8 ms·

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that sa

The solution (which is too late to help you with now) is to take a photo of the QR code that is first showed to you when you originally set up 2FA. Keep that safe somewhere and you can always go back. For anyone who is freaked out by this and currently still has access to their google Authenticator app, I suggest exporting all your codes to a big QR code in the app and keep that safe (maybe print it out).

TacticalCoder 4y ago
And for authenticators that do not allow to export the secret, while your authenticator is not lost yet, add another authenticator: and during registration, save the QR code.
- deleted 4y ago
  [deleted]
- tpmx 4y ago
  There is no option to add another authenticator app at https://myaccount.google.com/security https://myaccount.google.com/security (desktop UI). I think the only feasible option is to first remove Google Authenticator and then re-enable it. Seriously, Google? Might be micro, but this is not a sign of a healthy company on an upwards trajectory.
  - tpmx 4y ago
    It's time to de-google. Seriously. Now it's from a self-preservation POV, not a political POV.
j1elo 4y ago
The QR that you mention, is just an encoding of an actual string key (edit: I'm reading now that it's called seed). If possible, it is better to get the string directly, instead of its QR encoded counterpart. This is needed for example to store the TOTP in a device that has no camera. Or in your Bitwarden Pro account. Obviously you wouldn't be able to scan a QR with such an application, so the actual string is needed you just copy-paste it, so it should be provided by any service that offers 2FA (I confirmed Google does)
- Xylakant 4y ago
  You are correct about the QR code just representing a (fairly short) string, but applications can handle QR code just fine - 1password can read it directly from the screen.
  - lcnPylGDnU4H9OF 4y ago
    There may be a plugin for it but the KeePass clients I've used don't support this by default. Generally, it would be best to look for the string (and keep both the string and the image secret!).
    - wingmanjd 4y ago
      KeepassXC lets you store the TOTP seed value associated with an entry by right-clicking on that key and selecting "Setting up TOTP". Also, other TOTP generators like Authy and Aegis let you backup your tokens to restore to another device.
      - pieter_mj 4y ago
        Yes, but be careful which totp app you're using to store seed values/secret keys : some store them as plain text! Personally on android I'm using keepass2android and keepassium on ios to store both the QR image and the string value. It will also generate the OTP value at login. As you know, the keepass password file can be backed-up anywhere. https://raw.githubusercontent.com/blues-lab/totp-app-analysis-public/main/Gilsenan%20et%20al%20-%20Security%20and%20Privacy%20Failures%20in%20Popular%202FA%20Apps.pdf https://raw.githubusercontent.com/blues-lab/totp-app-analysi...
      - deleted 4y ago
        [deleted]
  - deleted 4y ago
    [deleted]
- password4321 4y ago
  Why not both? Thanks for the clarification.
jvanderbot 4y ago
You can do this, or you can write down the secret (Click to get the text), and use oathtool to generate codes rather than google's auth. I keep all my 2fa secrets in pass for this reason. Never lose access again!
- tmerse 4y ago
  But be careful. If you access the passwords and 2fa secrets via the same credentials you are back to one factor authentication if secret + pass store ever get compromised. Imho it's a different story if you use a separate gpg-key/secret to access the 2fa secrets (which should also only happen in emergency cases). This can easily be done with pass.
  - mr_mitm 4y ago
    How is a regular user supposed to think of all this in advance? It's ridiculous. Securely proving your identity in case of loss of proof of identity is hard enough with just passwords. With 2FA it's pretty much impossible.
  - b112 4y ago
    I'm sure all of this will make sense to grandma, too. (Gmail's main target is not devs, or even computer literate people. And owning a smart phone =! literate.)
    - tmerse 4y ago
      It may not help grandma as much as someone who maintains some popular opensource library that you may happen to use or someone that puts parts of their savings into crypto. Who is more likely to visit this page (and use tools like pass) is up for you to decide. The point still stands. Storing passwords and 2fa secrets inside in the same box will weaken the 2 in 2fa. (Gmail's main target is not devs, or even computer literate people. And owning a smart phone =! literate.) Grandma can always print the 2fa seed or write down the alphanumeric value and store it not next to the sheet with her passwords – same principle (I think she won't use pass anyway as opposed to the person I was originally replying to which tells me they are most likely technically literate).
sureglymop 4y ago
Or save the TOTP hash directly.
hn_throwaway_99 4y ago
Fully understand why some people wouldn't want to do this given the LastPass hack, but some authenticators like Authy let you store a master backup password for all your codes.
riley_dog 4y ago
If you use 1Password, the initial code (just a string) is always available in the app. You can use it to move TOTP to another app, if you wish.
thesnide 4y ago
Printing it out and putting it in some safe is what i did. And works like a charm. I mean, if it works for crypto wallets it might also work for 2FA...
AlexanderTheGr8 4y ago
Wait, they have the authority to block your google auth app? Last I checked, the app is not connected to your google account. And the app's functionality is open source (TOTP). So how does enforcement work?
tmerse 4y ago
This article helped me to understand how totp works and how it can be implemented [1] [1]: https://digitalbunker.dev/how-do-time-based-one-time-password-totp-services-work/ https://digitalbunker.dev/how-do-time-based-one-time-passwor...
ozim 4y ago
Well I have a backup phone - where I would scan 2FA code with 2 phones. Now it is not that necessary because google authenticator allows transfer of data. But when authenticator had no such option I was quite terrified and came up with idea to get another phone just as a backup and scanning 2FA code with 2 phones always for all websites. Of course backup one is always on my desk - but I don't have offsite backup for these. Problem is I don't want these TOTP tokens offsite really so it is a bit of a challange :) to come up with everything proof plan.
- gzer0 4y ago
  And this has now just encouraged me to buy a Pixel 6A running GrapheneOS to have as a backup at all times for my important google accounts
- simcop2387 4y ago
  I store them in a keepassxc database for syncing and alsomprotect it with a yubikey. Lets me back it up to other places while also allowing them to stay secure. Most other password manager solutions should also be able to be used to keep them secure and backed up.
- masukomi 4y ago
  i feel like I'm asking a dumb question but why not just use a password manager that syncs your stuff and handles 2FA like 1Password? Break the phone? no worries you've got the info on your desktop. House goes up in a fire, no worries, they've got it on the cloud and you can access from a friend's house / library / whatever.
  - tempestn 4y ago
    You can't actually access your 1pw vault from wherever if you don't have an existing authenticated device or a copy of your secret key. That's intended to provide added security in case your master password is compromised. So to guard against the house burning down situation you need to either keep a printout of the secret key somewhere else (friend's house, bank box, etc.) or save it somewhere (secure) online where you can get it without using 1pw.
pwenzel 4y ago
1Password stores QR codes and syncs them across any device that has access to your vault. I highly recommend this solution if you're worried about losing access to your 2FA codes. It is also easy to back up.
rhn_mk1 4y ago
And this is how you turn a second factor into another first factor.
tjoff 4y ago
This assumes you are using TOTP.
jve 4y ago
You can extract plaintext secret keys from google authenticator app and store them in user friendly format/password manager https://github.com/scito/extract_otp_secrets https://github.com/scito/extract_otp_secrets
- judge2020 4y ago
  If you're using Authy: https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d958c93 https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d... (be sure to read the comments if you see "appManager is not defined")
  - jve 4y ago
    Warning: Samsung browser on Galaxy S10 hangs when opening this URL.
glmdev 4y ago
I use VaultWarden to store my 2FA info which (aside from being very handy) replicates the codes offline on each device I sync my vault to.
davchana 4y ago
This. I always keep that qr code screenshot & pharse in a seperate keypass database. Instant same 2fa anytime. https://spa.bydav.in/otp.html https://spa.bydav.in/otp.html Shameless plug, I spinned up a local html javascript page to import export these code phrases anytime, with customization options, like issuer name, account name etc.
abrookewood 4y ago
Best bet is to save those QR codes (or text codes) in a different vault. I use passwords in LastPass and QR codes in KeePass.
deleted 4y ago
[deleted]
michaelcampbell 4y ago
So if my MFA-secured Google account is working fine right now, is the best course of action to remove MFA, then re-add it with this QR picture and/or jotting down the key trick?

TacticalCoder 4y ago

And for authenticators that do not allow to export the secret, while your authenticator is not lost yet, add another authenticator: and during registration, save the QR code.

deleted 4y ago
[deleted]
tpmx 4y ago
There is no option to add another authenticator app at https://myaccount.google.com/security https://myaccount.google.com/security (desktop UI). I think the only feasible option is to first remove Google Authenticator and then re-enable it. Seriously, Google? Might be micro, but this is not a sign of a healthy company on an upwards trajectory.
- tpmx 4y ago
  It's time to de-google. Seriously. Now it's from a self-preservation POV, not a political POV.

j1elo 4y ago

The QR that you mention, is just an encoding of an actual string key (edit: I'm reading now that it's called seed). If possible, it is better to get the string directly, instead of its QR encoded counterpart. This is needed for example to store the TOTP in a device that has no camera. Or in your Bitwarden Pro account. Obviously you wouldn't be able to scan a QR with such an application, so the actual string is needed you just copy-paste it, so it should be provided by any service that offers 2FA (I confirmed Google does)

Xylakant 4y ago
You are correct about the QR code just representing a (fairly short) string, but applications can handle QR code just fine - 1password can read it directly from the screen.
- lcnPylGDnU4H9OF 4y ago
  There may be a plugin for it but the KeePass clients I've used don't support this by default. Generally, it would be best to look for the string (and keep both the string and the image secret!).
  - wingmanjd 4y ago
    KeepassXC lets you store the TOTP seed value associated with an entry by right-clicking on that key and selecting "Setting up TOTP". Also, other TOTP generators like Authy and Aegis let you backup your tokens to restore to another device.
    - pieter_mj 4y ago
      Yes, but be careful which totp app you're using to store seed values/secret keys : some store them as plain text! Personally on android I'm using keepass2android and keepassium on ios to store both the QR image and the string value. It will also generate the OTP value at login. As you know, the keepass password file can be backed-up anywhere. https://raw.githubusercontent.com/blues-lab/totp-app-analysis-public/main/Gilsenan%20et%20al%20-%20Security%20and%20Privacy%20Failures%20in%20Popular%202FA%20Apps.pdf https://raw.githubusercontent.com/blues-lab/totp-app-analysi...
    - deleted 4y ago
      [deleted]
- deleted 4y ago
  [deleted]
password4321 4y ago
Why not both? Thanks for the clarification.

jvanderbot 4y ago

You can do this, or you can write down the secret (Click to get the text), and use oathtool to generate codes rather than google's auth. I keep all my 2fa secrets in pass for this reason. Never lose access again!

tmerse 4y ago
But be careful. If you access the passwords and 2fa secrets via the same credentials you are back to one factor authentication if secret + pass store ever get compromised. Imho it's a different story if you use a separate gpg-key/secret to access the 2fa secrets (which should also only happen in emergency cases). This can easily be done with pass.
- mr_mitm 4y ago
  How is a regular user supposed to think of all this in advance? It's ridiculous. Securely proving your identity in case of loss of proof of identity is hard enough with just passwords. With 2FA it's pretty much impossible.
- b112 4y ago
  I'm sure all of this will make sense to grandma, too. (Gmail's main target is not devs, or even computer literate people. And owning a smart phone =! literate.)
  - tmerse 4y ago
    It may not help grandma as much as someone who maintains some popular opensource library that you may happen to use or someone that puts parts of their savings into crypto. Who is more likely to visit this page (and use tools like pass) is up for you to decide. The point still stands. Storing passwords and 2fa secrets inside in the same box will weaken the 2 in 2fa. (Gmail's main target is not devs, or even computer literate people. And owning a smart phone =! literate.) Grandma can always print the 2fa seed or write down the alphanumeric value and store it not next to the sheet with her passwords – same principle (I think she won't use pass anyway as opposed to the person I was originally replying to which tells me they are most likely technically literate).

sureglymop 4y ago

Or save the TOTP hash directly.

hn_throwaway_99 4y ago

Fully understand why some people wouldn't want to do this given the LastPass hack, but some authenticators like Authy let you store a master backup password for all your codes.

riley_dog 4y ago

If you use 1Password, the initial code (just a string) is always available in the app. You can use it to move TOTP to another app, if you wish.

thesnide 4y ago

Printing it out and putting it in some safe is what i did. And works like a charm. I mean, if it works for crypto wallets it might also work for 2FA...

AlexanderTheGr8 4y ago

Wait, they have the authority to block your google auth app? Last I checked, the app is not connected to your google account. And the app's functionality is open source (TOTP). So how does enforcement work?

tmerse 4y ago

This article helped me to understand how totp works and how it can be implemented [1] [1]: https://digitalbunker.dev/how-do-time-based-one-time-password-totp-services-work/ https://digitalbunker.dev/how-do-time-based-one-time-passwor...

ozim 4y ago

Well I have a backup phone - where I would scan 2FA code with 2 phones. Now it is not that necessary because google authenticator allows transfer of data. But when authenticator had no such option I was quite terrified and came up with idea to get another phone just as a backup and scanning 2FA code with 2 phones always for all websites. Of course backup one is always on my desk - but I don't have offsite backup for these. Problem is I don't want these TOTP tokens offsite really so it is a bit of a challange :) to come up with everything proof plan.

gzer0 4y ago
And this has now just encouraged me to buy a Pixel 6A running GrapheneOS to have as a backup at all times for my important google accounts
simcop2387 4y ago
I store them in a keepassxc database for syncing and alsomprotect it with a yubikey. Lets me back it up to other places while also allowing them to stay secure. Most other password manager solutions should also be able to be used to keep them secure and backed up.
masukomi 4y ago
i feel like I'm asking a dumb question but why not just use a password manager that syncs your stuff and handles 2FA like 1Password? Break the phone? no worries you've got the info on your desktop. House goes up in a fire, no worries, they've got it on the cloud and you can access from a friend's house / library / whatever.
- tempestn 4y ago
  You can't actually access your 1pw vault from wherever if you don't have an existing authenticated device or a copy of your secret key. That's intended to provide added security in case your master password is compromised. So to guard against the house burning down situation you need to either keep a printout of the secret key somewhere else (friend's house, bank box, etc.) or save it somewhere (secure) online where you can get it without using 1pw.

pwenzel 4y ago

1Password stores QR codes and syncs them across any device that has access to your vault. I highly recommend this solution if you're worried about losing access to your 2FA codes. It is also easy to back up.

rhn_mk1 4y ago

And this is how you turn a second factor into another first factor.

tjoff 4y ago

This assumes you are using TOTP.

jve 4y ago

You can extract plaintext secret keys from google authenticator app and store them in user friendly format/password manager https://github.com/scito/extract_otp_secrets https://github.com/scito/extract_otp_secrets

judge2020 4y ago
If you're using Authy: https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d958c93 https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d... (be sure to read the comments if you see "appManager is not defined")
- jve 4y ago
  Warning: Samsung browser on Galaxy S10 hangs when opening this URL.

glmdev 4y ago

I use VaultWarden to store my 2FA info which (aside from being very handy) replicates the codes offline on each device I sync my vault to.

davchana 4y ago

This. I always keep that qr code screenshot & pharse in a seperate keypass database. Instant same 2fa anytime. https://spa.bydav.in/otp.html https://spa.bydav.in/otp.html Shameless plug, I spinned up a local html javascript page to import export these code phrases anytime, with customization options, like issuer name, account name etc.

abrookewood 4y ago

Best bet is to save those QR codes (or text codes) in a different vault. I use passwords in LastPass and QR codes in KeePass.

deleted 4y ago

[deleted]

michaelcampbell 4y ago

So if my MFA-secured Google account is working fine right now, is the best course of action to remove MFA, then re-add it with this QR picture and/or jotting down the key trick?