14 ms·

Google authentication is great, until it's time to get a new phone.

XorNot 8y ago
I store my totp secrets in keepass with everything else and synchronise it to my other devices. This probably undermines the idea - but phones get lost/destroyed/wiped regularly.
sethhochberg 8y ago
Check out Authenticator Plus - its another TOTP app that lets you backup your (encypted) 2FA secrets and optionally syncs them across devices. Thankfully Google Authenticator is just TOTP, so you can use whatever client you want.
- jammygit 8y ago
  Thanks for the tip, I only knew about authy before
- witten 8y ago
  Also, check out andOTP on F-Droid: https://f-droid.org/en/packages/org.shadowice.flocke.andotp/ https://f-droid.org/en/packages/org.shadowice.flocke.andotp/ Open source and supports backups.
  - StavrosK 8y ago
    andOTP is amazing, I thoroughly recommend it.
    - otachack 8y ago
      Had no idea about this. I liked Google's Auth since it was simple but it missed the crucial backup feature. Authy is nice but you're putting trust in a 3rd party that doesn't have a channel for donations, though it seems they're making money through SMS (Twilio). andOTP is just what I was looking for since it's FOSS and had backup! This would have been a lifesaver when I lost my phone but glad to have run into it now.
- peterwwillis 8y ago
  TOTP is old and busted, U2F is the new hotness. https://en.m.wikipedia.org/wiki/Universal_2nd_Factor https://en.m.wikipedia.org/wiki/Universal_2nd_Factor
  - slezyr 8y ago
    > The device key is secured against duplication by a degree of social trust in the commercial manufacturer TOTP sounds much better. Also doesn't requires "trusted magic hardware"
    - peterwwillis 8y ago
      U2F prevents some vulnerabilities that TOTP alone can't. It's possible to replicate it in software instead of a hardware token, but so far nobody has. So if you're adopting 2FA, suggestion is to use U2F if you can.
Godel_unicode 8y ago
Print out the QR code and store it in a safe.
lcabral 8y ago
A while back because of shifting mobiles a lot ( due to repairing my mobile and also having a temporary replacement) I ended up making a rudimentary program to store shows codes and even qrcodes for reading from the mobile working in my Linux terminal. https://github.com/lcabral37/terminalOathApp https://github.com/lcabral37/terminalOathApp It did the work and even today I use it every now and then, instead of pulling out the mobile.
JofArnold 8y ago
If you have 1Password it supports OTP and thus can be used across devices.
- jackweirdy 8y ago
  Whenever discussing this with colleagues there’s always been a bit of debate about whether OTP inside 1password constitutes 2FA or not. On the one hand a password could be popped from the target site or phishing, and you’d still need the 2nd factor from 1password to get in. But on the other hand, if you leave your phone lying around unlocked with a poor master password, both get popped together.
  - IMcPwn 8y ago
    If you leave your phone unlocked with Google Authenticator / SMS 2fa and a weak master password, you still get popped. The only difference to me in convenience of 2fa code auto fill.
- GoMonad 8y ago
  LastPass has this too I think. But something seems off to me storing my 2FA with the service that manages my first factor. YubiKeys can store and access OTP secrets. I put the secret in both Google Authenticator and my YubiKeys as backup.
  - SomeHacker44 8y ago
    Lastpass categorically does not have this. We could find no way to use it to share TOTP among administrators for a root account for example. They refused a refund as well. Horrifically bad company customer service, UX, UI. Save yourself the trouble and skip them, call 1Password.
Daniel_sk 8y ago
1Password can store 2FA and will auto-fill them on desktop and mobile.
- zrail 8y ago
  I do this too. I guess it sort of undermines the idea of a second factor but the only way someone could get at it would be to break into my 1Password account, which seems unlikely.
jjeaff 8y ago
Google authenticator allows you to transfer all your codes to a new phone and that includes if you lost your old phone. So they must be backing up to your Google account.
- bubblethink 8y ago
  Do you have a source on this ? I don't think google authenticator backs up by design, and that's good.
antihero 8y ago
This is why it's best to use something like Authy

I store my totp secrets in keepass with everything else and synchronise it to my other devices. This probably undermines the idea - but phones get lost/destroyed/wiped regularly.

sethhochberg 8y ago

Check out Authenticator Plus - its another TOTP app that lets you backup your (encypted) 2FA secrets and optionally syncs them across devices. Thankfully Google Authenticator is just TOTP, so you can use whatever client you want.

jammygit 8y ago
Thanks for the tip, I only knew about authy before
witten 8y ago
Also, check out andOTP on F-Droid: https://f-droid.org/en/packages/org.shadowice.flocke.andotp/ https://f-droid.org/en/packages/org.shadowice.flocke.andotp/ Open source and supports backups.
- StavrosK 8y ago
  andOTP is amazing, I thoroughly recommend it.
  - otachack 8y ago
    Had no idea about this. I liked Google's Auth since it was simple but it missed the crucial backup feature. Authy is nice but you're putting trust in a 3rd party that doesn't have a channel for donations, though it seems they're making money through SMS (Twilio). andOTP is just what I was looking for since it's FOSS and had backup! This would have been a lifesaver when I lost my phone but glad to have run into it now.
peterwwillis 8y ago
TOTP is old and busted, U2F is the new hotness. https://en.m.wikipedia.org/wiki/Universal_2nd_Factor https://en.m.wikipedia.org/wiki/Universal_2nd_Factor
- slezyr 8y ago
  > The device key is secured against duplication by a degree of social trust in the commercial manufacturer TOTP sounds much better. Also doesn't requires "trusted magic hardware"
  - peterwwillis 8y ago
    U2F prevents some vulnerabilities that TOTP alone can't. It's possible to replicate it in software instead of a hardware token, but so far nobody has. So if you're adopting 2FA, suggestion is to use U2F if you can.

Godel_unicode 8y ago

Print out the QR code and store it in a safe.

lcabral 8y ago

A while back because of shifting mobiles a lot ( due to repairing my mobile and also having a temporary replacement) I ended up making a rudimentary program to store shows codes and even qrcodes for reading from the mobile working in my Linux terminal. https://github.com/lcabral37/terminalOathApp https://github.com/lcabral37/terminalOathApp It did the work and even today I use it every now and then, instead of pulling out the mobile.

JofArnold 8y ago

If you have 1Password it supports OTP and thus can be used across devices.

jackweirdy 8y ago
Whenever discussing this with colleagues there’s always been a bit of debate about whether OTP inside 1password constitutes 2FA or not. On the one hand a password could be popped from the target site or phishing, and you’d still need the 2nd factor from 1password to get in. But on the other hand, if you leave your phone lying around unlocked with a poor master password, both get popped together.
- IMcPwn 8y ago
  If you leave your phone unlocked with Google Authenticator / SMS 2fa and a weak master password, you still get popped. The only difference to me in convenience of 2fa code auto fill.
GoMonad 8y ago
LastPass has this too I think. But something seems off to me storing my 2FA with the service that manages my first factor. YubiKeys can store and access OTP secrets. I put the secret in both Google Authenticator and my YubiKeys as backup.
- SomeHacker44 8y ago
  Lastpass categorically does not have this. We could find no way to use it to share TOTP among administrators for a root account for example. They refused a refund as well. Horrifically bad company customer service, UX, UI. Save yourself the trouble and skip them, call 1Password.

Daniel_sk 8y ago

1Password can store 2FA and will auto-fill them on desktop and mobile.

zrail 8y ago
I do this too. I guess it sort of undermines the idea of a second factor but the only way someone could get at it would be to break into my 1Password account, which seems unlikely.

jjeaff 8y ago

Google authenticator allows you to transfer all your codes to a new phone and that includes if you lost your old phone. So they must be backing up to your Google account.

bubblethink 8y ago
Do you have a source on this ? I don't think google authenticator backs up by design, and that's good.

antihero 8y ago

This is why it's best to use something like Authy