3 ms·

Thanks for the reference. For end-users, they claim that their app will work on multiple devices whereas Google Authenticator only works on one. That would

Thanks for the reference. For end-users, they claim that their app will work on multiple devices whereas Google Authenticator only works on one. That would be a big advantage - I'm worried about losing my phone even with backup codes in my wallet. Worst case situation is that I'm robbed and have to hand over phone and wallet! Also, I'm not aware of Google Authenticator being updated. Which makes me concerned that it's not a priority for Google and might be end-of-lifed.

scrollaway 10y ago
Google Authenticator is a TOTP client. TOTP is an open spec. If you use a different client, you can probably find one that will let you back up codes (I'm sure Authy supports TOTP). Also note that all you need for that backup is a "seed", which is a hash. IIRC Google Authenticator uses SQLite to store its data, I bet it's not hard to get the seeds out and back them up manually.
- solarkennedy 10y ago
  I wrote a program to extract the seeds out of the sqlite and back into QR codes for easy transfer. You are right it wasn't that hard: https://github.com/solarkennedy/tfa_auth_dump https://github.com/solarkennedy/tfa_auth_dump
  - xorcist 10y ago
    Do you need to root your phone in order to extract the sqlite database?
  - scrollaway 10y ago
    Neat!
throwanem 10y ago
I replaced Google Authenticator with Authy precisely because Google Authenticator doesn't back up correctly. I've found Authy an excellent replacement, and definitely worth the purchase price. Hope that helps.
ocdtrekkie 10y ago
TOTP as an open spec is implemented in Google Authenticator's open source version on GitHub. (It's old, but works great.) I recommend not using proprietary apps or services for security purposes. Things with backup or sync are risky, they add additional ways your authenticator can be compromised. There's an alternative that's similarly useful, but far more secure. When you add a 2FA code, print the QR code presented by the website and store it somewhere very secure in real world space. You can later scan it with any TOTP app, and it'll add the identical authenticator to another device.

scrollaway 10y ago

Google Authenticator is a TOTP client. TOTP is an open spec. If you use a different client, you can probably find one that will let you back up codes (I'm sure Authy supports TOTP). Also note that all you need for that backup is a "seed", which is a hash. IIRC Google Authenticator uses SQLite to store its data, I bet it's not hard to get the seeds out and back them up manually.

solarkennedy 10y ago
I wrote a program to extract the seeds out of the sqlite and back into QR codes for easy transfer. You are right it wasn't that hard: https://github.com/solarkennedy/tfa_auth_dump https://github.com/solarkennedy/tfa_auth_dump
- xorcist 10y ago
  Do you need to root your phone in order to extract the sqlite database?
- scrollaway 10y ago
  Neat!

throwanem 10y ago

I replaced Google Authenticator with Authy precisely because Google Authenticator doesn't back up correctly. I've found Authy an excellent replacement, and definitely worth the purchase price. Hope that helps.

ocdtrekkie 10y ago

TOTP as an open spec is implemented in Google Authenticator's open source version on GitHub. (It's old, but works great.) I recommend not using proprietary apps or services for security purposes. Things with backup or sync are risky, they add additional ways your authenticator can be compromised. There's an alternative that's similarly useful, but far more secure. When you add a 2FA code, print the QR code presented by the website and store it somewhere very secure in real world space. You can later scan it with any TOTP app, and it'll add the identical authenticator to another device.