4 ms·
So long as you never switch or factory reset phones, because Google Authenticator, by design, never reveals the private keys. (I've locked myself out of account
by cbhl 10y ago
So long as you never switch or factory reset phones, because Google Authenticator, by design, never reveals the private keys. (I've locked myself out of accounts because I broke my phone and had to get a new one.)
Also, do you really trust your Android phone with your TOTP private key? How do you know there isn't malware running on it as root?
- deleted 10y ago[deleted]
- tlrobinson 10y agoIsn't that what the backup codes they give you when you enable it are for?
- tptacek 9y agoYes, not to mention that you can enroll more than one TOTP authenticator. There are legit complaints about Google Authenticator (foremost among them that it's a nightmare when you have more than 4-5 accounts), but "no backups" isn't one of them. Don't back up TOTP secrets.
- otterley 10y agoGoogle Authenticator provides a list of backup codes that you can print and put in your wallet, or store as a secure note (e.g. in 1Password): https://support.google.com/accounts/answer/1187538?hl=en https://support.google.com/accounts/answer/1187538?hl=en
- jasonjayr 10y agoOne advantage that software TOTP provides over hardware TOTP, is that you can print the QRCode w/ the private key, and lock it in a safe. This allows you a trivial means of cloning and backing up the token. Unfortunately, this is against best practices, since you have multiple copies of the private key lying around; but this has been an acceptable trade-off for me thus far.
- kej 10y agoJust print the TOTP QR code and store it in a safe place. Then you can set up an authenticator on the new phone with the same key as the old one.
- biafra 9y agoYou can authenticate more than one device. At least with Google accounts in the past. Meanwhile I use Titanium backup to backup authenticator and restore it on a different device.
- tscs37 9y agoThere are alternative TOTP apps that offer backup options.
- alasdair_ 9y agoI use google authenticator along with a printed list of recovery codes. Half are stored in my safe and half in another location offsite. I own a yubikey but it's useless as a permanent device since it needs a fullsize USB port - something my phone (and the latest gen macbook) lack.
- Natanael_L 9y agoThey have a new USB C equipped version