Suggestion: 2FA security key backup key registration

[dsaronin]

PayPal should allow two backup security keys to be registered for accessing account. (or allow two different Authenticator apps to be registered.)

Reason: one key is always left at home/secure location in case main security key is lost or stolen. That way one's account can always be accessed. Google, Microsoft, etc all understand and allow this.

Example:
Currently the way PayPal is setup: If I have my PayPal account primary 2FA set through the authenticator app on my smartphone, and the backup the security key I always carry, then what happens when I'm traveling and both my phone and my backup security key are stolen/lost?

[user12334567]

1 agree. It's always better to have two hardware keys coded to an account in case one is lost or broken, the other can still get you in.

[frayoshi]

backup 2FA FIDO2 are very important, not having the possibility to set a backup on Paypal, is absurd.. highly suggest this implementation too.

And thanks for adding the primary 2FA FIDO2 anyway... many banks still use the notably unsecure SMS method as 2FA.

[JASTech]

2fa really is just another tool for hackers to access your account, it creates inconvenience for the user with a higher likelyhood of leaving themselves vulnerable especially by causing a false sense of security. To those who wish to use the feature, that is your choice, but that should not impact the behavior of service providers to reduce their concentration on securing the basic account security

[honumael]

Do you mind elaborating how a 2FA in addition to a regular password gives "hackers another tool to access your account"? I don't really see it, considering it's just an extra factor on top of your regular password.

Additionally, I think using 2FA-App/Security Key is more convenient than the whole "confirm your identity by entering the one time code sent by email" that I got before I set up a 2FA-App.

[FelixTran2703]

Hi there,

Actually, the issue of backing up this 2FA code is also simple. When setting up 2FA security, save the Secret Key/QR Code in a safe place (maybe Google Drive,...).
If your phone is lost, you can use another phone to scan the saved QR Code. Or a faster way is to paste the Secret Key into the website: [removed] to get the 2FA code.
After accessing the account, you can reset the 2FA code (if needed).
I also changed my phone and lost the 2FA code, it was very difficult to call the Paypal hotline to verify and request to delete 2FA.
Hope this method can help you and everyone!
Good luck.