7 ms·
my phone recently just died. only two years old. all my authenticator stuff is gone. sms is fine, I just move the sim to a new phone
by cultofmetatron 4y ago
my phone recently just died. only two years old. all my authenticator stuff is gone. sms is fine, I just move the sim to a new phone
- lotsofpulp 4y agoI use Strongbox to backup TOTP in Keepass databases.
- malfist 4y agoThat's good for you, is grandma going to do that?
- yonixw 4y agoI'm a programmer and when I was told to store backup codes, I saw the site still has a "Forgot Password?" button so I dismissed it as a QUICK way to recovery, Not the ONLY way! The only one who told me losing backup codes means losing your data forever was my bitcoin wallet. (Ironic)
- GoblinSlayer 4y agoTOTP is only needed if you use very a weak password, which shouldn't be a thing with keepass.
- lotsofpulp 4y agoWhat if your password is leaked from some website’s database or you have a keylogger or someone somehow sees it? Wouldn’t it help then?
- GoblinSlayer 4y agoKeepass shows passwords as a sequence of masked characters https://keepass.info/screenshots/keepass_2x/main_big.png https://keepass.info/screenshots/keepass_2x/main_big.png If you have a keylogger, it will just steal your TOTP.
- ufmace 4y agoYeah that's the problem - TOTP with a basic app is pretty easy to use, but making sure you're protected from a phone suddenly lost or broken scenario is tougher, and you may not know you need to do it until it's too late. How many people actually store those backup codes properly or go to the trouble to use a third-party app that supports backups and actually do backups?
- Arch-TK 4y agoWouldn't most people just use Google Authenticator and have it automagically back up to google's nigh unlimited storage space? Obviously not something anyone who respects their privacy would subject themselves to, but it seems to me like the easy path leads to these things being backed up. Obviously if google has your 2FA keys and you were using 2FA keys to log into your google account then you would need to recover your account, but you would be stuck in the same situation as if you had damaged/lost your SIM (e.g. if you lose your phone).
- jsmith99 4y agoYou would think that. Actually, Google authenticator does NOT backup codes, although there are other apps that do.
- kentonv 4y agoGoogle Authenticator does not back up TOTP state to Google. In fact, AFAIK, the app does not talk to the internet, at all, much less does it associated with a Google account. You can transfer your Google Authenticator state to another phone. This is accomplished through scanning QR codes -- no data is transferred over a network. This is a relatively new feature; for many years, Google Authenticator refused to provide any way to extract the authenticator state from the phone at all. You literally had to root your phone to get the state out. It's designed this way because if your TOTP state were backed up to your Google account then it would no longer provide any additional security over Chrome's password manager, which is also backed up to Google. The two factors in "two factor" are supposed to be "something you know" (password) and "something you have" (phone, or security key). In order for the authenticator app to really be "something you have", it has to be hard to copy.
- dalyons 4y ago> It's designed this way Its a bad design then :) . I dropped gauthenticator years ago because of the ridiculously user unfriendly inability to transfer/backup auth codes. What a braindead UX assumption. If you pursue security purity too far, people just wont use it.
- 71a54xd 4y agoJust store backup codes, using a 2FA app like authy which can be swapped via SMS defeats the entire point of using 2FA authenticators in lieu of SMS.