7 ms·

First, it is a good idea to setup the authentication on multiple devices. This is not hard to do. Second, if that happens you are in the same situation as with

by petr25102018 6y ago

First, it is a good idea to setup the authentication on multiple devices. This is not hard to do. Second, if that happens you are in the same situation as with the phone authentication -> so the disadvantage is the same.

thinkingemote 6y ago
It's not possible to have Google authenticator on multiple devices with the same accounts on it. It's easy to transfer from one to the other but that doesn't remove the single point of failure. Solution is to have back up codes for each account.
- renata 6y ago
  You can just scan the QR code on multiple devices during setup. I have an old junker phone that I use just for this and being a universal remote that never leaves my end-table.
  - petr25102018 6y ago
    This is how I do it. But of course, keeping emergency codes is a good idea too.
- theandrewbailey 6y ago
  I use KeePassXC to store and create my TOTPs. If needed, I can (painfully) type the underlying hash into any app.
- 7786655 6y ago
  This is a problem with Google authenticator, not with RFC 6238 TOTP in general. Plenty of authenticator apps support backing up your secrets.
  - DaiPlusPlus 6y ago
    Indeed. I’m trying to move from Google Authenticator to Authy for that reason - but the inability to backup/export from GA is a PITA... a cruel form of vendor lock-in.
    - 7786655 6y ago
      If you are switching authenticator apps, I would suggest switching to one that respects your freedom, such as Aegis, andOTP, or KeePass. It's worth also noting that Authy also has no official way to export your secrets, although there are workarounds: https://tij.me/blog/migrating-your-one-time-passwords-from-authy-to-raivo-otp/ https://tij.me/blog/migrating-your-one-time-passwords-from-a...
- tinus_hn 6y ago
  No. For two factor authentication to work the solution needs to be practical for most people. So it can’t involve multiple phones or backup schemes most people aren’t going to implement. Otherwise you’re going to lock a lot of people out of their accounts which is not acceptable. Ultimately this typically ends up with a reset scheme that depends on phone numbers or email addresses which means the protection, which is as strong as the weakest link, is worthless.

thinkingemote 6y ago

It's not possible to have Google authenticator on multiple devices with the same accounts on it. It's easy to transfer from one to the other but that doesn't remove the single point of failure. Solution is to have back up codes for each account.

renata 6y ago
You can just scan the QR code on multiple devices during setup. I have an old junker phone that I use just for this and being a universal remote that never leaves my end-table.
- petr25102018 6y ago
  This is how I do it. But of course, keeping emergency codes is a good idea too.
theandrewbailey 6y ago
I use KeePassXC to store and create my TOTPs. If needed, I can (painfully) type the underlying hash into any app.
7786655 6y ago
This is a problem with Google authenticator, not with RFC 6238 TOTP in general. Plenty of authenticator apps support backing up your secrets.
- DaiPlusPlus 6y ago
  Indeed. I’m trying to move from Google Authenticator to Authy for that reason - but the inability to backup/export from GA is a PITA... a cruel form of vendor lock-in.
  - 7786655 6y ago
    If you are switching authenticator apps, I would suggest switching to one that respects your freedom, such as Aegis, andOTP, or KeePass. It's worth also noting that Authy also has no official way to export your secrets, although there are workarounds: https://tij.me/blog/migrating-your-one-time-passwords-from-authy-to-raivo-otp/ https://tij.me/blog/migrating-your-one-time-passwords-from-a...
tinus_hn 6y ago
No. For two factor authentication to work the solution needs to be practical for most people. So it can’t involve multiple phones or backup schemes most people aren’t going to implement. Otherwise you’re going to lock a lot of people out of their accounts which is not acceptable. Ultimately this typically ends up with a reset scheme that depends on phone numbers or email addresses which means the protection, which is as strong as the weakest link, is worthless.