4 ms·

I eventually switched away from Google Authenticator to Authy because I found it incredibly frustrating that Google wouldn't let you migrate 2FA codes between d

I eventually switched away from Google Authenticator to Authy because I found it incredibly frustrating that Google wouldn't let you migrate 2FA codes between devices (then, to add insult to injury, they let you migrate your Google token, and only your Google token). Authy has worked well for me so far, having migrated phones twice since then. I've also got it on a backup tablet just to make sure I'm never completely locked out if something goes wrong. But for the security-paranoid, I understand that letting a cloud service store your 2FA tokens is suspect, even if it's password-protected. Steve Gibson suggests the alternative: when the site generates the QR code, take a picture of it, print the picture out, keep it in your safety deposit box. When you change phones, pull the QR codes out and re-scan them.

raulpopa 9y ago
Here is something you could try too, Chrome based Authenticator protected with your typing pattern as 2FA: https://chrome.google.com/webstore/detail/typingdna-authenticator/gmohoglkppnemohbcgjakmgengkeaphi https://chrome.google.com/webstore/detail/typingdna-authenti...
gonvaled 9y ago
Interesting. I have been researching how to dump the database of google authenticator (currently over 20 entries, some non recoverable), but the solution involves rooting my android phone and accessing a protected sqlite file, with a propietary (and version dependent) schema. I am not going to do that. Does authy have the same workflow a google authenticator? Can I add entries with QR code? With ID? Can I dump the database in plaintext? (the IDs) Can it generate QRs for scanning with other 2fa tools? Edit: ah, it's an online service. That kills it for me.
- CodeWriter23 9y ago
  1Password captures and stores TOTPs, even copies the current OTP into your clipboard momentarily when you log in to a site. You don’t have to use their online service; you can keep the password vault in a file. You can sync your devices over LAN and WiFi.
  - dexterdog 9y ago
    Thus defeating the purpose of 2fa
    - gonvaled 9y ago
      Can you ellaborate?
      - HappyRobot 9y ago
        Your passwords and two-factor keys should not be accessible through the same service. If 1Password is hacked, both forms of authentication are compromised.
        CodeWriter23 9y ago
        So, if your phone using any password manager of your choice, Plus Google Authenticator for TOTPs is compromised, same level of risk, right? Because GA has no challenge nor authentication to dump your TOTPs.
        dexterdog 9y ago
        Yes, but if you can put your 2fa manager behind something like samsung knox it gives you some level of separation.
        AdmiralAsshat 9y ago
        > Because GA has no challenge nor authentication to dump your TOTPs. Define "dump". GA won't challenge you to display the one-time TOTP code, no. It would be incumbent upon you to lock your device. But as far as dumping those codes out into a state such that a malicious actor could then take them and import them onto another device, no, that is not easily doable. As the distant parent noted, Google Authenticator stores the stuff in an encrypted sqlite database that is not extractable without root access. I don't think even run-of-the-mill adb debug commands can get it out.
- davchana 9y ago
  Store QR Codes and/or keys in a separate keepass db, like I do, explained in this thread at https://news.ycombinator.com/item?id=16522709 https://news.ycombinator.com/item?id=16522709
- izacus 9y ago
  Authenticator+ allows you to export it's data to file without going through rooting and whatnot.
  - zaarn 9y ago
    I can recommend Authenticator+, it's a very nice and handy application. Though I've recently switched over to simply putting all the 2FA secrets in my keepass database, that's good enough for me in terms of security.
davchana 9y ago
I also do almost similar thing, please see my comment in this thread at https://news.ycombinator.com/item?id=16522709 https://news.ycombinator.com/item?id=16522709

raulpopa 9y ago

Here is something you could try too, Chrome based Authenticator protected with your typing pattern as 2FA: https://chrome.google.com/webstore/detail/typingdna-authenticator/gmohoglkppnemohbcgjakmgengkeaphi https://chrome.google.com/webstore/detail/typingdna-authenti...

gonvaled 9y ago

Interesting. I have been researching how to dump the database of google authenticator (currently over 20 entries, some non recoverable), but the solution involves rooting my android phone and accessing a protected sqlite file, with a propietary (and version dependent) schema. I am not going to do that. Does authy have the same workflow a google authenticator? Can I add entries with QR code? With ID? Can I dump the database in plaintext? (the IDs) Can it generate QRs for scanning with other 2fa tools? Edit: ah, it's an online service. That kills it for me.

CodeWriter23 9y ago
1Password captures and stores TOTPs, even copies the current OTP into your clipboard momentarily when you log in to a site. You don’t have to use their online service; you can keep the password vault in a file. You can sync your devices over LAN and WiFi.
- dexterdog 9y ago
  Thus defeating the purpose of 2fa
  - gonvaled 9y ago
    Can you ellaborate?
    - HappyRobot 9y ago
      Your passwords and two-factor keys should not be accessible through the same service. If 1Password is hacked, both forms of authentication are compromised.
      - CodeWriter23 9y ago
        So, if your phone using any password manager of your choice, Plus Google Authenticator for TOTPs is compromised, same level of risk, right? Because GA has no challenge nor authentication to dump your TOTPs.
        dexterdog 9y ago
        Yes, but if you can put your 2fa manager behind something like samsung knox it gives you some level of separation.
        AdmiralAsshat 9y ago
        > Because GA has no challenge nor authentication to dump your TOTPs. Define "dump". GA won't challenge you to display the one-time TOTP code, no. It would be incumbent upon you to lock your device. But as far as dumping those codes out into a state such that a malicious actor could then take them and import them onto another device, no, that is not easily doable. As the distant parent noted, Google Authenticator stores the stuff in an encrypted sqlite database that is not extractable without root access. I don't think even run-of-the-mill adb debug commands can get it out.
davchana 9y ago
Store QR Codes and/or keys in a separate keepass db, like I do, explained in this thread at https://news.ycombinator.com/item?id=16522709 https://news.ycombinator.com/item?id=16522709
izacus 9y ago
Authenticator+ allows you to export it's data to file without going through rooting and whatnot.
- zaarn 9y ago
  I can recommend Authenticator+, it's a very nice and handy application. Though I've recently switched over to simply putting all the 2FA secrets in my keepass database, that's good enough for me in terms of security.

davchana 9y ago

I also do almost similar thing, please see my comment in this thread at https://news.ycombinator.com/item?id=16522709 https://news.ycombinator.com/item?id=16522709