4 ms·

Any clear reason to go for Google for TOTP? As opposed to Authy or something else.

by RamRodification 4y ago

ntoskrnl 4y ago
Those were examples I thought people were likely to recognize, not vendor recommendations. I edited for clarity.
jeromegv 4y ago
No, it's all the same.
encryptluks2 4y ago
You do realize that TOTP is a standard that doesn't require you to use either, that you can use the same secrets for any TOTP app, right?
- RamRodification 4y ago
  You did read my comment where I suggested "Authy or something else", as in any TOTP app, right?
regecks 4y ago
There is a clear reason not to use Authy, which is that making your data portable is extremely annoying. No export function. I ended up writing a 3rd party Authy client just to get my TOTP keys out. For iOS users, I cannot say enough good things about https://apps.apple.com/us/app/otp-auth/id659877384 https://apps.apple.com/us/app/otp-auth/id659877384. Author is responsive, encrypted backups, portable data format.
- Macha 4y ago
  For android users, Aegis provides much of these benefits (as does andOTP). Both are open source, I like aegis a bit better.
  - SailingCactus33 4y ago
    andOTP has just worked for me across multiple device migrations for years. Encrypted backups to a git repo for mobile files managed with MGit.
- nicce 4y ago
  Thanks. I have been looking replacement for Authy for quite some time because of no export function.
- RamRodification 4y ago
  That's good one. Thanks.
davis 4y ago
There's actually a very good reason to not use Google Authenticator actually. They don't offer any backups (at least on iOS) and as a result, if you lose your phone, you are hosed. Google Authenticator also doesn't use iCloud for backup for files like other apps. I also just assume at this point no one owns that app and that it'll never get backups because that's how Google operates. I've seen multiple people lose their TOTP codes this way and have been locked out of their accounts. Or even the more simple case, they buy a new phone, restore from backup and just assume everything is peachy then send their old phone back and then don't realize it until they open the app for the first time. Use something with cloud backups for your safety.
- bogwog 4y ago
  I got scared as hell a few years ago when an update bricked the app, so launching it caused it to immediately crash. Fortunately, reinstalling the app fixed it without losing any data. But since then I started actually backing up my recovery codes, and whenever I create a new account somewhere, I set up 2FA on three separate apps on my phone just in case.
- nicce 4y ago
  Authy does not allow to make local backup (export) and it is fully closed source, not really transparent. I wish there were better alternatives.
  - PausGreat 4y ago
    Ravio OTP on iOS
- SoftTalker 4y ago
  They offer one-time backup codes that can be used if a device is lost. I'm not sure if this is Google or the site, but for every login where I've set up Google Authenticator I have copied the backup codes to my password manager for that account. I'd agree that a lot of people might not do that however.
  - 4y ago

Any clear reason to go for Google for TOTP? As opposed to Authy or something else.

ntoskrnl 4y ago

Those were examples I thought people were likely to recognize, not vendor recommendations. I edited for clarity.

jeromegv 4y ago

No, it's all the same.

encryptluks2 4y ago

You do realize that TOTP is a standard that doesn't require you to use either, that you can use the same secrets for any TOTP app, right?

RamRodification 4y ago
You did read my comment where I suggested "Authy or something else", as in any TOTP app, right?

regecks 4y ago

There is a clear reason not to use Authy, which is that making your data portable is extremely annoying. No export function. I ended up writing a 3rd party Authy client just to get my TOTP keys out. For iOS users, I cannot say enough good things about https://apps.apple.com/us/app/otp-auth/id659877384 https://apps.apple.com/us/app/otp-auth/id659877384. Author is responsive, encrypted backups, portable data format.

Macha 4y ago
For android users, Aegis provides much of these benefits (as does andOTP). Both are open source, I like aegis a bit better.
- SailingCactus33 4y ago
  andOTP has just worked for me across multiple device migrations for years. Encrypted backups to a git repo for mobile files managed with MGit.
nicce 4y ago
Thanks. I have been looking replacement for Authy for quite some time because of no export function.
RamRodification 4y ago
That's good one. Thanks.

davis 4y ago

There's actually a very good reason to not use Google Authenticator actually. They don't offer any backups (at least on iOS) and as a result, if you lose your phone, you are hosed. Google Authenticator also doesn't use iCloud for backup for files like other apps. I also just assume at this point no one owns that app and that it'll never get backups because that's how Google operates. I've seen multiple people lose their TOTP codes this way and have been locked out of their accounts. Or even the more simple case, they buy a new phone, restore from backup and just assume everything is peachy then send their old phone back and then don't realize it until they open the app for the first time. Use something with cloud backups for your safety.

bogwog 4y ago
I got scared as hell a few years ago when an update bricked the app, so launching it caused it to immediately crash. Fortunately, reinstalling the app fixed it without losing any data. But since then I started actually backing up my recovery codes, and whenever I create a new account somewhere, I set up 2FA on three separate apps on my phone just in case.
nicce 4y ago
Authy does not allow to make local backup (export) and it is fully closed source, not really transparent. I wish there were better alternatives.
- PausGreat 4y ago
  Ravio OTP on iOS
SoftTalker 4y ago
They offer one-time backup codes that can be used if a device is lost. I'm not sure if this is Google or the site, but for every login where I've set up Google Authenticator I have copied the backup codes to my password manager for that account. I'd agree that a lot of people might not do that however.
- 4y ago