5 ms·

In Fortune 1000 land, Microsoft Authenticator rules the land. I love it because most have implemented notification push-authentication with biometric verificati

by animex 5y ago

In Fortune 1000 land, Microsoft Authenticator rules the land. I love it because most have implemented notification push-authentication with biometric verification. Some sites will use that in lieu of any password at all. The worst is when separate apps & companies roll their own authenticator app.

maximum_stress 5y ago
As well it should. It's rare for me to defend Microsoft anything, but in this case I will. MS authenticator happily backs itself up to the cloud if you let it. Whether you consider that good or just another attack vector is up to you, but keep in mind if you switch phones, you'll be setting up TOTP again for every service in Google authenticator.
filoleg 5y ago
For me personally, Microsoft Authenticator started ruling as well recently, after 5+ years with Google Authenticator. Why? I have already mentioned it in other comments before, and it is due to Google’s insistence on not implementing recovery from backup. If i store my 2FA in google authenticator and something happens to my phone? I am in a world of serious pain. If i upgrade phones? I have to disable and re-enable 2FA on my new phone manually for every single service I use. Microsoft Authenticator solves both of those problems, as they have recently (less than a year ago iirc) added a “backup to cloud” feature. No more stressing about something happening to my phone, as long as i have my (single) primary recovery key stored on a piece of paper somewhere safe (as opposed to having a paper recovery key for every 2fa service i use). Prior to this, i was seriously considering getting a cheap backup phone to which i set up all the 2fa codes simultaneously with my main phone, then put that cheap phone in a bank cell/safe/etc., and then rely on it in case something happens to my main phone. That would still not solve the problem of manual transfer and disabling/re-enabling 2fa for every single service, but that would be much better than losing the device. Note: I know Authy exists and had this functionality of cloud syncing 2FA keys between logged in devices for years, but for some irrational reason i was sticking with the “simpler is better, and i somehow trust google more with this one”, but luckily, I trust MSFT with my 2FA no less than i would google, perhaps even moreso. And the biometric 2FA for services that support it (so far, I’ve only seen it used with certain corporate MSFT services) are a nice cherry on top.
- isbvhodnvemrwvn 5y ago
  Google Authenticator has added account transfer at some point in the recent couple years - you get a QR code that you can scan on another device to transfer stuff. It's not automated backup, but it makes migration to new devices easier.
  - akersten 5y ago
    Can I print that QR code and stuff it in a safe to scan 3 years from now, or does it expire? It isn't clear from the export screen.
    - unclebucknasty 5y ago
      >Can I print that QR code and stuff it in a safe to scan 3 years from now, or does it expire? Given the protocol/algorithm, it shouldn't expire.
    - remus 5y ago
      I'm pretty sure the QR codes actually encode your secrets so if you want to print them out you're good to go. Obviously won't include any new ones you add in in the meantime though.
  - filoleg 5y ago
    This is only for Google-specific services that use 2FA (and it works with any authenticator apps, not just Google Authenticator, because this functionality is dependent on the service, not the app). So if I try to do this for my Google account 2FA (with Google Authenticator, Microsoft Authenticator, or literally any other authenticator app), it works. But it won’t work for any of my other 2FA accounts, like MSFT, Discord, etc., no matter which authenticator app I use. To your defense, Google Authenticator added the option for restoring from local backup fairly recently, but only for Android. And even then, no ability to sync it with multiple devices.
    - nemetroid 5y ago
      That doesn't make much sense to me. If the app has the state necessary to generate TOTP codes, why couldn't it transfer that state to a different device? How could it be dependent on the service?

by animex 5y ago

maximum_stress 5y ago

As well it should. It's rare for me to defend Microsoft anything, but in this case I will. MS authenticator happily backs itself up to the cloud if you let it. Whether you consider that good or just another attack vector is up to you, but keep in mind if you switch phones, you'll be setting up TOTP again for every service in Google authenticator.

filoleg 5y ago

For me personally, Microsoft Authenticator started ruling as well recently, after 5+ years with Google Authenticator. Why? I have already mentioned it in other comments before, and it is due to Google’s insistence on not implementing recovery from backup. If i store my 2FA in google authenticator and something happens to my phone? I am in a world of serious pain. If i upgrade phones? I have to disable and re-enable 2FA on my new phone manually for every single service I use. Microsoft Authenticator solves both of those problems, as they have recently (less than a year ago iirc) added a “backup to cloud” feature. No more stressing about something happening to my phone, as long as i have my (single) primary recovery key stored on a piece of paper somewhere safe (as opposed to having a paper recovery key for every 2fa service i use). Prior to this, i was seriously considering getting a cheap backup phone to which i set up all the 2fa codes simultaneously with my main phone, then put that cheap phone in a bank cell/safe/etc., and then rely on it in case something happens to my main phone. That would still not solve the problem of manual transfer and disabling/re-enabling 2fa for every single service, but that would be much better than losing the device. Note: I know Authy exists and had this functionality of cloud syncing 2FA keys between logged in devices for years, but for some irrational reason i was sticking with the “simpler is better, and i somehow trust google more with this one”, but luckily, I trust MSFT with my 2FA no less than i would google, perhaps even moreso. And the biometric 2FA for services that support it (so far, I’ve only seen it used with certain corporate MSFT services) are a nice cherry on top.

isbvhodnvemrwvn 5y ago
Google Authenticator has added account transfer at some point in the recent couple years - you get a QR code that you can scan on another device to transfer stuff. It's not automated backup, but it makes migration to new devices easier.
- akersten 5y ago
  Can I print that QR code and stuff it in a safe to scan 3 years from now, or does it expire? It isn't clear from the export screen.
  - unclebucknasty 5y ago
    >Can I print that QR code and stuff it in a safe to scan 3 years from now, or does it expire? Given the protocol/algorithm, it shouldn't expire.
  - remus 5y ago
    I'm pretty sure the QR codes actually encode your secrets so if you want to print them out you're good to go. Obviously won't include any new ones you add in in the meantime though.
- filoleg 5y ago
  This is only for Google-specific services that use 2FA (and it works with any authenticator apps, not just Google Authenticator, because this functionality is dependent on the service, not the app). So if I try to do this for my Google account 2FA (with Google Authenticator, Microsoft Authenticator, or literally any other authenticator app), it works. But it won’t work for any of my other 2FA accounts, like MSFT, Discord, etc., no matter which authenticator app I use. To your defense, Google Authenticator added the option for restoring from local backup fairly recently, but only for Android. And even then, no ability to sync it with multiple devices.
  - nemetroid 5y ago
    That doesn't make much sense to me. If the app has the state necessary to generate TOTP codes, why couldn't it transfer that state to a different device? How could it be dependent on the service?