5 ms·

> fundamentally impossible to backup an android phone ... to anything other than Google services, I'd wager. It's been tough backing up Android phones as-is.

> fundamentally impossible to backup an android phone ... to anything other than Google services, I'd wager. It's been tough backing up Android phones as-is. I have yet to figure out a way to get codes out of the Google Authenticator app other than via sqlite on a rooted phone.

ignoramous 8y ago
If you're on a rooted Android device, you could backup the entire img with Nandroid [0], or backup apps and data using Titanium Backup [1]. [0] https://android.stackexchange.com/questions/104852/how-do-i-take-a-full-image-backup-of-an-android-device https://android.stackexchange.com/questions/104852/how-do-i-... [1] https://play.google.com/store/apps/details?id=com.keramidas.TitaniumBackup https://play.google.com/store/apps/details?id=com.keramidas....
derekp7 8y ago
That part may be by security design. The purpose of "something you have" is that it is something that can't be trivially copied. My workaround is to record the codes offline before entering them in Authenticator (essentially printing them out and putting in my fire safe). This also allows me to easily put them into other devices (such as upgrading phones, or on a Yubikey).
- marcosdumay 8y ago
  It can not be trivially copied because it's on my pocket. One can improve on this, and compose with a necessary password, that I know, and erasing the data after too many wrong guesses. How does making it hard for me to get my data from my phone improve on my security?
  - maxerickson 8y ago
    Because if you can't get the data off your phone, you can't undermine the part where it can not be trivially copied because it's on your pocket. Once they get the data off a phone the user can upload it to reddit or whatever stupid idea someone might have.
kelnos 8y ago
I would suggest using another app like Authenticator+ that has encrypted cloud sync. It's saved me a ton of trouble over the last few years.
- williamscales 8y ago
  I'm not sure about Authenticator+ as I haven't used it, but I did use Authy. I ran into nearly the same issue when I wanted to migrate to Bitwarden - it was difficult to extract my TOTP secrets. I ended up having to write some Javascript code that would extract them for me. Do use an encrypted cloud sync but make sure that it doesn't create a similar problem.
  - kelnos 7y ago
    In this case, Authenticator+'s cloud sync is just an encrypted sqlite DB (with dirt-simple schema) that gets uploaded to Google Drive (I believe there are also other options for upload target). So it's pretty trivial to migrate to other services.
PascalW 8y ago
Doesn't help you now but I can highly recommend AndOTP [1]. It's an opensource OTP app with support for encrypted backups/restores for your 2FA codes. [1] https://github.com/andOTP/andOTP https://github.com/andOTP/andOTP
e40 8y ago
I have switched Android phones about 10 times and I have never successfully used the Google-made backup. Here's why, I think: Old phone is on Android N. Backups happening regularly by their service. Phone breaks or I get a new phone. New phone is running Android N-1. In the setup process it tries to use the backup and it fails, of course, because it's from a newer version of Android. Every. Single. Time. What I should have done, and I ALWAYS FORGET: do not login to your account until you have fully updated the phone to the latest Android version!
pyt 8y ago
Google disabled backups for their Authenticator app so I don't think they will ever let you export the secrets. I wrote an application to automate OTP secret extraction for just about every app out there after trying to migrate a few dozen tokens from Google Authenticator to AndOTP. You might find it useful: https://github.com/puddly/android-otp-extractor https://github.com/puddly/android-otp-extractor
- ganeshkrishnan 8y ago
  Dont you need root access to get the app private data? I switched from Microsoft to Google because they advertised as having backup and now I am stuck with Google authenticator without any backup. The only saving grace for Android was adb backup and restore but Google is shutting that down
  - pyt 8y ago
    You do need root access, unfortunately. Even backing up the filesystem with `tar` is troublesome: https://github.com/dlenski/tetherback https://github.com/dlenski/tetherback I really hoped Google would have allowed some way to locally make full Android backups by now but I guess that's not compatible with their business model.
nyuszika7h 8y ago
It can definitely be annoying when you have many codes already stored in it, but the long term solution is: don't use Google Authenticator. There are better alternatives such as andOTP / FreeOTP, Authy, or password managers such as 1Password or Bitwarden (paid version) can handle TOTP codes too.

ignoramous 8y ago

If you're on a rooted Android device, you could backup the entire img with Nandroid [0], or backup apps and data using Titanium Backup [1]. [0] https://android.stackexchange.com/questions/104852/how-do-i-take-a-full-image-backup-of-an-android-device https://android.stackexchange.com/questions/104852/how-do-i-... [1] https://play.google.com/store/apps/details?id=com.keramidas.TitaniumBackup https://play.google.com/store/apps/details?id=com.keramidas....

derekp7 8y ago

That part may be by security design. The purpose of "something you have" is that it is something that can't be trivially copied. My workaround is to record the codes offline before entering them in Authenticator (essentially printing them out and putting in my fire safe). This also allows me to easily put them into other devices (such as upgrading phones, or on a Yubikey).

marcosdumay 8y ago
It can not be trivially copied because it's on my pocket. One can improve on this, and compose with a necessary password, that I know, and erasing the data after too many wrong guesses. How does making it hard for me to get my data from my phone improve on my security?
- maxerickson 8y ago
  Because if you can't get the data off your phone, you can't undermine the part where it can not be trivially copied because it's on your pocket. Once they get the data off a phone the user can upload it to reddit or whatever stupid idea someone might have.

kelnos 8y ago

I would suggest using another app like Authenticator+ that has encrypted cloud sync. It's saved me a ton of trouble over the last few years.

williamscales 8y ago
I'm not sure about Authenticator+ as I haven't used it, but I did use Authy. I ran into nearly the same issue when I wanted to migrate to Bitwarden - it was difficult to extract my TOTP secrets. I ended up having to write some Javascript code that would extract them for me. Do use an encrypted cloud sync but make sure that it doesn't create a similar problem.
- kelnos 7y ago
  In this case, Authenticator+'s cloud sync is just an encrypted sqlite DB (with dirt-simple schema) that gets uploaded to Google Drive (I believe there are also other options for upload target). So it's pretty trivial to migrate to other services.

PascalW 8y ago

Doesn't help you now but I can highly recommend AndOTP [1]. It's an opensource OTP app with support for encrypted backups/restores for your 2FA codes. [1] https://github.com/andOTP/andOTP https://github.com/andOTP/andOTP

e40 8y ago

I have switched Android phones about 10 times and I have never successfully used the Google-made backup. Here's why, I think: Old phone is on Android N. Backups happening regularly by their service. Phone breaks or I get a new phone. New phone is running Android N-1. In the setup process it tries to use the backup and it fails, of course, because it's from a newer version of Android. Every. Single. Time. What I should have done, and I ALWAYS FORGET: do not login to your account until you have fully updated the phone to the latest Android version!

pyt 8y ago

Google disabled backups for their Authenticator app so I don't think they will ever let you export the secrets. I wrote an application to automate OTP secret extraction for just about every app out there after trying to migrate a few dozen tokens from Google Authenticator to AndOTP. You might find it useful: https://github.com/puddly/android-otp-extractor https://github.com/puddly/android-otp-extractor

ganeshkrishnan 8y ago
Dont you need root access to get the app private data? I switched from Microsoft to Google because they advertised as having backup and now I am stuck with Google authenticator without any backup. The only saving grace for Android was adb backup and restore but Google is shutting that down
- pyt 8y ago
  You do need root access, unfortunately. Even backing up the filesystem with `tar` is troublesome: https://github.com/dlenski/tetherback https://github.com/dlenski/tetherback I really hoped Google would have allowed some way to locally make full Android backups by now but I guess that's not compatible with their business model.

nyuszika7h 8y ago

It can definitely be annoying when you have many codes already stored in it, but the long term solution is: don't use Google Authenticator. There are better alternatives such as andOTP / FreeOTP, Authy, or password managers such as 1Password or Bitwarden (paid version) can handle TOTP codes too.