4 ms·
Maybe I'm not understanding, but what is export and backup in the context of an OTP application. Per my understanding, if I have Authy on my Phone, the one on
by yumraj 5y ago
Maybe I'm not understanding, but what is export and backup in the context of an OTP application.
Per my understanding, if I have Authy on my Phone, the one on my PC/laptop is the backup, and vice versa - in the sense that if one dies I can use another.
Could you elaborate on the use case.
- stonewareslord 5y agoTOTP/HOTP codes are defined by an algorithm (sha1/md5/...), secret (A826EF8...), and number of digits (I usually see 6 digit codes). TOTP additionally takes time period (30 second codes) and time (current time which maps to some 30 second block) as a parameter and HOTP takes a counter as a parameter. All of these parameters go into the function to generate the numbers as a result. If you have ever set one of these up with a QR code, that QR scans to something like: otpauth://totp/ACME%20Co:john.doe@email.com?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME%20Co&algorithm=SHA1&digits=6&period=30 (From: https://github.com/google/google-authenticator/wiki/Key-Uri-Format https://github.com/google/google-authenticator/wiki/Key-Uri-...). Notice all parameters I mentioned above are present, as well as a user friendly account name. So to directly answer your question: a backup would in some way contain all the parameters above, possibly in that otpauth:// format, but could be json or something else. I would not consider Authy to be a trustworthy backup. I assume they are storing these secrets for you and transferring them to other computers at your request. If you can't see the secret, you can't switch to a different app. (Take this last paragraph with a grain of salt, I don't know much about authy but it sounds like trouble. I use FreeOTP and other open source OTP apps).