11 ms·

Recently my cell phone suffered a catastrophic failure and had to be replaced. "No problem", I thought "I'll just restore my data from Android's automatic back

by maxk42 5y ago

Recently my cell phone suffered a catastrophic failure and had to be replaced. "No problem", I thought "I'll just restore my data from Android's automatic backups onto my new device." Google's Authenticator app's data is not restored. I have no way of logging into half a dozen apps that require 2FA now. Good going, Google. I'll never use your shitty 2FA again.

CaptainJustin 5y ago
1. What is the official way we're supposed to handle this? 2. How should the tech world communicate that better so that it's more user-friendly?
- te_chris 5y ago
  Yeah, I've been burned by Goog Authenticator not being cloud. I use 1pass for 2FA now and it works in the cloud at least.
- r1ch 5y ago
  The most common solution is one-time-use backup codes that most services give you when enrolling. Hopefully you saved them somewhere safe! The main issue is Google Authenticator and how popular it is. As GP noticed, it doesn't flag the files as being allowed for backup which is kind of ridiculous. Almost anything is better, https://getaegis.app/ https://getaegis.app/ is my recommendation. You can also manually backup your seed (screenshot / save the QR code during enrollment).
- creato 5y ago
  I think the only way to handle the possibility of failure of a 2FA system is to have multiple options configured. They all can fail somehow: loss, damage, hardware failure, etc. On my Google account I have two security keys, an OTP app, and saved backup codes. That's not user friendly though. I don't see how to make a user friendly, reliable, and safe 2FA system. Not having 2FA isn't safe either!
- deleted 5y ago
  [deleted]
paride5745 5y ago
I use Authy, which stores the 2FA on their cloud safely. Super easy to move between phones and to recover in case of disaster.
- lelandbatey 5y ago
  I also use Authy, so I want to point out something. Authy doesnt exactly "store the credentials online"; they do allow you to store an encrypted snapshot backup in the cloud which you can restore from, but that's not the same as storing them in the cloud. As far as I can tell, for cases where you're just using Authy in the same way as Google Authenticator (a big standard TOTP app), the only value proposition is that Authy allows separate programs with your TOTP keys in them to communicate together so that they all have copies of the same keys. It seems in those cases that Authy is storing very little and is instead acting like a dumb "connecting layer" for installations of the Authy app to talk to each other. This is nice for security, but the consequence is that if you lose access to all your Authy installations at the same time then you're SOL. I'm inferring this merely from using Authy for years, if someone knows more about how they work, please chime in to correct me.
- omnimus 5y ago
  We need 2FA because our password manager is not enough. ... We put 2FA keys in different password manager it works great.
taf2 5y ago
that does suck... they do provide backup codes... and they do present a page every few months for you to verify that... i would recommend a 2fa app such as Authy maybe as a good way in the future to have a backup for your 2fa codes...
- throwawayboise 5y ago
  Yep -- you must save the backup codes off line, off-device for any hope of recovery from loss or damage of that device. This is the weakness of the scheme. It relies on people doing something that most people are not good at doing. Thus there will probably be a way for the user to recover without the codes (sending in photo ID or whatever) and that will be the point of attack for anyone trying to maliciously take over the account.
reaperducer 5y ago
Google's Authenticator app's data is not restored. I have no way of logging into half a dozen apps that require 2FA now. Good going, Google. I'll never use your shitty 2FA again. Don't just blame Google. The same thing happened to me with an iPhone using Duo. Now I'm locked out of Facebook because Duo wants me to re-link my Facebook account, and I can't log in to Facebook to do the link because I can't use Duo. To make things worse, Facebook's customer service has lived up to its reputation. Meaning my requests for access, including sending in copy of my government ID, have gone ignored. I appreciate that 2FA is better, but this is the reason I don't use 2FA anymore.
rabboRubble 5y ago
pro-tip for next, back up the otp set up keys or capture the qr code during initial sign up. i've been able to do this because i replicated otp set up in a second source (1password). in 1password, edit the record then inspect the otp field string. it will look like this: otpauth://totp/Discord:you@email.com?secret=blahblahblah&issuer=Discord save the "blahblahblah" and you can manually recreate a token at any time.
- dcow 5y ago
  Unless you truly want to uphold the property "the something I have is not the something that stores my passwords" (you likely don't), your two factor codes should be in your password manager. Period. A good password manager has a strong user/device PKI backed by an offline key and will only be accessible on devices you've bootstrapped, so it's isomorphic to "something I have" at least and usually exactly equal to "somethings I have". And if you are a security nut trying to uphold that property and telling people it's bad to put your TOTP urls in your password manager... you better not have an authenticator app installed on the same device as your password manager or you've thrown that property out the window. Not saying it's never appropriate to have a true second factor. Just that it's not appropriate for 99% of consumer use cases and the security setup and structure afforded by password managers is more than sufficient to have good account hygiene. It would be a better world if everyone used a password manager and stored their totp codes in it than everyone has a hodgepodge of authentication apps that aren't reliable and break and cause services to implement manual verification backdoor loopholes into their auth anyway etc. etc. TOTP 2FA defends against weak passwords. A password manager enables strong passwords largely making TOTP irrelevant. Unfortunately not everyone uses a password manager and thus services are compelled to add TOTP 2FA because what other choice do they have?
  - rabboRubble 5y ago
    yeah, the only reason that i didn't get burned like the person above my original quote is that i got lucky. i had figured out that i could have two tokens running at the same time (one token for service A in Google Authenticator, second token for service A in 1Password). But I realized when I lost all Google Authenticator tokens one time, that I was this close || to a disaster. I had only recently also set up 1pw. The most ideal set up would be to have a universally Yubikey or something equivalent. Preferrably with a backup pre-configured second Yukibey possible in a disaster recovery bugout kit. Then have all the initial QR codes, otp secret manual otp key strings like i demonstrated above your post, account recovery keys, backup break-in codes, or whatever other flavor of two-factor recovery a service uses, all this notated in a secured password manager. The real problem i see with two factor is that the offered recovery method is so variable from service to service. it makes knowing which information you need to have on hand when you've gotten locked out is problematic. the other thing i do is that for core cloud service providers, i print out the password manager details for the accounts. this is apple, cloud backup service, google, microsoft and a couple of hardware device passwords. it's a risk to have this printed, but the print out is in a fireproof safe with a trusted party. i basically assume my disaster recovery plan is that i have my wallet and the clothes on my back and nothing else. everything else gone including my computers and phones and i have to get back all services and data without having any devices. the higher the level of security, the higher level of disaster preparedness the end user needs to practice. I've emailed my elderly parents to make sure they understand that this mandatory 2fa roll out is happening, and I've explained how they could fuck up their accounts by not notating the recovery method. offered to review their details to make sure it passes a sniff test.
spixy 5y ago
Microsoft Authenticator does support backups (already tried a few times)
tinus_hn 5y ago
Don’t know if it’s available on Android, but on iOS Authenticator by Matt Rubin is a tiny app that properly backs up your codes if you use (as documented) iOS’ encrypted backups. Where Google Authenticator just doesn’t backup half your codes, leaving you in for a surprise if you lose your phone.

by maxk42 5y ago

CaptainJustin 5y ago

1. What is the official way we're supposed to handle this? 2. How should the tech world communicate that better so that it's more user-friendly?

te_chris 5y ago
Yeah, I've been burned by Goog Authenticator not being cloud. I use 1pass for 2FA now and it works in the cloud at least.
r1ch 5y ago
The most common solution is one-time-use backup codes that most services give you when enrolling. Hopefully you saved them somewhere safe! The main issue is Google Authenticator and how popular it is. As GP noticed, it doesn't flag the files as being allowed for backup which is kind of ridiculous. Almost anything is better, https://getaegis.app/ https://getaegis.app/ is my recommendation. You can also manually backup your seed (screenshot / save the QR code during enrollment).
creato 5y ago
I think the only way to handle the possibility of failure of a 2FA system is to have multiple options configured. They all can fail somehow: loss, damage, hardware failure, etc. On my Google account I have two security keys, an OTP app, and saved backup codes. That's not user friendly though. I don't see how to make a user friendly, reliable, and safe 2FA system. Not having 2FA isn't safe either!
deleted 5y ago
[deleted]

paride5745 5y ago

I use Authy, which stores the 2FA on their cloud safely. Super easy to move between phones and to recover in case of disaster.

lelandbatey 5y ago
I also use Authy, so I want to point out something. Authy doesnt exactly "store the credentials online"; they do allow you to store an encrypted snapshot backup in the cloud which you can restore from, but that's not the same as storing them in the cloud. As far as I can tell, for cases where you're just using Authy in the same way as Google Authenticator (a big standard TOTP app), the only value proposition is that Authy allows separate programs with your TOTP keys in them to communicate together so that they all have copies of the same keys. It seems in those cases that Authy is storing very little and is instead acting like a dumb "connecting layer" for installations of the Authy app to talk to each other. This is nice for security, but the consequence is that if you lose access to all your Authy installations at the same time then you're SOL. I'm inferring this merely from using Authy for years, if someone knows more about how they work, please chime in to correct me.
omnimus 5y ago
We need 2FA because our password manager is not enough. ... We put 2FA keys in different password manager it works great.

taf2 5y ago

that does suck... they do provide backup codes... and they do present a page every few months for you to verify that... i would recommend a 2fa app such as Authy maybe as a good way in the future to have a backup for your 2fa codes...

throwawayboise 5y ago
Yep -- you must save the backup codes off line, off-device for any hope of recovery from loss or damage of that device. This is the weakness of the scheme. It relies on people doing something that most people are not good at doing. Thus there will probably be a way for the user to recover without the codes (sending in photo ID or whatever) and that will be the point of attack for anyone trying to maliciously take over the account.

reaperducer 5y ago

Google's Authenticator app's data is not restored. I have no way of logging into half a dozen apps that require 2FA now. Good going, Google. I'll never use your shitty 2FA again. Don't just blame Google. The same thing happened to me with an iPhone using Duo. Now I'm locked out of Facebook because Duo wants me to re-link my Facebook account, and I can't log in to Facebook to do the link because I can't use Duo. To make things worse, Facebook's customer service has lived up to its reputation. Meaning my requests for access, including sending in copy of my government ID, have gone ignored. I appreciate that 2FA is better, but this is the reason I don't use 2FA anymore.

rabboRubble 5y ago

pro-tip for next, back up the otp set up keys or capture the qr code during initial sign up. i've been able to do this because i replicated otp set up in a second source (1password). in 1password, edit the record then inspect the otp field string. it will look like this: otpauth://totp/Discord:you@email.com?secret=blahblahblah&issuer=Discord save the "blahblahblah" and you can manually recreate a token at any time.

dcow 5y ago
Unless you truly want to uphold the property "the something I have is not the something that stores my passwords" (you likely don't), your two factor codes should be in your password manager. Period. A good password manager has a strong user/device PKI backed by an offline key and will only be accessible on devices you've bootstrapped, so it's isomorphic to "something I have" at least and usually exactly equal to "somethings I have". And if you are a security nut trying to uphold that property and telling people it's bad to put your TOTP urls in your password manager... you better not have an authenticator app installed on the same device as your password manager or you've thrown that property out the window. Not saying it's never appropriate to have a true second factor. Just that it's not appropriate for 99% of consumer use cases and the security setup and structure afforded by password managers is more than sufficient to have good account hygiene. It would be a better world if everyone used a password manager and stored their totp codes in it than everyone has a hodgepodge of authentication apps that aren't reliable and break and cause services to implement manual verification backdoor loopholes into their auth anyway etc. etc. TOTP 2FA defends against weak passwords. A password manager enables strong passwords largely making TOTP irrelevant. Unfortunately not everyone uses a password manager and thus services are compelled to add TOTP 2FA because what other choice do they have?
- rabboRubble 5y ago
  yeah, the only reason that i didn't get burned like the person above my original quote is that i got lucky. i had figured out that i could have two tokens running at the same time (one token for service A in Google Authenticator, second token for service A in 1Password). But I realized when I lost all Google Authenticator tokens one time, that I was this close || to a disaster. I had only recently also set up 1pw. The most ideal set up would be to have a universally Yubikey or something equivalent. Preferrably with a backup pre-configured second Yukibey possible in a disaster recovery bugout kit. Then have all the initial QR codes, otp secret manual otp key strings like i demonstrated above your post, account recovery keys, backup break-in codes, or whatever other flavor of two-factor recovery a service uses, all this notated in a secured password manager. The real problem i see with two factor is that the offered recovery method is so variable from service to service. it makes knowing which information you need to have on hand when you've gotten locked out is problematic. the other thing i do is that for core cloud service providers, i print out the password manager details for the accounts. this is apple, cloud backup service, google, microsoft and a couple of hardware device passwords. it's a risk to have this printed, but the print out is in a fireproof safe with a trusted party. i basically assume my disaster recovery plan is that i have my wallet and the clothes on my back and nothing else. everything else gone including my computers and phones and i have to get back all services and data without having any devices. the higher the level of security, the higher level of disaster preparedness the end user needs to practice. I've emailed my elderly parents to make sure they understand that this mandatory 2fa roll out is happening, and I've explained how they could fuck up their accounts by not notating the recovery method. offered to review their details to make sure it passes a sniff test.

spixy 5y ago

Microsoft Authenticator does support backups (already tried a few times)

tinus_hn 5y ago

Don’t know if it’s available on Android, but on iOS Authenticator by Matt Rubin is a tiny app that properly backs up your codes if you use (as documented) iOS’ encrypted backups. Where Google Authenticator just doesn’t backup half your codes, leaving you in for a surprise if you lose your phone.