10 ms·

Google's Abandoned Android Authenticator App

313 points by edent 7y ago

skyfaller 7y ago
I recently switched to Aegis Authenticator: https://getaegis.app/ https://getaegis.app/ It seems to be as well-maintained as andOTP, and I like that it is licensed GPLv3 rather than MIT.
fredley 7y ago
I recently switched to Aegis, it's so much better, and open source[0]. Crucially it has biometric encryption, and import/export so switching to a new device isn't a horrific ordeal. It also has some great QoL features like custom icons, highlighting, and reordering. To anybody looking to move away from Google Authenticator, I highly recommend it. 0: https://github.com/beemdevelopment/Aegis https://github.com/beemdevelopment/Aegis
- Satwell2 7y ago
  This looks good but I can't find any information about who is behind it and why I should trust them. I wish they were collaborating with a well known project like andOTP instead.
AdmiralAsshat 7y ago
I switched to Authy some years ago. It took Google forever to add the ability to Authenticator to let you migrate 2FA codes to new devices, and even then, it was only Google codes. I got tired of having to deactivate 2FA on my 20 or so accounts, switch to my new Android device, reactivate 2FA, and then scan the QR codes on the new device. Authy made it a painless experience, particularly since I could verify codes were working on the new device before factory resetting the old one.
- chasingthewind 7y ago
  I actually associated a Yubikey to my account because I was so annoyed at this problem. I wanted a better backup plan than the physical printed codes idea. I didn't realize that a better 2FA app would have solved this :P
  - AdmiralAsshat 7y ago
    Not everything supports Yubikey/FIDO U2F at this point, so that wouldn't work for everything, although I do have one. My Gmail account itself is behind a Yubikey (and a a backup Yubikey), not a 2FA app, because I'm trying to avoid a Game Over scenario. The Gmail address is the recovery address for my password manager account, so getting that pwned is basically the keys to the kingdom for every other account.
    - bickeringyokel 7y ago
      I realize not everyone wants to leave Gmail, but another reason I'm thinking of using tutanota aside from e2e encryption is you can create a second user that's tied to your master account. You can reset the passwords of your sub accounts from the main accout if they are compromised.. of course you have to pay for multiple accounts though.
    - Vinnl 7y ago
      The weird thing is: Yubikey was the only option for me in Gmail. Only after I associated a Yubikey with it, was I able to also use an authenticator app. Does anyone know if this is normal behaviour, and if so, what the reasoning behind it is?
      - angry_octet 7y ago
        That's weird, probably a glitch. TOTP is the basic option.
  - skybrian 7y ago
    Having printed access codes in your safe doesn't seem worse than a backup Yubikey in your safe? Maybe better, since electronic devices can break.
    - angry_octet 7y ago
      Either way, put it in a tamper evident envelope in the safe.
- djanogo 7y ago
  The QR code you scan is stored in app's db, you can use generic scanner to get the code and save it on paper or another encrypted DB or extract them from the Google Auth app SQL DB - if you have root access.
  - AdmiralAsshat 7y ago
    Good luck getting root access on a US Snapdragon Samsung phone. IIRC, they physically damage themselves in some way if they detect that they've been rooted, which then caps the battery from ever going beyond 70 or 80%.
    - nrclark 7y ago
      I'm interested to read more about this, do you have a source for it? That seems like it would be just asking for a world of warranty returns and support nightmares for whatever company built it into their phones.
      - AdmiralAsshat 7y ago
        Here's the only quick source I could find about the battery being capped while rooted: https://www.xda-developers.com/sampwnd-root-galaxy-s8-snapdragon/ https://www.xda-developers.com/sampwnd-root-galaxy-s8-snapdr... I'm pretty sure this was implemented across their phones after the Galaxy Note 7 debacle. I think the idea was that anyone who tried to root their devices and avoid Samsung remotely deactivating them would at least be prevented from charging the battery to full, which could cause the battery swelling/overheating/fire-catching problem. I'll have to do more digging on the quote I remember about Samsung phones physically blowing a circuit somewhere if they detect they've been rooted.
        XMPPwocky 7y ago
        > I'll have to do more digging on the quote I remember about Samsung phones physically blowing a circuit somewhere if they detect they've been rooted. This sounds like the ODIN QFuse. These aren't really particularly dramatic- they're tiny, microscopic "fuses", designed to blow cleanly and easily. Most devices have plenty of them- used to lock the devices down after manufacturing.
- fullstop 7y ago
  I went to Authy and then to Yubikey. I can get to my OTP from just about any smart phone now or even my desktop.
  - Yhippa 7y ago
    What do you do in the event you lose your Yubikey?
    - joshvm 7y ago
      You hope that you have printed backup codes for whichever services provide it, or alternative auth, or you go through ID verification to regain access. Not much else you can do, the point of 2FA is that you can't get in without it. Some services let you store multiple keys. So you can own a separate yubikey that you keep in a trusted place eg deposit box.
    - inetsee 7y ago
      Yubikey recommends "having a backup device and registering both with your accounts". I vaguely remember some people saying that they have a backup Yubikey that they keep in their safe deposit box, so that it's as safe as possible.
      - nicpottier 7y ago
        Does anybody do this? I've read that as well but it doesn't make sense to me. How do I add my backup device if it is in a vault somewhere? For that to be useful I would have to have my backup device on me so I can add new accounts, but then that defeats the purpose. I could see this working for a few very secure logins, but if the idea is to two factor everything it doesn't seem tenable.
        deleted 7y ago
        [deleted]
        tmottabr 7y ago
        No, your backup device need to be stored until you need it, not with you all times. you add your main device and your backup device. than you store the backyup device, after having it configured on your accounts, in the safe and use the main device to authenticate on a daily basis. when you create a new account you add your main device and than when possible retrieve the backup device from storage and add the new account to it and store it back again. on the event of you loosing your main device you retrieve the backup device from storage, use it to authenticate and remove your lost device from your accounts. You can then acquire a new one key, add to all your accounts and store the backup in a safe again until needed.
- whoisjuan 7y ago
  I use Authy, but God, I hate their UI and UX. Finding the accounts there is a pain in the ass, and for some reason, I always end up with duplicated accounts (when I just added them once). Also, it has been two months since their last iOS update, so it's not like Twilio is taking care of it either.
  - zouhair 7y ago
    Give andOTP a try[0] [0]: https://github.com/andOTP/andOTP https://github.com/andOTP/andOTP
    - phs 7y ago
      I love andOTP, it does one job and gives me (not my phone's firmware) control over the secret storage.
  - notlukesky 7y ago
    I use SAASPASS Authenticator for personal services and it has search capabilities and also optional autofill on both desktop (with browser extension) and mobile. The codes can also be copy/pasted from the web portal. https://saaspass.com/ https://saaspass.com/ Full disclosure: I work for a SI that integrates SAASPASS IAM to enterprises.
    - aroch 7y ago
      You've posted the same comment several times throughout this thread and in the past you've also, shall we say, name dropped saaspass repeatedly. While also ignoring questions about your affiliation with the company. Mind explaining why you bring them up so often?
    - effingwewt 7y ago
      Adding a disclaimer but continuously peppering the entire thread with your C/P seems beyond disingenuous.
  - bonestamp2 7y ago
    Agreed. My biggest complain is the sorting of the list, a very simple thing to fix. I mean, how come I can't change the order of some accounts on some platforms? I only login to my tax account once a year, but on the desktop app it is first alphabetically so it's always at the top. Meanwhile, I login to my vpn multiple times a day and it is alphabetically at the bottom. So, I've had to start prefixing names with bullshit just to get them in a convenient order. It's like they don't use their own product or they'd notice this flaw very quickly.
- gerash 7y ago
  IIUC the Authy "feature" where it allows you to transfer 2FA codes to a new device defeats the purpose of 2FA. That is, if someone gets access to your Authy account they'll get access to your 2FA codes. This has been used to steal cryptocurrencies from users in the past: https://www.newsbtc.com/2017/06/03/coinbase-recommends-users-enable-google-authenticator-ditch-authy/ https://www.newsbtc.com/2017/06/03/coinbase-recommends-users...
  - AdmiralAsshat 7y ago
    True, but you can enable/disable the multi-device feature at any time. So you can theoretically just turn it long enough to port your codes over to the new device, confirm that they work, and then de-authorize the old advice from the account and turn the feature off. I ended up doing as much when I lost my Android tablet at a bookstore on which I had Authy installed. It gave me a mild panic attack at the time, but, a year later and none of my accounts have been hacked yet, so, I have to hope that the other security measures on the device were enough to thwart the potential thief/adversary.
kjaftaedi 7y ago
The author doesn't explain why this is a google problem other than their code is "old". The way the source article reads, it seems like the vulnerability would affect any OTP app.
- edent 7y ago
  The latest version of [andOTP](https://github.com/andOTP/andOTP/releases https://github.com/andOTP/andOTP/releases) indicates that it protects some of the fields from accessibility hijack. I suspect other apps will find a way to prevent this attack. The problem I, the author, have is that it seems unlikely that Google can fix this. What are the risks associated with suddenly changing a codebase which is 2.5 years old? Is there anyone there who works on it day-to-day, understands how it works, and can release a verifiably fixed patch? Security products need constant maintainance.
- smt88 7y ago
  No user should trust the security of an app that was abandoned 2.5 years ago. It's irresponsible (and typical) of Google to keep the app available and unmaintained. Even if the code were bug-free at the time, dependencies, APIs, and attacks change.
excerionsforte 7y ago
I got rid of Google Authenticator in 2018 preferring Microsoft Authenticator after feeling weary about having to setup 2FA on a new phone and subsequently reading posts like https://smartphones.gadgethacks.com/news/google-authenticator-is-not-best-2fa-app-anymore-0186776/ https://smartphones.gadgethacks.com/news/google-authenticato... which made me aware that I didn't have to go through that pain anymore if I dumped Google Authenticator.
- antaviana 7y ago
  If you do not mind your phone contacts are shared with the app [1], Microsoft Authenticator is fine. [1] https://docs.microsoft.com/en-us/azure/active-directory/user-help/user-help-auth-app-faq https://docs.microsoft.com/en-us/azure/active-directory/user...
  - excerionsforte 7y ago
    That would be valid concern if you could not deny the permissions meaning this doc is out of date. I have both iOS and Android and have the permissions set to deny as they are not essential to the operation of the application. Also, these concerns would pop up in the reviews if you could not deny the permission if it asked for it. One of the reasons I looked at MS Authenticator because it is one of the highest scoring and reviewed authenticator apps, so it would have taken a hit on the score if this was not possible.
  - eyegor 7y ago
    Why would you need to give it contacts permissions? Just deny it.
  - prophesi 7y ago
    "Contacts and phone: The app requires this permission so it can search for existing work or school Microsoft accounts on your phone and add them to the app, helping to ensure your account works properly. This permission also helps save you time while adding your personal Microsoft accounts, by automatically filling in some of the info for you, like your first and last name." Wow, they really did their best to find a sliver of justification for that permission. I don't need an OTP app to autofill my first and last name. And to those arguing about their opt-out for this permission, ask what unnecessary permissions your coworkers/family/friends have denied on the last few apps they installed.
bad_user 7y ago
Website is blocking my access with a challenge that doesn't work :-(
- edent 7y ago
  I've had a few reports of that. Are you using Tor or something similarly exotic?
  - insomniacity 7y ago
    Assuming this is recaptcha, I have heard that sometimes your IP/cookie reputation can be so bad that they reject valid responses to the challenge.
  - bad_user 7y ago
    I'm using PrivateInternetAccess as my VPN.
asdfasgasdgasdg 7y ago
Wait. The vulnerability report says, "Abusing the Accessibility privileges, ..." the trojan can steal your OTPs. If you give a program accessibility privileges, it can read the screen. Is that all we're talking about here? What is the proposed mitigation that Google should implement on the app? You can't block accessibility on the OTP app because then blind people will not be able to use it.
- Piskvorrr 7y ago
  Another app that stores credentials mitigates this by putting up a 30-second delay; the text goes a bit like this: "It seems that you are using a screen reader or something else that uses the Accessibility services. If you have no idea what this is, do not continue past this screen. The below buttons will be enabled in 30 seconds [I know what is happening] [This doesn't sound familiar, exit]" (Of course it only appears when you actually have something subscribed into the accessibility services, which is how I found out) Yes, it's inconvenient, but forces you to actually read the message instead of blindly barging through Accept Accept Accept.
  - asdfasgasdgasdg 7y ago
    Does it do that every time, or just the first time? If it just happens once I guess that might be a tolerable tradeoff. Still doesn't seem like it's worth classifying Google's app as abandoned just because they declined to implement this particular feature.
    - Piskvorrr 7y ago
      Each time. Annoying, but bearable for something I use once a day...
  - IAmEveryone 7y ago
    That places the burden on people required to use such assistive technology. I’m sure life as a blind person is already full of obstacles, so we should maybe think twice before actively seeking to build new barriers. And how does this actually prevent abuse? Wouldn’t malware happily wait 30 seconds and click “yes”? And if the dialog isn’t accessible to the screen reader, doesn’t it then exclude some users entirely?
deleted 7y ago
[deleted]
derefr 7y ago
The fact that malware can steal Google Authenticator TOTP seeds, means that non-malware apps on your phone—e.g. other TOTP apps—could also steal (i.e. import) these seeds, no? I’d quite enjoy if e.g. 1Password would import all my Google Authenticator tokens into itself automatically. I’ve been meaning to move them over for a long while now, but it’s a whole process, since there’s no place in the Google Authenticator UI to retrieve the original seed value.
- plttn 7y ago
  It's just using the accessibility privileges to look at the contents of the screen like a screen reader would, and copy the shown code. This isn't quite as advanced as "stealing your seeds".
lars_francke 7y ago
I've recently tried switching to YubiKeys to store all my 2FA tokens and only later learned that they have a hard limit of 32 stored tokens. Does anyone know of an alternative hardware token that supports more than that and also all the other protocols that YubiKeys do?
- EthanHeilman 7y ago
  Why can't yubikey use a single root secret and derive all sub-secrets from that root secret?
  - nickez 7y ago
    They should be doing that. Maybe the OP means the limitations on passwordless credentials and not u2f credentials.
    - lars_francke 7y ago
      I might get the terminology wrong. What I meant are the HOTP and TOTP secrets. They can only store 32 of them.
      - lars_francke 7y ago
        This is what I'm referring to https://support.yubico.com/support/solutions/articles/15000014219-yubikey-5-series-technical-manual#OATHkht9hr https://support.yubico.com/support/solutions/articles/150000...
  - juriansluiman 7y ago
    Because usually the server sends the shared secret and there are just 32 slots for shared secrets available.
    - EthanHeilman 7y ago
      Yubikey and webauthn[0] supports public key authentication where the client chooses the secret. [0]: https://webauthn.io/ https://webauthn.io/
otachack 7y ago
I recommend to use anything but Google Authenticator. andOTP is my preferred considering you can make non-encrypted and encrypted backups of all entries. I lost my phone once and was primarily using Google Authenticator at the time. Because I didn't backup the seeds when registering entries to Google Auth, I had to go through some recovery processes on many of my accounts which where time consuming, nerve wrecking, and annoying. This was at the height of crypto craze so one account was Coinbase in which I had to go through some in depth recovery process (with an ID an all, which ended up crossing some legal lines in my state). Do yourself a favor and either use a service with a supported and up to date app or take control with an app like andOTP and take backups yourself.
thedance 7y ago
This affects any totp app like Symantec VIP, doesn't it?
ISL 7y ago
Is the app truly abandoned? If there's one 2FA app I wouldn't expect to be abandoned, it is Authenticator.
morpheuskafka 7y ago
I thought the keyboard apps listed as abandoned at the end of the article were all rolled into the main Gboard app?
Slartie 7y ago
This looks like the same pattern observed with the iOS Google Authenticator app. That one was neglected for multiple years as well, up to the point at which it looked ridiculously out of place on newer devices because it was running in some compatibility mode for old screen sizes and screen resolutions. After multiple years of no support whatsoever, they finally updated it. But apparently that was just random luck - the current version is over a year old already as well, with the update news saying "Added support for iPhone X". I don't get it why Google apparently does not get the notion that they basically "own" the brand identity of what we technically-minded people know as the TOTP 2FA scheme - and they own it because of the Google Authenticator app. Thousands of websites ask their users to install "the Google Authenticator app" if the user wants to enable 2FA - they don't tell them to install "an OTP app" or something like that, no, practically everyone refers to this scheme and the associated apps as "Google Authenticator". And it can't be too hard for a company able to fund and drive the development of a leading web browser engine to keep a simple TOTP app up to date and well-supported in the two major smartphone ecosystems. Heck, a single full-time developer should be more than enough manpower to do that! And Google has like, what, 100.000 of them? Instead, Google lets other companies slowly chip away at their mindshare in the 2FA market - during the years of Google's inactivity, lots of alternative applications sprung up, and many password safe apps added TOTP support to their feature catalogs. We're at a point at which most technically savvy people advise other people to use ANY of those apps, but NOT Google Authenticator, even if the website tells them so. It's just a matter of time until the sites catch up and quit suggesting Google Authenticator (after all, the shortcomings of Google's application, like inability to backup seeds, probably cause additional burden on support channels for sites explicitly mentioning Google Authenticator, and if there are other apps that cause less problems, suggesting to use those at some point in time will be more beneficial than the brand name recognition bonus provided by suggesting an app by Google).
- wpietri 7y ago
  I'm ok with Google truly owning something. And I'm ok with them not doing something at all. But i want them to stop jumping in, bigfooting a space, and then losing interest. I know they've given up on "don't be evil", but maybe they can at least adopt, "With great power comes great responsibility."
exabrial 7y ago
Wait, can it steal the stored secrets or just codes? I'd love for a utility that can "steal" the secrets so I can migrate to my yubikey 5c.
- eyegor 7y ago
  Isn't there a way to get it to display the qr codes for connected accounts? Then you could migrate via registering those.
  - exabrial 7y ago
    No there's not unfortunately. Nowadays, I encrypt the QR codes using my GPG key and store them with pass.
- pyt 7y ago
  If you have a rooted Android phone, I wrote a tool to pull secrets from most popular OTP apps: https://github.com/puddly/android-otp-extractor https://github.com/puddly/android-otp-extractor
  - cesarb 7y ago
    You might not even need a rooted phone. For at least one of these apps, you can extract the secrets from an ADB backup, which does not need root (it only needs the developer mode).
    - pyt 7y ago
      Interesting. Do you know which still one allows backups?
stuff4ben 7y ago
At this point should we assume that ANYTHING Google does will be supported in the future? Fool me once shame on me, fool me over and over again and I'll replace you with someone who cares. This is a pattern of consumer abuse (privacy and abandonware) that Google continues to exhibit. Why should we continue to support them?
ThePhysicist 7y ago
Good thing TOTP is an open standard, so there are some alternative apps available. I guess they consider TOTP as legacy and are focusing on U2F, I think in their products you can’t even sign up for TOTP based 2FA anymore. I amassed quite a collection of U2F Titan security keys that Google gave away for free at conferences, some of them have become obsolete already though and some had serious security issues (the Bluetooth one). I prefer using the Yubikey for that reason, though I find them quite a bit overpriced.
- nucleardog 7y ago
  You can still sign up, but it's a bit of a pain. When you initially enable 2FA, you won't be given the option. But you can register with SMS/U2F/etc. Once you've enabled the first authentication method, you can go into your 2FA settings and add a virtual 2FA device. Once that's done, you can go back and delete whatever you added initially to be left with only a virtual 2FA device.
vzaliva 7y ago
Potential vulnerability aside, I think the article leaves you with wrong impression about stat of Google Authenticator app. In my understanding Google Authenticator app you install from App Store is not the same as github app authors talking about. As it clearly says in README "While this fork is open source, the official version of the app still remains proprietary. There is no guarantee that the open source repository will receive any changes made upstream (or vice versa)."
- edent 7y ago
  If you visit the Authenticator app on https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en https://play.google.com/store/apps/details?id=com.google.and... - you'll see at the bottom that it was last updated on September 27, 2017 As in, that's the last time an updated was published on the Play store. I'm sorry I didn't make that clearer.
zouhair 7y ago
And the usual Google neglect of its products continues. It's a vicious circle, they keep neglecting apps, people start using them less and less and as they notice people using them less they neglect them more and the cycle continues until they kill it. This is one of the main reasons I stopped using any of their new projects.
danso 7y ago
FWIW, the iOS version was last updated on Sept. 12, 2018, a minor update for iPhone X support and "Minor bug fixes". The second-to-last update, from 2.3.0 => 3.0.0, was Feb. 2016: https://apps.apple.com/us/app/google-authenticator/id388497605 https://apps.apple.com/us/app/google-authenticator/id3884976...
Someone1234 7y ago
This is a bad article. Let me summarize my thoughts: - The "security bug" it references isn't one at all. Accessibility Services can draw over other apps and interact with them by design. They're designed as an alternative way of interactive with android for disabled people consequentially they can do anything a normal user can do. The security "researcher" found a non-bug then convinced an ignorant journalist at zdnet to publish an article about normal/correct Android functionality. - If it were somehow a bug, it is still impossible for Google Authenticator to patch/mitigate it. Accessibility Services act as the user, therefore they can do anything a user can do. You cannot block them for good reason (breaks disable user's ability to use Android). - The third party apps they reference don't block Accessibility Services either, making it hypocritical to criticize one while pointing to others with the same fictitious flaw. - Switching to a random open source TOTP/HOTP 2F app might reduce your security, not increase it. You'll either compile it yourself requiring enabling "Allow installation from unknown sources" (bad) or you'll more commonly just grab it from the app store, in which case that random OSS developer's account can feed you evil-ware either intentionally or via compromise. As soon as it is from the app store the "open source" nature is completely irrelevant, it isn't a security guarantee. - No unpatched security bugs have been found in Google Authentictor. Google Authenticator's lack of updates are annoying though (unfixed bugs, poor backup support, QoL features like secondary pin, etc). Just not the way the article frames it.
- drewg123 7y ago
  > compile it yourself requiring enabling "Allow installation from unknown sources" This is one of my biggest pet peeves about Android. I wish i could add my own signing key for apps I compile myself, rather than just being given the choice of Google play or anything at all.
  - Operyl 7y ago
    In a round about way you sort of can now. The “allow installation from unknown sources” is per app-source now. You need to enable it for Google Chrome if you downloaded the package from Chrome, or for F-Droid if you downloaded it from F-Droid. So, the solution you’re looking for could be just a small shim app to download from your own repository of sorts. Janky .. but it’s a bit more possible than before I guess. As an added bonus you could do some signature validations too!
bilal4hmed 7y ago
if you are on Android, I highly recommend Aegis https://github.com/beemdevelopment/Aegis https://github.com/beemdevelopment/Aegis its open source, supports import of keys as well as export with a very active dev.
zackify 7y ago
The most frustrating thing about this app.... is that it ignores other algorithms such as sha-256 or 512. But get this! On iOS it correctly shows the right OTP code for these algorithms. On android it acts like it’s a sha-1 and has the wrong code....
- notlukesky 7y ago
  SAASPASS Authenticator supports all of them. https://saaspass.com/ https://saaspass.com/ Full disclosure: I work for a SI that integrates SAASPASS IAM to enterprises.
Avamander 7y ago
I don't think it actually needs an update. Supporting new features would be nice, but it's not a requirement.
dep_b 7y ago
I remember even installing Google Authenticator for some kind of Microsoft project, which seemed to legitimize it even more.
acdha 7y ago
I'm a big fan of using the Yubico Authenticator instead of Google's apps: https://www.yubico.com/products/services-software/download/yubico-authenticator/ https://www.yubico.com/products/services-software/download/y... In addition to being supported, it avoids the possibility of a future mistake leaking TOTP seeds since they're stored on the key rather than the phone.
dagaci 7y ago
Is Microsoft authenticator interchangeable with Google's?
srathi 7y ago
I've moved to Authy. They allow a backup password to encrypt all tokens on their servers. I think that is a valid tradeoff with a random password saved in Keepass. Otherwise, changing a cellphone (or hard resetting) is an arduous task.
dang 7y ago
Related current thread: https://news.ycombinator.com/item?id=22443225 https://news.ycombinator.com/item?id=22443225
darawk 7y ago
Hmm. I see a lot of people here responding that disabling this would break the Accessibility Services, and I completely agree. However, it does seem to me like there is a genuine problem here. Perhaps the solution is to have a two-layer accessibility permission system? One permission for reading the screen of non-inherently-sensitive applications, like web browsers and email clients, and another permission for reading high-sensitivity applications like Google Authenticator. Enabling the second permission would come with very strong warnings about security, and the admonition that you should really really trust this application provider a lot more than your average screen reader app.
ohazi 7y ago
If Authenticator is actually abandoned, are there any suggested alternatives? I know I can just get a yubikey, but I'm still not comfortable with the process for temporarily authenticating on a computer or phone that isn't mine. In those cases I much prefer to type in a code.
metalliqaz 7y ago
I use the lastpass authenticator and I like it. Works well in conjunction with the lastpass app
mmis1000 7y ago
It scans qrcode. It shows current 2fa code. It ensures no one will able to generate your 2fa code without stole the device physically (because it can't be backup). What else do you need? Why do anyone need to update it if it is completely fine?
gaia 7y ago
Surprised there (this far) no mention of Authenticator Plus (https://www.authenticatorplus.com/ https://www.authenticatorplus.com/) here. I welcome scrutiny of this option (but I am not affiliated in any capacity with them)

313 points by edent 7y ago

I recently switched to Aegis Authenticator: https://getaegis.app/ https://getaegis.app/ It seems to be as well-maintained as andOTP, and I like that it is licensed GPLv3 rather than MIT.

fredley 7y ago

I recently switched to Aegis, it's so much better, and open source[0]. Crucially it has biometric encryption, and import/export so switching to a new device isn't a horrific ordeal. It also has some great QoL features like custom icons, highlighting, and reordering. To anybody looking to move away from Google Authenticator, I highly recommend it. 0: https://github.com/beemdevelopment/Aegis https://github.com/beemdevelopment/Aegis

Satwell2 7y ago
This looks good but I can't find any information about who is behind it and why I should trust them. I wish they were collaborating with a well known project like andOTP instead.

AdmiralAsshat 7y ago

I switched to Authy some years ago. It took Google forever to add the ability to Authenticator to let you migrate 2FA codes to new devices, and even then, it was only Google codes. I got tired of having to deactivate 2FA on my 20 or so accounts, switch to my new Android device, reactivate 2FA, and then scan the QR codes on the new device. Authy made it a painless experience, particularly since I could verify codes were working on the new device before factory resetting the old one.

chasingthewind 7y ago
I actually associated a Yubikey to my account because I was so annoyed at this problem. I wanted a better backup plan than the physical printed codes idea. I didn't realize that a better 2FA app would have solved this :P
- AdmiralAsshat 7y ago
  Not everything supports Yubikey/FIDO U2F at this point, so that wouldn't work for everything, although I do have one. My Gmail account itself is behind a Yubikey (and a a backup Yubikey), not a 2FA app, because I'm trying to avoid a Game Over scenario. The Gmail address is the recovery address for my password manager account, so getting that pwned is basically the keys to the kingdom for every other account.
  - bickeringyokel 7y ago
    I realize not everyone wants to leave Gmail, but another reason I'm thinking of using tutanota aside from e2e encryption is you can create a second user that's tied to your master account. You can reset the passwords of your sub accounts from the main accout if they are compromised.. of course you have to pay for multiple accounts though.
  - Vinnl 7y ago
    The weird thing is: Yubikey was the only option for me in Gmail. Only after I associated a Yubikey with it, was I able to also use an authenticator app. Does anyone know if this is normal behaviour, and if so, what the reasoning behind it is?
    - angry_octet 7y ago
      That's weird, probably a glitch. TOTP is the basic option.
- skybrian 7y ago
  Having printed access codes in your safe doesn't seem worse than a backup Yubikey in your safe? Maybe better, since electronic devices can break.
  - angry_octet 7y ago
    Either way, put it in a tamper evident envelope in the safe.
djanogo 7y ago
The QR code you scan is stored in app's db, you can use generic scanner to get the code and save it on paper or another encrypted DB or extract them from the Google Auth app SQL DB - if you have root access.
- AdmiralAsshat 7y ago
  Good luck getting root access on a US Snapdragon Samsung phone. IIRC, they physically damage themselves in some way if they detect that they've been rooted, which then caps the battery from ever going beyond 70 or 80%.
  - nrclark 7y ago
    I'm interested to read more about this, do you have a source for it? That seems like it would be just asking for a world of warranty returns and support nightmares for whatever company built it into their phones.
    - AdmiralAsshat 7y ago
      Here's the only quick source I could find about the battery being capped while rooted: https://www.xda-developers.com/sampwnd-root-galaxy-s8-snapdragon/ https://www.xda-developers.com/sampwnd-root-galaxy-s8-snapdr... I'm pretty sure this was implemented across their phones after the Galaxy Note 7 debacle. I think the idea was that anyone who tried to root their devices and avoid Samsung remotely deactivating them would at least be prevented from charging the battery to full, which could cause the battery swelling/overheating/fire-catching problem. I'll have to do more digging on the quote I remember about Samsung phones physically blowing a circuit somewhere if they detect they've been rooted.
      - XMPPwocky 7y ago
        > I'll have to do more digging on the quote I remember about Samsung phones physically blowing a circuit somewhere if they detect they've been rooted. This sounds like the ODIN QFuse. These aren't really particularly dramatic- they're tiny, microscopic "fuses", designed to blow cleanly and easily. Most devices have plenty of them- used to lock the devices down after manufacturing.
fullstop 7y ago
I went to Authy and then to Yubikey. I can get to my OTP from just about any smart phone now or even my desktop.
- Yhippa 7y ago
  What do you do in the event you lose your Yubikey?
  - joshvm 7y ago
    You hope that you have printed backup codes for whichever services provide it, or alternative auth, or you go through ID verification to regain access. Not much else you can do, the point of 2FA is that you can't get in without it. Some services let you store multiple keys. So you can own a separate yubikey that you keep in a trusted place eg deposit box.
  - inetsee 7y ago
    Yubikey recommends "having a backup device and registering both with your accounts". I vaguely remember some people saying that they have a backup Yubikey that they keep in their safe deposit box, so that it's as safe as possible.
    - nicpottier 7y ago
      Does anybody do this? I've read that as well but it doesn't make sense to me. How do I add my backup device if it is in a vault somewhere? For that to be useful I would have to have my backup device on me so I can add new accounts, but then that defeats the purpose. I could see this working for a few very secure logins, but if the idea is to two factor everything it doesn't seem tenable.
      - deleted 7y ago
        [deleted]
      - tmottabr 7y ago
        No, your backup device need to be stored until you need it, not with you all times. you add your main device and your backup device. than you store the backyup device, after having it configured on your accounts, in the safe and use the main device to authenticate on a daily basis. when you create a new account you add your main device and than when possible retrieve the backup device from storage and add the new account to it and store it back again. on the event of you loosing your main device you retrieve the backup device from storage, use it to authenticate and remove your lost device from your accounts. You can then acquire a new one key, add to all your accounts and store the backup in a safe again until needed.
whoisjuan 7y ago
I use Authy, but God, I hate their UI and UX. Finding the accounts there is a pain in the ass, and for some reason, I always end up with duplicated accounts (when I just added them once). Also, it has been two months since their last iOS update, so it's not like Twilio is taking care of it either.
- zouhair 7y ago
  Give andOTP a try[0] [0]: https://github.com/andOTP/andOTP https://github.com/andOTP/andOTP
  - phs 7y ago
    I love andOTP, it does one job and gives me (not my phone's firmware) control over the secret storage.
- notlukesky 7y ago
  I use SAASPASS Authenticator for personal services and it has search capabilities and also optional autofill on both desktop (with browser extension) and mobile. The codes can also be copy/pasted from the web portal. https://saaspass.com/ https://saaspass.com/ Full disclosure: I work for a SI that integrates SAASPASS IAM to enterprises.
  - aroch 7y ago
    You've posted the same comment several times throughout this thread and in the past you've also, shall we say, name dropped saaspass repeatedly. While also ignoring questions about your affiliation with the company. Mind explaining why you bring them up so often?
  - effingwewt 7y ago
    Adding a disclaimer but continuously peppering the entire thread with your C/P seems beyond disingenuous.
- bonestamp2 7y ago
  Agreed. My biggest complain is the sorting of the list, a very simple thing to fix. I mean, how come I can't change the order of some accounts on some platforms? I only login to my tax account once a year, but on the desktop app it is first alphabetically so it's always at the top. Meanwhile, I login to my vpn multiple times a day and it is alphabetically at the bottom. So, I've had to start prefixing names with bullshit just to get them in a convenient order. It's like they don't use their own product or they'd notice this flaw very quickly.
gerash 7y ago
IIUC the Authy "feature" where it allows you to transfer 2FA codes to a new device defeats the purpose of 2FA. That is, if someone gets access to your Authy account they'll get access to your 2FA codes. This has been used to steal cryptocurrencies from users in the past: https://www.newsbtc.com/2017/06/03/coinbase-recommends-users-enable-google-authenticator-ditch-authy/ https://www.newsbtc.com/2017/06/03/coinbase-recommends-users...
- AdmiralAsshat 7y ago
  True, but you can enable/disable the multi-device feature at any time. So you can theoretically just turn it long enough to port your codes over to the new device, confirm that they work, and then de-authorize the old advice from the account and turn the feature off. I ended up doing as much when I lost my Android tablet at a bookstore on which I had Authy installed. It gave me a mild panic attack at the time, but, a year later and none of my accounts have been hacked yet, so, I have to hope that the other security measures on the device were enough to thwart the potential thief/adversary.

kjaftaedi 7y ago

The author doesn't explain why this is a google problem other than their code is "old". The way the source article reads, it seems like the vulnerability would affect any OTP app.

edent 7y ago
The latest version of [andOTP](https://github.com/andOTP/andOTP/releases https://github.com/andOTP/andOTP/releases) indicates that it protects some of the fields from accessibility hijack. I suspect other apps will find a way to prevent this attack. The problem I, the author, have is that it seems unlikely that Google can fix this. What are the risks associated with suddenly changing a codebase which is 2.5 years old? Is there anyone there who works on it day-to-day, understands how it works, and can release a verifiably fixed patch? Security products need constant maintainance.
smt88 7y ago
No user should trust the security of an app that was abandoned 2.5 years ago. It's irresponsible (and typical) of Google to keep the app available and unmaintained. Even if the code were bug-free at the time, dependencies, APIs, and attacks change.

excerionsforte 7y ago

I got rid of Google Authenticator in 2018 preferring Microsoft Authenticator after feeling weary about having to setup 2FA on a new phone and subsequently reading posts like https://smartphones.gadgethacks.com/news/google-authenticator-is-not-best-2fa-app-anymore-0186776/ https://smartphones.gadgethacks.com/news/google-authenticato... which made me aware that I didn't have to go through that pain anymore if I dumped Google Authenticator.

antaviana 7y ago
If you do not mind your phone contacts are shared with the app [1], Microsoft Authenticator is fine. [1] https://docs.microsoft.com/en-us/azure/active-directory/user-help/user-help-auth-app-faq https://docs.microsoft.com/en-us/azure/active-directory/user...
- excerionsforte 7y ago
  That would be valid concern if you could not deny the permissions meaning this doc is out of date. I have both iOS and Android and have the permissions set to deny as they are not essential to the operation of the application. Also, these concerns would pop up in the reviews if you could not deny the permission if it asked for it. One of the reasons I looked at MS Authenticator because it is one of the highest scoring and reviewed authenticator apps, so it would have taken a hit on the score if this was not possible.
- eyegor 7y ago
  Why would you need to give it contacts permissions? Just deny it.
- prophesi 7y ago
  "Contacts and phone: The app requires this permission so it can search for existing work or school Microsoft accounts on your phone and add them to the app, helping to ensure your account works properly. This permission also helps save you time while adding your personal Microsoft accounts, by automatically filling in some of the info for you, like your first and last name." Wow, they really did their best to find a sliver of justification for that permission. I don't need an OTP app to autofill my first and last name. And to those arguing about their opt-out for this permission, ask what unnecessary permissions your coworkers/family/friends have denied on the last few apps they installed.

bad_user 7y ago

Website is blocking my access with a challenge that doesn't work :-(

edent 7y ago
I've had a few reports of that. Are you using Tor or something similarly exotic?
- insomniacity 7y ago
  Assuming this is recaptcha, I have heard that sometimes your IP/cookie reputation can be so bad that they reject valid responses to the challenge.
- bad_user 7y ago
  I'm using PrivateInternetAccess as my VPN.

asdfasgasdgasdg 7y ago

Wait. The vulnerability report says, "Abusing the Accessibility privileges, ..." the trojan can steal your OTPs. If you give a program accessibility privileges, it can read the screen. Is that all we're talking about here? What is the proposed mitigation that Google should implement on the app? You can't block accessibility on the OTP app because then blind people will not be able to use it.

Piskvorrr 7y ago
Another app that stores credentials mitigates this by putting up a 30-second delay; the text goes a bit like this: "It seems that you are using a screen reader or something else that uses the Accessibility services. If you have no idea what this is, do not continue past this screen. The below buttons will be enabled in 30 seconds [I know what is happening] [This doesn't sound familiar, exit]" (Of course it only appears when you actually have something subscribed into the accessibility services, which is how I found out) Yes, it's inconvenient, but forces you to actually read the message instead of blindly barging through Accept Accept Accept.
- asdfasgasdgasdg 7y ago
  Does it do that every time, or just the first time? If it just happens once I guess that might be a tolerable tradeoff. Still doesn't seem like it's worth classifying Google's app as abandoned just because they declined to implement this particular feature.
  - Piskvorrr 7y ago
    Each time. Annoying, but bearable for something I use once a day...
- IAmEveryone 7y ago
  That places the burden on people required to use such assistive technology. I’m sure life as a blind person is already full of obstacles, so we should maybe think twice before actively seeking to build new barriers. And how does this actually prevent abuse? Wouldn’t malware happily wait 30 seconds and click “yes”? And if the dialog isn’t accessible to the screen reader, doesn’t it then exclude some users entirely?

deleted 7y ago

[deleted]

derefr 7y ago

The fact that malware can steal Google Authenticator TOTP seeds, means that non-malware apps on your phone—e.g. other TOTP apps—could also steal (i.e. import) these seeds, no? I’d quite enjoy if e.g. 1Password would import all my Google Authenticator tokens into itself automatically. I’ve been meaning to move them over for a long while now, but it’s a whole process, since there’s no place in the Google Authenticator UI to retrieve the original seed value.

plttn 7y ago
It's just using the accessibility privileges to look at the contents of the screen like a screen reader would, and copy the shown code. This isn't quite as advanced as "stealing your seeds".

lars_francke 7y ago

I've recently tried switching to YubiKeys to store all my 2FA tokens and only later learned that they have a hard limit of 32 stored tokens. Does anyone know of an alternative hardware token that supports more than that and also all the other protocols that YubiKeys do?

EthanHeilman 7y ago
Why can't yubikey use a single root secret and derive all sub-secrets from that root secret?
- nickez 7y ago
  They should be doing that. Maybe the OP means the limitations on passwordless credentials and not u2f credentials.
  - lars_francke 7y ago
    I might get the terminology wrong. What I meant are the HOTP and TOTP secrets. They can only store 32 of them.
    - lars_francke 7y ago
      This is what I'm referring to https://support.yubico.com/support/solutions/articles/15000014219-yubikey-5-series-technical-manual#OATHkht9hr https://support.yubico.com/support/solutions/articles/150000...
- juriansluiman 7y ago
  Because usually the server sends the shared secret and there are just 32 slots for shared secrets available.
  - EthanHeilman 7y ago
    Yubikey and webauthn[0] supports public key authentication where the client chooses the secret. [0]: https://webauthn.io/ https://webauthn.io/

otachack 7y ago

I recommend to use anything but Google Authenticator. andOTP is my preferred considering you can make non-encrypted and encrypted backups of all entries. I lost my phone once and was primarily using Google Authenticator at the time. Because I didn't backup the seeds when registering entries to Google Auth, I had to go through some recovery processes on many of my accounts which where time consuming, nerve wrecking, and annoying. This was at the height of crypto craze so one account was Coinbase in which I had to go through some in depth recovery process (with an ID an all, which ended up crossing some legal lines in my state). Do yourself a favor and either use a service with a supported and up to date app or take control with an app like andOTP and take backups yourself.

thedance 7y ago

This affects any totp app like Symantec VIP, doesn't it?

ISL 7y ago

Is the app truly abandoned? If there's one 2FA app I wouldn't expect to be abandoned, it is Authenticator.

morpheuskafka 7y ago

I thought the keyboard apps listed as abandoned at the end of the article were all rolled into the main Gboard app?

Slartie 7y ago

This looks like the same pattern observed with the iOS Google Authenticator app. That one was neglected for multiple years as well, up to the point at which it looked ridiculously out of place on newer devices because it was running in some compatibility mode for old screen sizes and screen resolutions. After multiple years of no support whatsoever, they finally updated it. But apparently that was just random luck - the current version is over a year old already as well, with the update news saying "Added support for iPhone X". I don't get it why Google apparently does not get the notion that they basically "own" the brand identity of what we technically-minded people know as the TOTP 2FA scheme - and they own it because of the Google Authenticator app. Thousands of websites ask their users to install "the Google Authenticator app" if the user wants to enable 2FA - they don't tell them to install "an OTP app" or something like that, no, practically everyone refers to this scheme and the associated apps as "Google Authenticator". And it can't be too hard for a company able to fund and drive the development of a leading web browser engine to keep a simple TOTP app up to date and well-supported in the two major smartphone ecosystems. Heck, a single full-time developer should be more than enough manpower to do that! And Google has like, what, 100.000 of them? Instead, Google lets other companies slowly chip away at their mindshare in the 2FA market - during the years of Google's inactivity, lots of alternative applications sprung up, and many password safe apps added TOTP support to their feature catalogs. We're at a point at which most technically savvy people advise other people to use ANY of those apps, but NOT Google Authenticator, even if the website tells them so. It's just a matter of time until the sites catch up and quit suggesting Google Authenticator (after all, the shortcomings of Google's application, like inability to backup seeds, probably cause additional burden on support channels for sites explicitly mentioning Google Authenticator, and if there are other apps that cause less problems, suggesting to use those at some point in time will be more beneficial than the brand name recognition bonus provided by suggesting an app by Google).

wpietri 7y ago
I'm ok with Google truly owning something. And I'm ok with them not doing something at all. But i want them to stop jumping in, bigfooting a space, and then losing interest. I know they've given up on "don't be evil", but maybe they can at least adopt, "With great power comes great responsibility."

exabrial 7y ago

Wait, can it steal the stored secrets or just codes? I'd love for a utility that can "steal" the secrets so I can migrate to my yubikey 5c.

eyegor 7y ago
Isn't there a way to get it to display the qr codes for connected accounts? Then you could migrate via registering those.
- exabrial 7y ago
  No there's not unfortunately. Nowadays, I encrypt the QR codes using my GPG key and store them with pass.
pyt 7y ago
If you have a rooted Android phone, I wrote a tool to pull secrets from most popular OTP apps: https://github.com/puddly/android-otp-extractor https://github.com/puddly/android-otp-extractor
- cesarb 7y ago
  You might not even need a rooted phone. For at least one of these apps, you can extract the secrets from an ADB backup, which does not need root (it only needs the developer mode).
  - pyt 7y ago
    Interesting. Do you know which still one allows backups?

stuff4ben 7y ago

At this point should we assume that ANYTHING Google does will be supported in the future? Fool me once shame on me, fool me over and over again and I'll replace you with someone who cares. This is a pattern of consumer abuse (privacy and abandonware) that Google continues to exhibit. Why should we continue to support them?

ThePhysicist 7y ago

Good thing TOTP is an open standard, so there are some alternative apps available. I guess they consider TOTP as legacy and are focusing on U2F, I think in their products you can’t even sign up for TOTP based 2FA anymore. I amassed quite a collection of U2F Titan security keys that Google gave away for free at conferences, some of them have become obsolete already though and some had serious security issues (the Bluetooth one). I prefer using the Yubikey for that reason, though I find them quite a bit overpriced.

nucleardog 7y ago
You can still sign up, but it's a bit of a pain. When you initially enable 2FA, you won't be given the option. But you can register with SMS/U2F/etc. Once you've enabled the first authentication method, you can go into your 2FA settings and add a virtual 2FA device. Once that's done, you can go back and delete whatever you added initially to be left with only a virtual 2FA device.

vzaliva 7y ago

Potential vulnerability aside, I think the article leaves you with wrong impression about stat of Google Authenticator app. In my understanding Google Authenticator app you install from App Store is not the same as github app authors talking about. As it clearly says in README "While this fork is open source, the official version of the app still remains proprietary. There is no guarantee that the open source repository will receive any changes made upstream (or vice versa)."

edent 7y ago
If you visit the Authenticator app on https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en https://play.google.com/store/apps/details?id=com.google.and... - you'll see at the bottom that it was last updated on September 27, 2017 As in, that's the last time an updated was published on the Play store. I'm sorry I didn't make that clearer.

zouhair 7y ago

And the usual Google neglect of its products continues. It's a vicious circle, they keep neglecting apps, people start using them less and less and as they notice people using them less they neglect them more and the cycle continues until they kill it. This is one of the main reasons I stopped using any of their new projects.

danso 7y ago

FWIW, the iOS version was last updated on Sept. 12, 2018, a minor update for iPhone X support and "Minor bug fixes". The second-to-last update, from 2.3.0 => 3.0.0, was Feb. 2016: https://apps.apple.com/us/app/google-authenticator/id388497605 https://apps.apple.com/us/app/google-authenticator/id3884976...

Someone1234 7y ago

This is a bad article. Let me summarize my thoughts: - The "security bug" it references isn't one at all. Accessibility Services can draw over other apps and interact with them by design. They're designed as an alternative way of interactive with android for disabled people consequentially they can do anything a normal user can do. The security "researcher" found a non-bug then convinced an ignorant journalist at zdnet to publish an article about normal/correct Android functionality. - If it were somehow a bug, it is still impossible for Google Authenticator to patch/mitigate it. Accessibility Services act as the user, therefore they can do anything a user can do. You cannot block them for good reason (breaks disable user's ability to use Android). - The third party apps they reference don't block Accessibility Services either, making it hypocritical to criticize one while pointing to others with the same fictitious flaw. - Switching to a random open source TOTP/HOTP 2F app might reduce your security, not increase it. You'll either compile it yourself requiring enabling "Allow installation from unknown sources" (bad) or you'll more commonly just grab it from the app store, in which case that random OSS developer's account can feed you evil-ware either intentionally or via compromise. As soon as it is from the app store the "open source" nature is completely irrelevant, it isn't a security guarantee. - No unpatched security bugs have been found in Google Authentictor. Google Authenticator's lack of updates are annoying though (unfixed bugs, poor backup support, QoL features like secondary pin, etc). Just not the way the article frames it.

drewg123 7y ago
> compile it yourself requiring enabling "Allow installation from unknown sources" This is one of my biggest pet peeves about Android. I wish i could add my own signing key for apps I compile myself, rather than just being given the choice of Google play or anything at all.
- Operyl 7y ago
  In a round about way you sort of can now. The “allow installation from unknown sources” is per app-source now. You need to enable it for Google Chrome if you downloaded the package from Chrome, or for F-Droid if you downloaded it from F-Droid. So, the solution you’re looking for could be just a small shim app to download from your own repository of sorts. Janky .. but it’s a bit more possible than before I guess. As an added bonus you could do some signature validations too!

bilal4hmed 7y ago

if you are on Android, I highly recommend Aegis https://github.com/beemdevelopment/Aegis https://github.com/beemdevelopment/Aegis its open source, supports import of keys as well as export with a very active dev.

zackify 7y ago

The most frustrating thing about this app.... is that it ignores other algorithms such as sha-256 or 512. But get this! On iOS it correctly shows the right OTP code for these algorithms. On android it acts like it’s a sha-1 and has the wrong code....

notlukesky 7y ago
SAASPASS Authenticator supports all of them. https://saaspass.com/ https://saaspass.com/ Full disclosure: I work for a SI that integrates SAASPASS IAM to enterprises.

Avamander 7y ago

I don't think it actually needs an update. Supporting new features would be nice, but it's not a requirement.

dep_b 7y ago

I remember even installing Google Authenticator for some kind of Microsoft project, which seemed to legitimize it even more.

acdha 7y ago

I'm a big fan of using the Yubico Authenticator instead of Google's apps: https://www.yubico.com/products/services-software/download/yubico-authenticator/ https://www.yubico.com/products/services-software/download/y... In addition to being supported, it avoids the possibility of a future mistake leaking TOTP seeds since they're stored on the key rather than the phone.

dagaci 7y ago

Is Microsoft authenticator interchangeable with Google's?

srathi 7y ago

I've moved to Authy. They allow a backup password to encrypt all tokens on their servers. I think that is a valid tradeoff with a random password saved in Keepass. Otherwise, changing a cellphone (or hard resetting) is an arduous task.

dang 7y ago

Related current thread: https://news.ycombinator.com/item?id=22443225 https://news.ycombinator.com/item?id=22443225

darawk 7y ago

Hmm. I see a lot of people here responding that disabling this would break the Accessibility Services, and I completely agree. However, it does seem to me like there is a genuine problem here. Perhaps the solution is to have a two-layer accessibility permission system? One permission for reading the screen of non-inherently-sensitive applications, like web browsers and email clients, and another permission for reading high-sensitivity applications like Google Authenticator. Enabling the second permission would come with very strong warnings about security, and the admonition that you should really really trust this application provider a lot more than your average screen reader app.

ohazi 7y ago

If Authenticator is actually abandoned, are there any suggested alternatives? I know I can just get a yubikey, but I'm still not comfortable with the process for temporarily authenticating on a computer or phone that isn't mine. In those cases I much prefer to type in a code.

metalliqaz 7y ago

I use the lastpass authenticator and I like it. Works well in conjunction with the lastpass app

mmis1000 7y ago

It scans qrcode. It shows current 2fa code. It ensures no one will able to generate your 2fa code without stole the device physically (because it can't be backup). What else do you need? Why do anyone need to update it if it is completely fine?

gaia 7y ago

Surprised there (this far) no mention of Authenticator Plus (https://www.authenticatorplus.com/ https://www.authenticatorplus.com/) here. I welcome scrutiny of this option (but I am not affiliated in any capacity with them)