5 ms·

Anyone know if you can use the authenticator app on more than one device? My wife and I share the same Amazon account and it would suck if I had to generate a t

Anyone know if you can use the authenticator app on more than one device? My wife and I share the same Amazon account and it would suck if I had to generate a token for her whenever she wanted to buy something. I don't want to have separate accounts because I don't want to pay for Prime more than once.

fooey 10y ago
Prime lets you share with members of your family https://www.amazon.com/gp/help/customer/display.html?nodeId=200444180 https://www.amazon.com/gp/help/customer/display.html?nodeId=... https://www.amazon.com/myh/households https://www.amazon.com/myh/households
- stuff4ben 10y ago
  Thanks for that!
taylorwc 10y ago
The simple way to do this is to use the authenticator app on each of your phones and scan the QR code at the same time, when you setup 2FA. Since it's time-based, your apps will always be in sync and showing the same code.
michaelt 10y ago
Anyone know if you can use the authenticator app on more than one device? Not only can you do that, you can scan the QR code in the image in the article and get the author's TOTP credentials in 'Google Authenticator'. The normal way to do phone-based 2FA is a QR code with data of the format "otpauth://totp/yourusername?secret=1F56D7AFLONGBASE64&issuer=Amazon" where the secret is the secret needed for TOTP [2] one-time code generation. As such, you can write down the secret (or print out the QR code) and scan it into other phones (or use it with tools like oathtool on linux) and they'll then generate identical codes to your main phone. Obviously, if you store your TOTP secret alongside your password or keep a copy somewhere that isn't safe, there's no point in using 2FA. And if people fuck this up too often 2FA users will start insisting we install twenty shit proprietary apps (one for steam, one for salesforce, one for symantec vip access....) and nobody wants that. So use your new powers with care! [1] https://www.eff.org/files/styles/large/public/2016/12/19/amazon_6.png?itok=vlg3tjCh https://www.eff.org/files/styles/large/public/2016/12/19/ama... [2] https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm https://en.wikipedia.org/wiki/Time-based_One-time_Password_A...
- ckcheng 10y ago
  Printing out or otherwise saving the QR code (somewhere safe) is also the only way to have a backup code in case the device is lost or broken, because they don't provide one-time backup codes (unlike pretty much everyone else). Then again, it sounds like it's really easy to disable 2FA with just a simple phone call, so...
- rahimnathwani 10y ago
  I thought that only worked if the two devices scanned the code at the samw time.
avens19 10y ago
Use Authy instead of Google Authenticator. It allows multiple devices and backups
- bks 10y ago
  +1000 for authy.
tedd4u 10y ago
1Password [0] can store and share one-time passwords as well. [0] https://1password.com/ https://1password.com/
- OrwellianChild 10y ago
  Did not know this! A little cumbersome, but it works!
ust 10y ago
Yes, there is oathtool that you can use on Linux (well, that's how it's called in Debian). I use the same, just type: oathtool --totp -b "key value" where your "key value" is your secret (same thing you would get if you scan QR code). And then you just need to keep the secret safe, and you can run it on as many devices you need. EDIT: just realized that michaelt had much more substantial comment.

fooey 10y ago

Prime lets you share with members of your family https://www.amazon.com/gp/help/customer/display.html?nodeId=200444180 https://www.amazon.com/gp/help/customer/display.html?nodeId=... https://www.amazon.com/myh/households https://www.amazon.com/myh/households

stuff4ben 10y ago
Thanks for that!

taylorwc 10y ago

The simple way to do this is to use the authenticator app on each of your phones and scan the QR code at the same time, when you setup 2FA. Since it's time-based, your apps will always be in sync and showing the same code.

michaelt 10y ago

Anyone know if you can use the authenticator app on more than one device? Not only can you do that, you can scan the QR code in the image in the article and get the author's TOTP credentials in 'Google Authenticator'. The normal way to do phone-based 2FA is a QR code with data of the format "otpauth://totp/yourusername?secret=1F56D7AFLONGBASE64&issuer=Amazon" where the secret is the secret needed for TOTP [2] one-time code generation. As such, you can write down the secret (or print out the QR code) and scan it into other phones (or use it with tools like oathtool on linux) and they'll then generate identical codes to your main phone. Obviously, if you store your TOTP secret alongside your password or keep a copy somewhere that isn't safe, there's no point in using 2FA. And if people fuck this up too often 2FA users will start insisting we install twenty shit proprietary apps (one for steam, one for salesforce, one for symantec vip access....) and nobody wants that. So use your new powers with care! [1] https://www.eff.org/files/styles/large/public/2016/12/19/amazon_6.png?itok=vlg3tjCh https://www.eff.org/files/styles/large/public/2016/12/19/ama... [2] https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm https://en.wikipedia.org/wiki/Time-based_One-time_Password_A...

ckcheng 10y ago
Printing out or otherwise saving the QR code (somewhere safe) is also the only way to have a backup code in case the device is lost or broken, because they don't provide one-time backup codes (unlike pretty much everyone else). Then again, it sounds like it's really easy to disable 2FA with just a simple phone call, so...
rahimnathwani 10y ago
I thought that only worked if the two devices scanned the code at the samw time.

avens19 10y ago

Use Authy instead of Google Authenticator. It allows multiple devices and backups

bks 10y ago
+1000 for authy.

tedd4u 10y ago

1Password [0] can store and share one-time passwords as well. [0] https://1password.com/ https://1password.com/

OrwellianChild 10y ago
Did not know this! A little cumbersome, but it works!

ust 10y ago

Yes, there is oathtool that you can use on Linux (well, that's how it's called in Debian). I use the same, just type: oathtool --totp -b "key value" where your "key value" is your secret (same thing you would get if you scan QR code). And then you just need to keep the secret safe, and you can run it on as many devices you need. EDIT: just realized that michaelt had much more substantial comment.