6 ms·

I switched to Authy some years ago. It took Google forever to add the ability to Authenticator to let you migrate 2FA codes to new devices, and even then, it wa

I switched to Authy some years ago. It took Google forever to add the ability to Authenticator to let you migrate 2FA codes to new devices, and even then, it was only Google codes. I got tired of having to deactivate 2FA on my 20 or so accounts, switch to my new Android device, reactivate 2FA, and then scan the QR codes on the new device. Authy made it a painless experience, particularly since I could verify codes were working on the new device before factory resetting the old one.

chasingthewind 7y ago
I actually associated a Yubikey to my account because I was so annoyed at this problem. I wanted a better backup plan than the physical printed codes idea. I didn't realize that a better 2FA app would have solved this :P
- AdmiralAsshat 7y ago
  Not everything supports Yubikey/FIDO U2F at this point, so that wouldn't work for everything, although I do have one. My Gmail account itself is behind a Yubikey (and a a backup Yubikey), not a 2FA app, because I'm trying to avoid a Game Over scenario. The Gmail address is the recovery address for my password manager account, so getting that pwned is basically the keys to the kingdom for every other account.
  - bickeringyokel 7y ago
    I realize not everyone wants to leave Gmail, but another reason I'm thinking of using tutanota aside from e2e encryption is you can create a second user that's tied to your master account. You can reset the passwords of your sub accounts from the main accout if they are compromised.. of course you have to pay for multiple accounts though.
  - Vinnl 7y ago
    The weird thing is: Yubikey was the only option for me in Gmail. Only after I associated a Yubikey with it, was I able to also use an authenticator app. Does anyone know if this is normal behaviour, and if so, what the reasoning behind it is?
    - angry_octet 7y ago
      That's weird, probably a glitch. TOTP is the basic option.
- skybrian 7y ago
  Having printed access codes in your safe doesn't seem worse than a backup Yubikey in your safe? Maybe better, since electronic devices can break.
  - angry_octet 7y ago
    Either way, put it in a tamper evident envelope in the safe.
- notlukesky 7y ago
  I use SAASPASS Authenticator for personal services and it has search capabilities and also optional autofill on both desktop (with browser extension) and mobile. The codes can also be copy/pasted from the web portal. The same Authenticator codes can be on multiple devices including tablets. You have multiple different backup and restore capabilities including mobile number WITH a master password. https://saaspass.com/ https://saaspass.com/ Full disclosure: I work for a SI that integrates SAASPASS IAM to enterprises.
djanogo 7y ago
The QR code you scan is stored in app's db, you can use generic scanner to get the code and save it on paper or another encrypted DB or extract them from the Google Auth app SQL DB - if you have root access.
- AdmiralAsshat 7y ago
  Good luck getting root access on a US Snapdragon Samsung phone. IIRC, they physically damage themselves in some way if they detect that they've been rooted, which then caps the battery from ever going beyond 70 or 80%.
  - nrclark 7y ago
    I'm interested to read more about this, do you have a source for it? That seems like it would be just asking for a world of warranty returns and support nightmares for whatever company built it into their phones.
    - AdmiralAsshat 7y ago
      Here's the only quick source I could find about the battery being capped while rooted: https://www.xda-developers.com/sampwnd-root-galaxy-s8-snapdragon/ https://www.xda-developers.com/sampwnd-root-galaxy-s8-snapdr... I'm pretty sure this was implemented across their phones after the Galaxy Note 7 debacle. I think the idea was that anyone who tried to root their devices and avoid Samsung remotely deactivating them would at least be prevented from charging the battery to full, which could cause the battery swelling/overheating/fire-catching problem. I'll have to do more digging on the quote I remember about Samsung phones physically blowing a circuit somewhere if they detect they've been rooted.
      - XMPPwocky 7y ago
        > I'll have to do more digging on the quote I remember about Samsung phones physically blowing a circuit somewhere if they detect they've been rooted. This sounds like the ODIN QFuse. These aren't really particularly dramatic- they're tiny, microscopic "fuses", designed to blow cleanly and easily. Most devices have plenty of them- used to lock the devices down after manufacturing.
fullstop 7y ago
I went to Authy and then to Yubikey. I can get to my OTP from just about any smart phone now or even my desktop.
- Yhippa 7y ago
  What do you do in the event you lose your Yubikey?
  - joshvm 7y ago
    You hope that you have printed backup codes for whichever services provide it, or alternative auth, or you go through ID verification to regain access. Not much else you can do, the point of 2FA is that you can't get in without it. Some services let you store multiple keys. So you can own a separate yubikey that you keep in a trusted place eg deposit box.
  - inetsee 7y ago
    Yubikey recommends "having a backup device and registering both with your accounts". I vaguely remember some people saying that they have a backup Yubikey that they keep in their safe deposit box, so that it's as safe as possible.
    - nicpottier 7y ago
      Does anybody do this? I've read that as well but it doesn't make sense to me. How do I add my backup device if it is in a vault somewhere? For that to be useful I would have to have my backup device on me so I can add new accounts, but then that defeats the purpose. I could see this working for a few very secure logins, but if the idea is to two factor everything it doesn't seem tenable.
      - deleted 7y ago
        [deleted]
      - tmottabr 7y ago
        No, your backup device need to be stored until you need it, not with you all times. you add your main device and your backup device. than you store the backyup device, after having it configured on your accounts, in the safe and use the main device to authenticate on a daily basis. when you create a new account you add your main device and than when possible retrieve the backup device from storage and add the new account to it and store it back again. on the event of you loosing your main device you retrieve the backup device from storage, use it to authenticate and remove your lost device from your accounts. You can then acquire a new one key, add to all your accounts and store the backup in a safe again until needed.
whoisjuan 7y ago
I use Authy, but God, I hate their UI and UX. Finding the accounts there is a pain in the ass, and for some reason, I always end up with duplicated accounts (when I just added them once). Also, it has been two months since their last iOS update, so it's not like Twilio is taking care of it either.
- zouhair 7y ago
  Give andOTP a try[0] [0]: https://github.com/andOTP/andOTP https://github.com/andOTP/andOTP
  - phs 7y ago
    I love andOTP, it does one job and gives me (not my phone's firmware) control over the secret storage.
- notlukesky 7y ago
  I use SAASPASS Authenticator for personal services and it has search capabilities and also optional autofill on both desktop (with browser extension) and mobile. The codes can also be copy/pasted from the web portal. https://saaspass.com/ https://saaspass.com/ Full disclosure: I work for a SI that integrates SAASPASS IAM to enterprises.
  - aroch 7y ago
    You've posted the same comment several times throughout this thread and in the past you've also, shall we say, name dropped saaspass repeatedly. While also ignoring questions about your affiliation with the company. Mind explaining why you bring them up so often?
  - effingwewt 7y ago
    Adding a disclaimer but continuously peppering the entire thread with your C/P seems beyond disingenuous.
- bonestamp2 7y ago
  Agreed. My biggest complain is the sorting of the list, a very simple thing to fix. I mean, how come I can't change the order of some accounts on some platforms? I only login to my tax account once a year, but on the desktop app it is first alphabetically so it's always at the top. Meanwhile, I login to my vpn multiple times a day and it is alphabetically at the bottom. So, I've had to start prefixing names with bullshit just to get them in a convenient order. It's like they don't use their own product or they'd notice this flaw very quickly.
gerash 7y ago
IIUC the Authy "feature" where it allows you to transfer 2FA codes to a new device defeats the purpose of 2FA. That is, if someone gets access to your Authy account they'll get access to your 2FA codes. This has been used to steal cryptocurrencies from users in the past: https://www.newsbtc.com/2017/06/03/coinbase-recommends-users-enable-google-authenticator-ditch-authy/ https://www.newsbtc.com/2017/06/03/coinbase-recommends-users...
- AdmiralAsshat 7y ago
  True, but you can enable/disable the multi-device feature at any time. So you can theoretically just turn it long enough to port your codes over to the new device, confirm that they work, and then de-authorize the old advice from the account and turn the feature off. I ended up doing as much when I lost my Android tablet at a bookstore on which I had Authy installed. It gave me a mild panic attack at the time, but, a year later and none of my accounts have been hacked yet, so, I have to hope that the other security measures on the device were enough to thwart the potential thief/adversary.

chasingthewind 7y ago

I actually associated a Yubikey to my account because I was so annoyed at this problem. I wanted a better backup plan than the physical printed codes idea. I didn't realize that a better 2FA app would have solved this :P

AdmiralAsshat 7y ago
Not everything supports Yubikey/FIDO U2F at this point, so that wouldn't work for everything, although I do have one. My Gmail account itself is behind a Yubikey (and a a backup Yubikey), not a 2FA app, because I'm trying to avoid a Game Over scenario. The Gmail address is the recovery address for my password manager account, so getting that pwned is basically the keys to the kingdom for every other account.
- bickeringyokel 7y ago
  I realize not everyone wants to leave Gmail, but another reason I'm thinking of using tutanota aside from e2e encryption is you can create a second user that's tied to your master account. You can reset the passwords of your sub accounts from the main accout if they are compromised.. of course you have to pay for multiple accounts though.
- Vinnl 7y ago
  The weird thing is: Yubikey was the only option for me in Gmail. Only after I associated a Yubikey with it, was I able to also use an authenticator app. Does anyone know if this is normal behaviour, and if so, what the reasoning behind it is?
  - angry_octet 7y ago
    That's weird, probably a glitch. TOTP is the basic option.
skybrian 7y ago
Having printed access codes in your safe doesn't seem worse than a backup Yubikey in your safe? Maybe better, since electronic devices can break.
- angry_octet 7y ago
  Either way, put it in a tamper evident envelope in the safe.
notlukesky 7y ago
I use SAASPASS Authenticator for personal services and it has search capabilities and also optional autofill on both desktop (with browser extension) and mobile. The codes can also be copy/pasted from the web portal. The same Authenticator codes can be on multiple devices including tablets. You have multiple different backup and restore capabilities including mobile number WITH a master password. https://saaspass.com/ https://saaspass.com/ Full disclosure: I work for a SI that integrates SAASPASS IAM to enterprises.

djanogo 7y ago

The QR code you scan is stored in app's db, you can use generic scanner to get the code and save it on paper or another encrypted DB or extract them from the Google Auth app SQL DB - if you have root access.

AdmiralAsshat 7y ago
Good luck getting root access on a US Snapdragon Samsung phone. IIRC, they physically damage themselves in some way if they detect that they've been rooted, which then caps the battery from ever going beyond 70 or 80%.
- nrclark 7y ago
  I'm interested to read more about this, do you have a source for it? That seems like it would be just asking for a world of warranty returns and support nightmares for whatever company built it into their phones.
  - AdmiralAsshat 7y ago
    Here's the only quick source I could find about the battery being capped while rooted: https://www.xda-developers.com/sampwnd-root-galaxy-s8-snapdragon/ https://www.xda-developers.com/sampwnd-root-galaxy-s8-snapdr... I'm pretty sure this was implemented across their phones after the Galaxy Note 7 debacle. I think the idea was that anyone who tried to root their devices and avoid Samsung remotely deactivating them would at least be prevented from charging the battery to full, which could cause the battery swelling/overheating/fire-catching problem. I'll have to do more digging on the quote I remember about Samsung phones physically blowing a circuit somewhere if they detect they've been rooted.
    - XMPPwocky 7y ago
      > I'll have to do more digging on the quote I remember about Samsung phones physically blowing a circuit somewhere if they detect they've been rooted. This sounds like the ODIN QFuse. These aren't really particularly dramatic- they're tiny, microscopic "fuses", designed to blow cleanly and easily. Most devices have plenty of them- used to lock the devices down after manufacturing.

fullstop 7y ago

I went to Authy and then to Yubikey. I can get to my OTP from just about any smart phone now or even my desktop.

Yhippa 7y ago
What do you do in the event you lose your Yubikey?
- joshvm 7y ago
  You hope that you have printed backup codes for whichever services provide it, or alternative auth, or you go through ID verification to regain access. Not much else you can do, the point of 2FA is that you can't get in without it. Some services let you store multiple keys. So you can own a separate yubikey that you keep in a trusted place eg deposit box.
- inetsee 7y ago
  Yubikey recommends "having a backup device and registering both with your accounts". I vaguely remember some people saying that they have a backup Yubikey that they keep in their safe deposit box, so that it's as safe as possible.
  - nicpottier 7y ago
    Does anybody do this? I've read that as well but it doesn't make sense to me. How do I add my backup device if it is in a vault somewhere? For that to be useful I would have to have my backup device on me so I can add new accounts, but then that defeats the purpose. I could see this working for a few very secure logins, but if the idea is to two factor everything it doesn't seem tenable.
    - deleted 7y ago
      [deleted]
    - tmottabr 7y ago
      No, your backup device need to be stored until you need it, not with you all times. you add your main device and your backup device. than you store the backyup device, after having it configured on your accounts, in the safe and use the main device to authenticate on a daily basis. when you create a new account you add your main device and than when possible retrieve the backup device from storage and add the new account to it and store it back again. on the event of you loosing your main device you retrieve the backup device from storage, use it to authenticate and remove your lost device from your accounts. You can then acquire a new one key, add to all your accounts and store the backup in a safe again until needed.

whoisjuan 7y ago

I use Authy, but God, I hate their UI and UX. Finding the accounts there is a pain in the ass, and for some reason, I always end up with duplicated accounts (when I just added them once). Also, it has been two months since their last iOS update, so it's not like Twilio is taking care of it either.

zouhair 7y ago
Give andOTP a try[0] [0]: https://github.com/andOTP/andOTP https://github.com/andOTP/andOTP
- phs 7y ago
  I love andOTP, it does one job and gives me (not my phone's firmware) control over the secret storage.
notlukesky 7y ago
I use SAASPASS Authenticator for personal services and it has search capabilities and also optional autofill on both desktop (with browser extension) and mobile. The codes can also be copy/pasted from the web portal. https://saaspass.com/ https://saaspass.com/ Full disclosure: I work for a SI that integrates SAASPASS IAM to enterprises.
- aroch 7y ago
  You've posted the same comment several times throughout this thread and in the past you've also, shall we say, name dropped saaspass repeatedly. While also ignoring questions about your affiliation with the company. Mind explaining why you bring them up so often?
- effingwewt 7y ago
  Adding a disclaimer but continuously peppering the entire thread with your C/P seems beyond disingenuous.
bonestamp2 7y ago
Agreed. My biggest complain is the sorting of the list, a very simple thing to fix. I mean, how come I can't change the order of some accounts on some platforms? I only login to my tax account once a year, but on the desktop app it is first alphabetically so it's always at the top. Meanwhile, I login to my vpn multiple times a day and it is alphabetically at the bottom. So, I've had to start prefixing names with bullshit just to get them in a convenient order. It's like they don't use their own product or they'd notice this flaw very quickly.

gerash 7y ago

IIUC the Authy "feature" where it allows you to transfer 2FA codes to a new device defeats the purpose of 2FA. That is, if someone gets access to your Authy account they'll get access to your 2FA codes. This has been used to steal cryptocurrencies from users in the past: https://www.newsbtc.com/2017/06/03/coinbase-recommends-users-enable-google-authenticator-ditch-authy/ https://www.newsbtc.com/2017/06/03/coinbase-recommends-users...

AdmiralAsshat 7y ago
True, but you can enable/disable the multi-device feature at any time. So you can theoretically just turn it long enough to port your codes over to the new device, confirm that they work, and then de-authorize the old advice from the account and turn the feature off. I ended up doing as much when I lost my Android tablet at a bookstore on which I had Authy installed. It gave me a mild panic attack at the time, but, a year later and none of my accounts have been hacked yet, so, I have to hope that the other security measures on the device were enough to thwart the potential thief/adversary.