4 ms·

Doesn't allow for export though, which is a complete pain for backup.

by _snrv 5y ago

miohtama 5y ago
Authy on Android has backup to Google Drive.
jamesboehmer 5y ago
I used this hack to export from Authy Desktop on Mac https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d958c93 https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...
yumraj 5y ago
Maybe I'm not understanding, but what is export and backup in the context of an OTP application. Per my understanding, if I have Authy on my Phone, the one on my PC/laptop is the backup, and vice versa - in the sense that if one dies I can use another. Could you elaborate on the use case.
- stonewareslord 5y ago
  TOTP/HOTP codes are defined by an algorithm (sha1/md5/...), secret (A826EF8...), and number of digits (I usually see 6 digit codes). TOTP additionally takes time period (30 second codes) and time (current time which maps to some 30 second block) as a parameter and HOTP takes a counter as a parameter. All of these parameters go into the function to generate the numbers as a result. If you have ever set one of these up with a QR code, that QR scans to something like: otpauth://totp/ACME%20Co:john.doe@email.com?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME%20Co&algorithm=SHA1&digits=6&period=30 (From: https://github.com/google/google-authenticator/wiki/Key-Uri-Format https://github.com/google/google-authenticator/wiki/Key-Uri-...). Notice all parameters I mentioned above are present, as well as a user friendly account name. So to directly answer your question: a backup would in some way contain all the parameters above, possibly in that otpauth:// format, but could be json or something else. I would not consider Authy to be a trustworthy backup. I assume they are storing these secrets for you and transferring them to other computers at your request. If you can't see the secret, you can't switch to a different app. (Take this last paragraph with a grain of salt, I don't know much about authy but it sounds like trouble. I use FreeOTP and other open source OTP apps).

Doesn't allow for export though, which is a complete pain for backup.

by _snrv 5y ago

Doesn't allow for export though, which is a complete pain for backup.

miohtama 5y ago

Authy on Android has backup to Google Drive.

jamesboehmer 5y ago

I used this hack to export from Authy Desktop on Mac https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d958c93 https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...

yumraj 5y ago

Maybe I'm not understanding, but what is export and backup in the context of an OTP application. Per my understanding, if I have Authy on my Phone, the one on my PC/laptop is the backup, and vice versa - in the sense that if one dies I can use another. Could you elaborate on the use case.

stonewareslord 5y ago
TOTP/HOTP codes are defined by an algorithm (sha1/md5/...), secret (A826EF8...), and number of digits (I usually see 6 digit codes). TOTP additionally takes time period (30 second codes) and time (current time which maps to some 30 second block) as a parameter and HOTP takes a counter as a parameter. All of these parameters go into the function to generate the numbers as a result. If you have ever set one of these up with a QR code, that QR scans to something like: otpauth://totp/ACME%20Co:john.doe@email.com?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME%20Co&algorithm=SHA1&digits=6&period=30 (From: https://github.com/google/google-authenticator/wiki/Key-Uri-Format https://github.com/google/google-authenticator/wiki/Key-Uri-...). Notice all parameters I mentioned above are present, as well as a user friendly account name. So to directly answer your question: a backup would in some way contain all the parameters above, possibly in that otpauth:// format, but could be json or something else. I would not consider Authy to be a trustworthy backup. I assume they are storing these secrets for you and transferring them to other computers at your request. If you can't see the secret, you can't switch to a different app. (Take this last paragraph with a grain of salt, I don't know much about authy but it sounds like trouble. I use FreeOTP and other open source OTP apps).