4 ms·

2FA is a maintenance nightmare. I have 2FA turned on for Github. Since they refuse to recover accounts that have 2FA enabled if you lose your second factor, I

2FA is a maintenance nightmare. I have 2FA turned on for Github. Since they refuse to recover accounts that have 2FA enabled if you lose your second factor, I have many alternative ways configured: TOTP, U2F, recovery codes, recovery phone number. I have the recovery codes stored in a secure location, and several U2F tokens enrolled (one of them is also off-site at a different location). But I didn't back up my TOTP seed. I still have the old phone with Google Authenticator, but it's too old to accept the version that lets me export my keys. Getting a new TOTP seed requires me to re-setup 2FA, which will invalidate the recovery codes and possibly unenroll my security keys (it says "This will invalidate your current two-factor devices and recovery codes.") It's also apparently impossible to set up Github 2FA with "only" a set of security keys + recovery methods - you have to first set up an authenticator app or SMS 2FA as a primary method. So now my options are: - Leave the dead TOTP on the account, and don't have a working TOTP setup - Re-setup from scratch, invalidating the recovery codes and possibly U2F tokens, requiring me to visit two distinct off-site locations to re-setup everything, one of which is currently locked down and inaccessible due to Coronavirus. And Github is one of the better sites when it comes to 2FA!

lambda_tango 6y ago
I had to get the seeds out of Google Authenticator several years ago. The seeds were stored in an SQLite database file in the app directory. I think I used another app to read the DB file and export the seeds to plain text, but you could also conceivably copy the file to a computer and work from there, though you might need root access either way.
- tgsovlerkhgsel 6y ago
  Yes, all of this requires a rooted phone or otherwise subverting the Android security model. A potential alternative could be finding an ancient APK that didn't have the 'prevent backup' bit set, downgrading via adb install, and pulling an adb backup. Still, massive PITA.
NiekvdMaas 6y ago
If your old phone is rooted: adb root && adb pull /data/data/com.google.android.apps.authenticator2/databases/databases
Avamander 6y ago
Yeah, it's very painful to use foreign services, the 2FA solutions are just so annoying. SMS and TOTP? Legit stone-age garbage just like paper signatures. I have none of these problems with local important services because I can use my goverment-issued ID for those things.

lambda_tango 6y ago

I had to get the seeds out of Google Authenticator several years ago. The seeds were stored in an SQLite database file in the app directory. I think I used another app to read the DB file and export the seeds to plain text, but you could also conceivably copy the file to a computer and work from there, though you might need root access either way.

tgsovlerkhgsel 6y ago
Yes, all of this requires a rooted phone or otherwise subverting the Android security model. A potential alternative could be finding an ancient APK that didn't have the 'prevent backup' bit set, downgrading via adb install, and pulling an adb backup. Still, massive PITA.

NiekvdMaas 6y ago

If your old phone is rooted: adb root && adb pull /data/data/com.google.android.apps.authenticator2/databases/databases

Avamander 6y ago

Yeah, it's very painful to use foreign services, the 2FA solutions are just so annoying. SMS and TOTP? Legit stone-age garbage just like paper signatures. I have none of these problems with local important services because I can use my goverment-issued ID for those things.