Dear Netcup Community and Team,
I am writing this post to share a significant experience I recently had and to advocate for a crucial security enhancement: the introduction of emergency recovery codes (or backup codes) for Two-Factor Authentication (2FA) on the Customer Control Panel (CCP).
1. What Happened?
Snipaste_2025-12-08_16-27-23.png
The verification code generated by my two-factor authentication device (authenticator app) is invalid, preventing me from logging into CCP normally. Without a backup method, I cannot generate the required TOTP code.
2. The Recovery Process (The 1-Month Ordeal)
I contacted support immediately. The official account recovery process, while secure, was extremely lengthy and manual. It involved multiple identity verification steps, ticket exchanges, and waiting periods. It took over one month to fully regain access to my account. During this time, I could not manage my servers, renew services, or access critical data. The impact on my operations was substantial.
3. The Core Problem & Risk
While I fully appreciate and support the security provided by 2FA, the current system has a single point of failure: losing your 2FA device means you are completely locked out with no user-initiated recourse. The existing fallback (manual account recovery via support) is, as my experience shows, a process that can take weeks. For business-critical infrastructure, this downtime is unacceptable and poses a significant operational risk.
4. My Concrete Suggestion: Implement Emergency Recovery Codes
This is a standard, best-practice security feature offered by almost all major online services (Google, GitHub, AWS, etc.). Here’s how it could work for Netcup:
Upon enabling 2FA, the CCP would generate 10 one-time-use emergency recovery codes.
The user would be forcefully prompted to download and securely store these codes (e.g., print them or save them in a password manager).
If the primary 2FA device is lost, the user can enter one of these codes to log in, immediately disable the old 2FA, and set up a new one.
This puts the power of speedy recovery in the user's hands, while maintaining high security (codes are one-time-use and user-stored).
5. The Benefits
For Users: Dramatically reduces account recovery downtime from weeks to minutes, empowering users to solve the problem themselves.
For Netcup Support: Significantly reduces the volume of complex, manual account recovery tickets, freeing up support resources for other issues.
For Security: Maintains the high security standard of 2FA while responsibly addressing a key usability and availability flaw.
My month-long lockout was a stressful lesson. I believe implementing emergency recovery codes would be a major step forward in making Netcup's excellent security infrastructure both robust and user-resilient.
I would like to hear from the community: Have others faced similar challenges? And to the Netcup team: Is this a feature that could be considered for the roadmap?
Thank you for reading.