4 ms·

Tangent, but the article mentions using Google Authenticator -- I was going to start using that recently, but the reviews indicated it had some really big probl

Tangent, but the article mentions using Google Authenticator -- I was going to start using that recently, but the reviews indicated it had some really big problems with restoring when you get a new phone etc and Google isn't really maintaining it. https://itunes.apple.com/us/app/google-authenticator/id388497605?mt=8 https://itunes.apple.com/us/app/google-authenticator/id38849... Can anyone comment on their 2fa approach to google?

scrollaway 9y ago
On Android, I use FreeOTP; I can make backups with `adb`. Separately, I use KeepassXC (https://keepassxc.org https://keepassxc.org) and store all my 2fa seeds in a dedicated (separate) 2fa database which I keep locked. You can also keep it in the same database as your password db if you want to trade the 2nd factor for convenience but still get the added benefit of one time passwords.
- philsnow 9y ago
  > I can make backups with `adb` does it follow that an attacker can make a "backup" of your 2fa codes as well, if they get ahold of your phone for a minute or two?
  - craftyguy 9y ago
    No, because you can (and should) disable usb connectivity/debugging.
  - scrollaway 9y ago
    Physical device access is where this kind of security ends. If someone stealing your phone just to get your 2fa codes is a threat vector for you, you should be using different/additional factors. In any event, as was pointed out, adb needs usb debugging turned on, which needs the device unlocked to be enabled.
  - veeti 9y ago
    You need to authorize each adb key on the phone, so a screen lock prevents this.
notheguyouthink 9y ago
I always (usually) get a copy of the string token when adding a "google" 2fa. I store this in a password manager. This allows me to have more confidence in recovery, as well as adding more devices, etc.
badloginagain 9y ago
I thought Google Authenticator was not recommended, and that Google was fully backing 'Duo'
_mcdougle 9y ago
Always save the keys (or the scanner code) whenever you add them to Authenticator. Then, when you get a new phone (or whatever) you can just re-import the keys.
- koolba 9y ago
  It's pretty stupid that Google doesn't allow for any way of getting the keys out of it's 2FA app. Your only transition path is backup/restoring an entire device to a newer one of the same OS. There's no direct path to migrate from say an iPhone to an Android based phone without manually adding each 2FA entry to the new device.
  - mrrsm 9y ago
    I think they do this to make it harder for an exploit to just run the command to get the keys. I'm torn whether I think this is really an issue or not though. From a security standpoint it is one less attack vector to get my 2nd factor keys. From a usability standpoint it is annoying when I switch devices. I personally solved this problem by storing my two factor auths on my yubikey neo which is a bit more portable. I don't think there is a way to get the keys off of there either but at least the key itself is portable and works with Android and all my desktops/laptops. I am not sure if they ever figured out iPhones though.
  - dangero 9y ago
    I agree this is SHOCKINGLY not consumer ready. Considering all the shaming I see every hack about 2fa I expected it to be pretty streamlined.
  - jamesgeck0 9y ago
    > Your only transition path is backup/restoring an entire device to a newer one of the same OS. This isn't an option on iOS! When I bought an iPhone a year and a half ago, the 2FA keys were not included in my iTunes device backup, even through backup encryption was turned on. I had to manually create new keys for all seven sites I use Google Authenticator with.
deleted 9y ago
[deleted]
valj 9y ago
I just changed phones and found this really simple. You can just store a phone number with Google and receive an SMS key if you forgot to print off a key before changing phones. Everything seems to be working pretty well for me and I noticed improvements since last using the app 1+ years ago, but obviously can't guarantee it's still being updated.
- koolba 9y ago
  That might work with Google itself but TOTP based 2FA codes aren't specific to Google. They can be used out of band by anyone and the SMS approach wouldn't apply to anybody else.
  - valj 9y ago
    Ahh yes - excellent point.
deleted 9y ago
[deleted]
eridius 9y ago
Google Authenticator is really just TOTP. My preferred approach is to use 1Password, which handles TOTP codes just fine.
mwj 9y ago
Authenticator Plus. It's a paid product, but allows me to sync my TOTP tokens to my Google drive account, so I'll never have that problem again.
morley 9y ago
I personally use Authy, and it's survived several migrations to new phones.
nickik 9y ago
Additionally to the other suggestion I can recommend using a Yubikey with NFC together with the Yubico Authenticator. You can easily move between devices.

scrollaway 9y ago

On Android, I use FreeOTP; I can make backups with `adb`. Separately, I use KeepassXC (https://keepassxc.org https://keepassxc.org) and store all my 2fa seeds in a dedicated (separate) 2fa database which I keep locked. You can also keep it in the same database as your password db if you want to trade the 2nd factor for convenience but still get the added benefit of one time passwords.

philsnow 9y ago
> I can make backups with `adb` does it follow that an attacker can make a "backup" of your 2fa codes as well, if they get ahold of your phone for a minute or two?
- craftyguy 9y ago
  No, because you can (and should) disable usb connectivity/debugging.
- scrollaway 9y ago
  Physical device access is where this kind of security ends. If someone stealing your phone just to get your 2fa codes is a threat vector for you, you should be using different/additional factors. In any event, as was pointed out, adb needs usb debugging turned on, which needs the device unlocked to be enabled.
- veeti 9y ago
  You need to authorize each adb key on the phone, so a screen lock prevents this.

notheguyouthink 9y ago

I always (usually) get a copy of the string token when adding a "google" 2fa. I store this in a password manager. This allows me to have more confidence in recovery, as well as adding more devices, etc.

badloginagain 9y ago

I thought Google Authenticator was not recommended, and that Google was fully backing 'Duo'

_mcdougle 9y ago

Always save the keys (or the scanner code) whenever you add them to Authenticator. Then, when you get a new phone (or whatever) you can just re-import the keys.

koolba 9y ago
It's pretty stupid that Google doesn't allow for any way of getting the keys out of it's 2FA app. Your only transition path is backup/restoring an entire device to a newer one of the same OS. There's no direct path to migrate from say an iPhone to an Android based phone without manually adding each 2FA entry to the new device.
- mrrsm 9y ago
  I think they do this to make it harder for an exploit to just run the command to get the keys. I'm torn whether I think this is really an issue or not though. From a security standpoint it is one less attack vector to get my 2nd factor keys. From a usability standpoint it is annoying when I switch devices. I personally solved this problem by storing my two factor auths on my yubikey neo which is a bit more portable. I don't think there is a way to get the keys off of there either but at least the key itself is portable and works with Android and all my desktops/laptops. I am not sure if they ever figured out iPhones though.
- dangero 9y ago
  I agree this is SHOCKINGLY not consumer ready. Considering all the shaming I see every hack about 2fa I expected it to be pretty streamlined.
- jamesgeck0 9y ago
  > Your only transition path is backup/restoring an entire device to a newer one of the same OS. This isn't an option on iOS! When I bought an iPhone a year and a half ago, the 2FA keys were not included in my iTunes device backup, even through backup encryption was turned on. I had to manually create new keys for all seven sites I use Google Authenticator with.

deleted 9y ago

[deleted]

valj 9y ago

I just changed phones and found this really simple. You can just store a phone number with Google and receive an SMS key if you forgot to print off a key before changing phones. Everything seems to be working pretty well for me and I noticed improvements since last using the app 1+ years ago, but obviously can't guarantee it's still being updated.

koolba 9y ago
That might work with Google itself but TOTP based 2FA codes aren't specific to Google. They can be used out of band by anyone and the SMS approach wouldn't apply to anybody else.
- valj 9y ago
  Ahh yes - excellent point.

deleted 9y ago

[deleted]

eridius 9y ago

Google Authenticator is really just TOTP. My preferred approach is to use 1Password, which handles TOTP codes just fine.

mwj 9y ago

Authenticator Plus. It's a paid product, but allows me to sync my TOTP tokens to my Google drive account, so I'll never have that problem again.

morley 9y ago

I personally use Authy, and it's survived several migrations to new phones.

nickik 9y ago

Additionally to the other suggestion I can recommend using a Yubikey with NFC together with the Yubico Authenticator. You can easily move between devices.