When is Authenticator code needed?

[RVDowning]

I managed to destroy my Authenticator keys and just got re-enabled by Coinbase.  So, any time that I had been asked for my Authenticator code it would fail.  So, I could not access Coinbase or Coinbase Pro on my phone, but could access both on my tablet, and could only access Coinbase Pro on my desktop.  If any of these would have had occasion to ask for my Authenticator code it would have failed and then I would have no longer have had access.  I can still access other exchanges that use Authenticator codes.

So, my question is under what circumstances is one asked for an Authenticator code?

[Little Mouse]

Your question isn’t clear to me.
Anyway, if you set 2FA (which you will be asked for with most of the reputed sites), you will be asked for code on every time you log in or withdraw fund. In case of coinbase, I used my number only and I am required to use the code everytime I try to withdraw fund.

[Yogee]

That's odd. It's supposed to ask the codes on all your devices. Are you sure you don't have two different Coinbase account? The account registered in your phone with 2FA is different from your tablet or desktop. It's the only reason I could think of.

[RVDowning]

Your question isn’t clear to me.
Anyway, if you set 2FA (which you will be asked for with most of the reputed sites), you will be asked for code on every time you log in or withdraw fund. In case of coinbase, I used my number only and I am required to use the code everytime I try to withdraw fund.

Well, on BlockFi I log on and off a couple of times every day and am only asked for my userid and password.  This makes me wonder if I should try a small withdrawal to see they ask me for anything else.  Coinbase sent me a one time code to use to login after my having been locked out, but I don't know if I will ever be asked for any other code. To clearify, each time I went to login on a different device they sent me a code to use during the login process.

If I am asked for any code when withdrawing funds, I would have no idea what to enter.

[Little Mouse]

 Coinbase sent me a one time code to use to login after my having been locked out, but I don't know if I will ever be asked for any other code. To clearify, each time I went to login on a different device they sent me a code to use during the login process.

Where do you receive the code? To your number? Then nothing else is required. That's the code I think. And in some cases, if the device used to log in your account is known to coinbase, they may not ask for code.

[RVDowning]

 Coinbase sent me a one time code to use to login after my having been locked out, but I don't know if I will ever be asked for any other code. To clearify, each time I went to login on a different device they sent me a code to use during the login process.

Where do you receive the code? To your number? Then nothing else is required. That's the code I think. And in some cases, if the device used to log in your account is known to coinbase, they may not ask for code.

Yes, they sent it to my phone, and then during the login process they sent an email to which I had to respond on the same device that I was using to try to login.

But, you now have me worried about BlockFi.  If I am asked for an Authenticator code to withdraw funds it will fail.  I wonder if there is any other way to test this without actually trying to withdraw funds.

[jossiel]

If you have activated your 2FA on your account then it will usually ask you whenever you login. But in your situation, if ever you can login on another device despite having the 2FA activated, that's really odd.

If I am asked for an Authenticator code to withdraw funds it will fail.  I wonder if there is any other way to test this without actually trying to withdraw funds.

You have deleted the app or the one that's showing your 2FA code on the app? it's unclear to me sorry. But this is the purpose why 2FA is important, you'll not be able to take it out if you don't have it. In this case, you need to contact the Coinbase support and explain this problem you have.

[khaled0111]

Generally and on most websites, you will be requested to enter the 2fa code when you login, make a withdrawal request or reset your password/email.
Your open sessions (on tablet and pc) will not last forever and you will be logged out automatically sooner or later so don't count on that.
You better request resetting your 2fa codes. You will have to confirm this action via email and in the worst case you will have to confirm your identity. So nothing to worry about if you are the real owner of those accounts.

[Twinkledoe]

Generally and on most websites, you will be requested to enter the 2fa code when you login, make a withdrawal request or reset your password/email.
Your open sessions (on tablet and pc) will not last forever and you will be logged out automatically sooner or later so don't count on that.
You better request resetting your 2fa codes. You will have to confirm this action via email and in the worst case you will have to confirm your identity. So nothing to worry about if you are the real owner of those accounts.

That's what I am thinking here. He can access via tablet or pc because he is still logged in. However, once he logged out, more than likely, it will ask him the authenticator code. So yes, reset your 2fa while you still can. If you have significant amount in those sites, it would be hard if you got tangled with this 2fa thing. Normally, it will ask when you withdraw but most sites, they ask your code when you login. So you might not get out your funds if you have problem with 2fa.

[Rengga Jati]

At first, I am asking what kind of Authenticator you are using?
Google Authenticator?

So, my question is under what circumstances is one asked for an Authenticator code?

basically, Authenticator is an additional security system that must be used in order to enable accessing or doing something that is related to security reasons. This is part of 2FA.
If it is not only about in COinbase, commonly Authenticator is used for:
1. Accessing or logging in to a certain platform, exchange, or site that requires authenticator code for additional security. It is very important to minimize being hacked or even abuse login access by someone who may know your email and username and password.
2. Authenticator code is also needed if you are willing to withdraw the assets from an exchange. It is also important to ensure that you are the real owner of the assets so that it will increase the security reason.

Further, please check these:
https://www.zdnet.com/article/better-than-the-best-password-how-to-use-2fa-to-improve-your-security/
https://www.pocket-lint.com/apps/news/141559-what-is-two-factor-authentication-and-why-should-you-use-it

[sheenshane]

I could not access Coinbase or Coinbase Pro on my phone, but could access both on my tablet, and could only access Coinbase Pro on my desktop.  If any of these would have had occasion to ask for my Authenticator code it would have failed and then I would have no longer have had access.

Because the 2FA that supposed to be your second layer protection is protecting to sign the unrecognized device, which means that if you didn't use your tablet for the Coinbase pro, it will always ask for a 2FA verification since it is the unrecognized device.

In other purposes, enabling 2FA verification code is good for security because you can't able to transfer fund without 2FA, but the problem if you lost it, it needs for your to contact the support team.

You might need to read this article from Coinbase.

[mk4]

Not sure what's happening because I personally don't use Coinbase, but 2-factor authentication is mostly required by financial services to increase more security for their users and to prevent hackers/scammers from accessing their accounts and stealing their money.

Why did you "destroy" your authentication keys in the first place(or did it get destroyed unintentionally)? Knowing that Coinbase would require it every time.

[RVDowning]

Not sure what's happening because I personally don't use Coinbase, but 2-factor authentication is mostly required by financial services to increase more security for their users and to prevent hackers/scammers from accessing their accounts and stealing their money.

Why did you "destroy" your authentication keys in the first place(or did it get destroyed unintentionally)? Knowing that Coinbase would require it every time.

I had an Android problem where after a phone reboot some apps were being deleted.  After googling around I saw that some others were reporting the same thing.  I got tired of having reinstall 4 - 5 apps every time I restarted the phone.  So I took a backup.  The next time I rebooted my phone and apps were deleted I just did a restore from the backup.  For some reason my Google Authenticator codes never worked again.  Somehow they were damaged during this process.

I had moved my funds from Coinbase Pro to BlockFi to take advantage of the interest they pay for deposited bitcoin.  Since that bitcoin movement I have not had occasion to again buy/sell/transfer any bitcoin using BlockFi.  I have been able to sign on/off BlockFi, but I would probably have had a problem if I actually tried executing a transaction.  I have initiated the process of getting re-authenticated (or whatever the term is) at the following site:

https://help.blockfi.com/hc/en-us/articles/360048862652-I-lost-my-2FA-Code-how-can-I-access-my-account-again-

However I still don't quite understand the Coinbase stuff.  They sent me a code to use to sign on, and an email to verify the device I use to access my account.  But wouldn't I expect to be asked for an Authenticator code if I tried to execute a transaction?  I don't see how it would now recognize my Authenticator codes.  I don't know anything I did that would allow it to.

[iamsheikhadil]

I think coinbase has some sort of "trust this device" or something that has allowed you to use that device for your account bypassing some of the security to save your time which might be the case here that you are able to use the accounts on one device while not on others. The question still confuses me though, you can use other exchanges without having 2fa with 2fa enabled? That's strange a bit. Your authenticator codes might not have been damaged, maybe they require a time correction, I don't remember exactly how to do it but Google can help you in it I guess.

[joniboini]

I had an Android problem where after a phone reboot some apps were being deleted.  After googling around I saw that some others were reporting the same thing.  I got tired of having reinstall 4 - 5 apps every time I restarted the phone.  So I took a backup.  The next time I rebooted my phone and apps were deleted I just did a restore from the backup.  For some reason my Google Authenticator codes never worked again.  Somehow they were damaged during this process.

I think it's time for you to find a new phone then. I never know a phone that does that. Are you sure you don't modify something and install something like "deepfreeze" for your phone?

Pretty sure the backup failed or got corrupted. If you can't buy a new phone then I think using another authenticator client might be a good alternative. You should do it asap to make sure you don't lose your access to those exchanges, which will take a very long time to recover.

[Husires]

I managed to destroy my Authenticator keys and just got re-enabled by Coinbase.  So, any time that I had been asked for my Authenticator code it would fail. 

It depends on how you recover your 2FA Authenticator. If you can get it back without the need for the support team it will not take any time you need to Sign in to your account with old 2-step verification code. open Security Settings page and regenerate your secret key

If you need the support team they will ask you for your IDs and you may need to wait a week or more.

So, my question is under what circumstances is one asked for an Authenticator code?

You need to use it every time you do something about your balance and you can change the settings to request it in every process.

[Pmalek]

Each website you create a 2-Factor Authentificaion for also gives you a recovery code that you can use in case you encounter problems with your phone or the Google 2FA app. What is the status of those recovery codes, did you not write them down when you initially set up 2FA?

I have used a few exchanges that allows you to whitelist your device and IP address. The next time you login, it's enough to enter your ID and password and the site wont request a 2FA code. That's why you are still able to access certain sites without any codes.

[RVDowning]

I think it's time for you to find a new phone then. I never know a phone that does that. Are you sure you don't modify something and install something like "deepfreeze" for your phone?

Pretty sure the backup failed or got corrupted. If you can't buy a new phone then I think using another authenticator client might be a good alternative. You should do it asap to make sure you don't lose your access to those exchanges, which will take a very long time to recover.

I did buy a new phone.  I went from an LG G4 running Android 6.0 to a Samsung Galaxy 515M (7 amp battery) running Android 10. 

There is an odd thing though.  After I knew that my Authenticator wasn't working any more I tried redoing my 2FA setup, obviously not knowing what I was doing.  Of course that accomplished nothing.  But the odd thing is that after rebooting the phone it never again deleted an app.  It could just be happenstance, but it is curious.  I retained my phone number, so the old phone is still usable for internet access, but it just gathering dust in a drawer.

It was suggested that I use Aegis, but without any Authenticator stuff working there is nothing to try to import to Aegis.

[RVDowning]

Each website you create a 2-Factor Authentificaion for also gives you a recovery code that you can use in case you encounter problems with your phone or the Google 2FA app. What is the status of those recovery codes, did you not write them down when you initially set up 2FA?

I have used a few exchanges that allows you to whitelist your device and IP address. The next time you login, it's enough to enter your ID and password and the site wont request a 2FA code. That's why you are still able to access certain sites without any codes.

I was unaware that I was given any recovery codes.  Coinbase, for example, simply sent me a verification code so that I could log in, unless this is the code you were talking about.  They sent me several such codes, presumably different ones for Coinbase and Coinbase Pro and for the three different devices I was using for access.  Of course, I now don't know which code goes with which device or app since they were all texted to my phone and have no differentiating information in the messages.

I guess I won't know anything further until I have occasion to execute a Coinbase/Coinbase Pro transaction.  Then I'll just have to see what it asks for and if it is something I can supply.

[examplens]

As I know, Coinbase uses the Authy app for 2FA until 31 march. They will no longer be supported after this date. If you do not migrate to Google 2FA or Duo, they will automatically remove the 2FA protection from your account.
Which time zone use on your phone, is there any difference in other devices which had regular access to Coinbase? it was a problem for me at one point until I put it on automatic time zone determination.