2 ms·
I stopped using Google Authenticator in 2013 when my tokens disappeared after a software update [1]. They were restored in the next update, but I didn't like no
by ValentineC 7y ago
I stopped using Google Authenticator in 2013 when my tokens disappeared after a software update [1]. They were restored in the next update, but I didn't like not having access to the raw TOTP data.
I switched to Authy after the incident, and now use 1Password after I discovered their TOTP feature.
[1] https://news.ycombinator.com/item?id=6325760 https://news.ycombinator.com/item?id=6325760
- the_svd_doctor 7y agoIsn’t that putting all eggs in the same basket?
- plttn 7y agoYes and no. Yes, it puts 1Password as the only point of failure iff 1Password security is compromised. This would require knowing my Master Password, my Secret Key, and 2FA with either my OTP from Google Authenticator or a Yubikey to open the vault on a new device, or knowing my master password on a device that I already have 1Password set up on. On the flip side however, for anyone who _doesn't_ know I use 1Password (oops), any credential stuffing attack or password leak is not likely to get anywhere, as they're not going to be attacking my 1Password vault.
- ValentineC 7y agoIt's a compromise for me: the killer feature is not having to depend on my phone to log into websites. I suppose it might be even more secure if I kept tokens in a separate vault.
- notlukesky 7y agoYou might be interested then in the autofilling options of SAASPASS Authenticator and Password Manager (with browser extension and iOS 12 autofill turned on).