5 ms·

AFAIK your Two-Factor is not connected to your google account. Or maybe we're talking about different things. Mine is an app that happens to be made by Google b

AFAIK your Two-Factor is not connected to your google account. Or maybe we're talking about different things. Mine is an app that happens to be made by Google but it has no connection to my google account. If I Google kicked me off the two factor app would keep running https://github.com/google/google-authenticator https://github.com/google/google-authenticator

ocdtrekkie 10y ago
Eh, it should be highlighted that the Google Authenticator app on the Play Store is NOT the one on GitHub, which is a much older version. The current version is closed source, and cannot be assumed to keep working if a Google account is banned. (I strongly recommend people compile and switch back to the old open source version.)
- lloeki 10y ago
  Maybe use an alternative TOTP 2FA app such as Authy (closed-source but not tied to a Google account)
  - tombrossman 10y ago
    Maybe for something important like account access, keep things open-source and use FreeOTP as a drop-in replacement. It's on F-Droid here: https://f-droid.org/repository/browse/?fdid=org.fedorahosted.freeotp https://f-droid.org/repository/browse/?fdid=org.fedorahosted...
    - xorcist 10y ago
      Is there a simple CLI TOTP client? Or what do you use a backup system if/when your phone fails?
      - ocdtrekkie 10y ago
        My recommendation for backing up 2FA is to print the QR code that you set up your phone with, and lock it in a very safe real world place. Do not keep a copy on a digital format.
      - tombrossman 10y ago
        I don't know of any CLI clients (that would be perfect with a Bash alias) but I just store the initial 'seed' passcode in my password manager. When setting up a new device, I manually enter that instead of scanning a QR code and it works perfectly.
        ocdtrekkie 10y ago
        If you store your 2FA recovery codes in the same place as your passwords, there is effectively no point in you having 2FA, because compromising one factor, your password manager, compromises both.
        tombrossman 10y ago
        You are correct but in my use-case I have my browser remember the passwords and use a standalone password manager for storing credentials that I infrequently access. An exploit compromising the browser would next have to compromise the password manager's encrypted database. Admittedly this is not perfect, but I am comfortable with the level of security it provides. I think it is also roughly comparable to users who have a 2FA app on their mobile and a password manager syncing to the same device.
- icebraining 10y ago
  F-Droid has an .apk of the old FOSS version: https://f-droid.org/repository/browse/?fdfilter=otp&fdid=com.google.android.apps.authenticator2 https://f-droid.org/repository/browse/?fdfilter=otp&fdid=com... Along with multiple alternative apps: https://f-droid.org/repository/browse/?fdfilter=otp&fdpage=1&page_id=0 https://f-droid.org/repository/browse/?fdfilter=otp&fdpage=1...

ocdtrekkie 10y ago

Eh, it should be highlighted that the Google Authenticator app on the Play Store is NOT the one on GitHub, which is a much older version. The current version is closed source, and cannot be assumed to keep working if a Google account is banned. (I strongly recommend people compile and switch back to the old open source version.)

lloeki 10y ago
Maybe use an alternative TOTP 2FA app such as Authy (closed-source but not tied to a Google account)
- tombrossman 10y ago
  Maybe for something important like account access, keep things open-source and use FreeOTP as a drop-in replacement. It's on F-Droid here: https://f-droid.org/repository/browse/?fdid=org.fedorahosted.freeotp https://f-droid.org/repository/browse/?fdid=org.fedorahosted...
  - xorcist 10y ago
    Is there a simple CLI TOTP client? Or what do you use a backup system if/when your phone fails?
    - ocdtrekkie 10y ago
      My recommendation for backing up 2FA is to print the QR code that you set up your phone with, and lock it in a very safe real world place. Do not keep a copy on a digital format.
    - tombrossman 10y ago
      I don't know of any CLI clients (that would be perfect with a Bash alias) but I just store the initial 'seed' passcode in my password manager. When setting up a new device, I manually enter that instead of scanning a QR code and it works perfectly.
      - ocdtrekkie 10y ago
        If you store your 2FA recovery codes in the same place as your passwords, there is effectively no point in you having 2FA, because compromising one factor, your password manager, compromises both.
        tombrossman 10y ago
        You are correct but in my use-case I have my browser remember the passwords and use a standalone password manager for storing credentials that I infrequently access. An exploit compromising the browser would next have to compromise the password manager's encrypted database. Admittedly this is not perfect, but I am comfortable with the level of security it provides. I think it is also roughly comparable to users who have a 2FA app on their mobile and a password manager syncing to the same device.
icebraining 10y ago
F-Droid has an .apk of the old FOSS version: https://f-droid.org/repository/browse/?fdfilter=otp&fdid=com.google.android.apps.authenticator2 https://f-droid.org/repository/browse/?fdfilter=otp&fdid=com... Along with multiple alternative apps: https://f-droid.org/repository/browse/?fdfilter=otp&fdpage=1&page_id=0 https://f-droid.org/repository/browse/?fdfilter=otp&fdpage=1...