The boy lost his iPhone over the weekend, we had to get him a new one. Everything transfered from the 6 to the 8 after installing the iTunes recovery except his Google Authenticator app. Well the app transferred, but the login info did not and there is the problem.

He was using G.A. as the second part of 2FactorAuthorization for his Trello account. I do not know much about Trello, but he has years of files and data on that account and he can no longer access it because Trello is sending the 2nd part of the Password to GA, which he no longer seems to be able to access on the new phone.

Trello is telling him there is nothing they can do because he never set his phone number up to be ‘trusted’, (lesson learned) and they will only send the 2nd part of the password to his seemingly inaccessible G.A. Account.

iTunes “help” is my next email, but I thought I’d drop this here too, just in case.

iTunes will be no help, and neither will Google. The whole point of two factor authentication is to prevent anyone from generating the second part of the password without the device it was linked to. They won't be able to generate the second password part, as the encrypted token that linked your particular instance of the Authenticator app to that password is now gone into the ether.

The only way in is going to be with Trello and convincing Trello that you are who you claim to be, and having them turn off TFA and resetting the password on their end.

My financial accounts that use TFA allow you to call in and verify your identity manually to unlock your account if your phone is lost or stolen. For my Google accounts, I have a print out with one-time use codes for emergencies.

Tip: if you use TFA with Google, bring your backup codes with you when you travel. My wife's phone was stolen in Paris, and we needed the backup codes to get into her account to remotely wipe her phone--i had to call a family member and have them get into my safe for the backup codes.

I do not quite understand the website, but it is something he’s been spending years on with friends on different sites accumulating data and information. I genuinely feel bad for him.


He took it upon himself to email Trello, this was their response. I have to believe there is “something” they can be done.


**********
"So sorry to hear about the situation you're in. It's a super tough spot. Some 2FA apps offer syncing of your code configurations, like Authy, but Google Authenticator doesn't offer this, unfortunately.

For some context, this is especially difficult from Trello's perspective. We make saving the backup codes such a big part of setting up 2FA because they're typically your only recovery option, so very important to keep. You setting up 2FA is an explicit instruction to us, to only allow login when your password is accompanied by that second factor; in other words, anything account related should only be trusted as authenticated when you have that second factor. We can't remove or reset 2FA for the very same reason you can't login—you can't be considered trusted and authenticated because you don't have that second factor that for all intents and purposes, you told us to require that you have.

We can't text you a code, even if your number hasn't changed, because your account was only configured to trust the generator app, and not your phone number, so we don't know that that number is a legitimate source for 2FA codes.

At the end of the day, Trello takes user security and privacy very seriously, and we're especially cautious of anything that might be an unauthorized person trying to gain access to another's Trello account, which is precisely the scenario that 2FA is designed to protect against.

Without your backup codes, the next best thing you can do is look for a browser/computer combination that you had previously marked as "trusted," meaning that 2FA would be bypassed when trying to login. Each browser on each computer you have access to is s separate combination to try; in other words, Firefox and Chrome on computer 1 are two different combinations, and Chrome on computer 2 is another. If you can find one of those trusted browsers, you'll be able to log in and update your 2FA configuration.

Do you perhaps have another mobile device that you might be logged into the Trello mobile app in? That wouldn't let you recover the account, but you could at least access your boards, and transfer them elsewhere.

You're, of course, welcome to sign up for a new account at any time, of course, but I'm sorry we're not able to help more with this one. Let me know of any further questions!"

Trello can't help but google can.

Can you/he get into his google account on a computer?

If can there is a way to move the authenticator to a new phone.

https://www.howtogeek.com/4259...-or-multiple-phones/

Try this and post if it works for you.

quote:

Originally posted by sig2392:
Trello can't help but google can.

Can you/he get into his google account on a computer?

If can there is a way to move the authenticator to a new phone.

https://www.howtogeek.com/4259...-or-multiple-phones/

Try this and post if it works for you.

Unless I'm missing something, that only migrates the Google credentials, every other site you have to manually switch to the new phone, which requires logging in to each site with the old credentials (requiring the old phone).

quote:

Originally posted by maladat:

Unless I'm missing something, that only migrates the Google credentials, every other site you have to manually switch to the new phone, which requires logging in to each site with the old credentials (requiring the old phone).

As I get to understand this better, you are correct. We cannot do anything with Google because the original phone is gone and you cannot transfer your info to another phone without access to the old phone.

It looks like our only hope is Trello, but they are not going to give up the ghost easily. They can help, but they will not help because it violates their data security policy. I get it, but am SO frustrated because the solution is 'right there' and we cannot do anything about it.

Depending on how he was using Trello, he may be able to create a new account, and have all of his friends simply "share back" the relevant information.

Artie,

He’s started to do that, (great idea by the way!) but That’s not what he’s most concerned with.

What he’s most worried about are the boards that he had set to private, which means no one but he could access/view them. He has no way of remaking those to any meaningful degree.

Yup. In that he has a problem. A letter to their general counsel of CEO might help.

Offer them a letter, notarized as to his identity asking to restore the account.

If he is a paying customer it may carry even more weight.

Yep Artie, that is my next step. At age 16 he is such a good kid, I want to make this work for him if for no other reason, I’ve always tried to teach them not to give up, to look for alternative solutions. My point would be made 10fold if I can help him get this to work.

When I set up Google Authenticator, I had to scan a barcode on the screen. This is the "sync" for that device. I also set up other methods within Google Authenticator (question, text, etc.) for other ways.

The security is for that device, and will not be part of the restore of a new phone.

The lesson in this case - read the potential issues if you don't have another way in to authenticate.