloud storage. Thanks for trying to find the thread!

 

[mustang7757]

This was the thread , back in 2019 lol


https://forums.androidcentral.com/showthread.php?t=966839

 

[B. Diddy]

Thanks, but I don't think that'll help me. From what I've read in Google's support pages, the only way to transfer 2FA accounts from one phone to another requires using Google Authenticator on the old phone (which I can't do, since it died).

 

[mustang7757]

Thanks, but I don't think that'll help me. From what I've read in Google's support pages, the only way to transfer 2FA accounts from one phone to another requires using Google Authenticator on the old phone (which I can't do, since it died).

Yeah after reviewing it I figured it wouldn't .

You mentioned u sent request not signed in , have you sent one while signed in?

 

[B. Diddy]

I can't sign in because it requires me to use 2FA. Customer support did respond to me, but they're asking for when was the last time I accessed my account, when I started my account, and the name of a file there. The first two are virtually impossible for me to say with precision, since I almost never use the account. I'm pretty sure I backed up some of my music files there a while back, so I gave U2 Joshua Tree as one of the files that should be there.

 

[mustang7757]

I can't sign in because it requires me to use 2FA. Customer support did respond to me, but they're asking for when was the last time I accessed my account, when I started my account, and the name of a file there. The first two are virtually impossible for me to say with precision, since I almost never use the account. I'm pretty sure I backed up some of my music files there a while back, so I gave U2 Joshua Tree as one of the files that should be there.

Its crazy it goes by device instead of the phone number or email , im not crazy about that type of 2FA

 

[B. Diddy]

I can understand why it would go with the phone number, since I think they're trying to prevent multiple instances of an authenticator (which would be less secure). But I would've thought Box would have some backup method of authenticating if there's a problem with the authenticator app. But nope, nada.:-\

 

[mustang7757]

I can understand why it would go with the phone number, since I think they're trying to prevent multiple instances of an authenticator (which would be less secure). But I would've thought Box would have some backup method of authenticating if there's a problem with the authenticator app. But nope, nada.:-\

Think about it if someone has your phone they can authenticate it and get in the account

 

[B. Diddy]

Think about it if someone has your phone they can authenticate it and get in the account

Well, first they would need the username and password of the account they're trying to get into, and then they would have to get past my phone's screen lock to access the authenticator. Multiple levels of security. It's certainly better than using SMS as the 2nd factor.

 

[mustang7757]

Well, first they would need the username and password of the account they're trying to get into, and then they would have to get past my phone's screen lock to access the authenticator. Multiple levels of security. It's certainly better than using SMS as the 2nd factor.

Yeah your right .