4 ms·
You can set up 2FA through one of the other options first. After that, TOTP should be available as an option as well. After setting TOTP up, you can remove the
by trulyrandom 5y ago
You can set up 2FA through one of the other options first. After that, TOTP should be available as an option as well. After setting TOTP up, you can remove the other one.
They're probably hiding the TOTP option because the backup story for Google Authenticator is really poor. If you lose your device, you lose access to all of the accounts you had set up 2FA for with Google Authenticator. Of course, there are other TOTP apps that are better in this regard, but Google is unlikely to promote those because then they'd lose some control over the authentication flow.
- mmastrac 5y agoI dislike how the only way to get TOTP codes off a device is by rooting. I had a half dozen codes that I had to dump from the sqlite db when I first used authenticator.
- krmboya 5y agoI use andOTP[1] installed via f-droid. You can easily get a backup file with your codes. [1] https://github.com/andOTP/andOTP https://github.com/andOTP/andOTP
- simonmales 5y agoThis! Though now Google Authenticator supports transfers, there is less of a need. But I still enjoy using andOTP.
- aorth 5y agoJust FYI, it's possible to backup your codes on Android using Aegis too. No root needed. https://github.com/beemdevelopment/Aegis https://github.com/beemdevelopment/Aegis
- cian 5y agoThankfully this has been fixed. You can now choose "Transfer accounts" (from the menu in the top right corner) to copy everything to Google Authenticator on a new (or backup) phone.
- mmastrac 5y agoInteresting! I ended up going with the LastPass authenticator in the end because of this issue but I am happy to see it fixed.
- jrochkind1 5y agoI honestly was wondering about this exact thing for a while -- if you lose your phone, do you use lose access to every account you have, irretrievably? (For that matter, with some apps it wasn't clear to me even what you do if you get a new phone, which everyone does eventually right??) What's the way around all this? I have had trouble getting an answer to this question, so thank you for addressing it somewhat, apparently I'm not totally crazy! (I am, somewhat shamedly, not yet a user of TOTP 2FA, although I will have to become so soon because of various platfrom and organizational requirements, and am trying to figure it out, and finding it challenging). What are the options/ways that other TOTP apps handle this better, what are my choices here?
- necovek 5y agoAegis, available in F-droid as well, is an open source solution that allows you to easily backup and restore your TOTP "devices" (or rather, keys). You'd have to transfer that backup manually between your old and new phone. A more user friendly cloud solution might be Authy that others have recommended.
- UncleMeat 5y agoThis is indeed a big problem. Phone numbers are easy to transfer to a new phone when you drop yours in the toilet. This, however, makes them easier to attack. The way to handle this correctly is to have backup options. This can be a second device or a printed sheet of backup codes. I’d wager that few people actually do this, though.
- jrochkind1 5y agoWhat is the mechanism for a "second device" backup option, how does that work an what TOTP products support it how?
- tzs 5y agoThe simplest case, applicable if you have access to more than one device that supports generating TOTP codes at the time you are setting up TOTP for a given site, is to simply scan the site's QR code on all the devices. E.g., when I create an account at a site that uses TOTP I scan the QR code on both my phone and my tablet. (Actually, I scan it twice on each device, using two different TOTP apps. That way I'm covered if one of the apps stops being supported). If you don't have all your devices available at the same time, or you want to allow for the possibility of adding a new device later, you can simply save the QR code. When the site gives you the QR code, take a screenshot and save that in some secure fashion. I save it as an encrypted PNG file. To add a TOTP device later view the screenshot and scan the QR code. Most sites that give you a TOTP QR code have an option to get the code in text. As an alternative to (or in addition to) saving a screenshot of the QR code you can ask for the text code and save that. Securing a text file might be more convenient for some people than securing an image file, although using the text code to set up a new phone or tablet likely won't be as convenient as using a QR code.
- prometheon1 5y agoThanks for the solution!