18 ms·

Google Authenticator now supports Google Account synchronization

468 points by ortusdux 4y ago

sylware 4y ago
... and noscript/basic (x)html browsers ? mmmmh....
hammyhavoc 4y ago
Too little too late. Moved to BitWarden with a VaultWarden server.
ianopolous 4y ago
How about they support the algorithm parameter in the TOTP spec, rather than silently ignoring it and hard-coding hmacSha1?
fabian2k 4y ago
Ahem, I think making it much easier to transfer and backup 2FA codes is extremely important to make this area more useable. But I'm missing some parts here in this announcement how the data is protected? Is the security the same as for the Google Account itself, or are there additional checks or protection for the case where you need to restore 2FA to another phone? And how are you supposed to handle the 2FA for your Google account? I mean I have U2F tokens which remove that concern, but that is far from the typical case. If you have the 2FA for your Google account in the Google Authenticator, which is probably a very common case, how does this entire thing work then when you need it, which is when you lose your phone?
- charcircuit 4y ago
  I believe the idea is that for as long as you still have 1 device signed in you can recover it by using one of the codes.
- ocrow 4y ago
  Yep. Also missing from the announcement are any instructions on what people need to do to use the feature.
  - kevincox 4y ago
    > To try the new Authenticator with Google Account synchronization, simply update the app and follow the prompts.
  - xattt 4y ago
    Nor the follow-up necessary should your account happen to be randomly blocked.
  - nixcraft 4y ago
    Here they have support page https://support.google.com/accounts/answer/1066447 https://support.google.com/accounts/answer/1066447
    - vb6sp6 4y ago
      [dead]
- justeleblanc 4y ago
  > And how are you supposed to handle the 2FA for your Google account? I mean I have U2F tokens which remove that concern, but that is far from the typical case. If you have the 2FA for your Google account in the Google Authenticator, which is probably a very common case, how does this entire thing work then when you need it, which is when you lose your phone? You open your safe and you use one of the recovery codes that you wrote down when you setup 2FA.
  - tasuki 4y ago
    Do you and people you know have a safe? Where I'm from, we generally don't use safes. Do you consider your safe to be... safe? I'd imagine it to be relatively easy to get into, by picking the lock or sawing through the safe.
    - cyberbanjo 4y ago
      Relatively easy? Relative to what?
      - jaggederest 4y ago
        Relative to the wrench attack, I guess: https://xkcd.com/538/ https://xkcd.com/538/
      - saltcured 4y ago
        Relative to a naively imagined abstraction of a safe, perhaps. A decent home safe can be reasonable protection against that loose scrap of paper with backup codes ending up in the trash can and may even keep it legible in the event of a house fire. But it is true, it won't be much help if you are targeted by safe crackers.
    - maxfurman 4y ago
      A safe is extremely safe against hackers on the other side of the world. Quite safe against more local threats without special equipment and time on their hands. Security is relative to your threat model!
    - 4y ago
- jbverschoor 4y ago
  Post by "Group Product Manager". It's a pretty useless post. Could've been 2 sentences. From the support page: > If you’re signed in to their Google Account within Google Authenticator, your codes will automatically be backed up and restored on any new device you use. Still doesn't explain how it works. On the same page they're talking about synchronization: > Google Authenticator 6.0 on Android and 4.0 on iOS introduces the option to keep all your verification codes synchronized across all your devices, simply by signing into your Google Account. I don't understand why "people" think it's a good idea to hide any form of mental model or technicalities. Provide people with a mental model. It will make it easier to understand all the Ws. People are not stupid. They will understand, as long as you can describe it properly.
roopakv 4y ago
I remember pushing for this when i was at Google ~5 years ago. I wasn't on the team but I wrote 2 proposals, one to do QR code export and imports and another to sync codes using the google backup framework. Neither was approved nor denied, just in limbo. But nice to see that both features have finally shipped. Sadly I have switched away to 1P, too much effort to move it all back.
- briffle 4y ago
  > Sadly I have switched away to 1P, too much effort to move it all back. It seems like a very, very bad thing to store both your passwords, and TOTP codes in the same tool...
  - bdcravens 4y ago
    I agree, and I'm a huge 1Password fan. I use Authy instead, which also backs up TOTPs. I'm also having the same thoughts about Google Auth: my email (Gmail) is a big target for gaining access to the rest of my digital life, and putting 2FA in the same hands seems risky. I'd need to do more evaluation to consider leaving Authy.
  - psanford 4y ago
    The main point of TOTP is that users passwords are mostly weak and reused across sites. TOTP protects those users from password stuffing and similar attacks. If you are using a strong random password generated from 1PW you've already mitigated against that threat. TOTP isn't buying you much additional security. So for most folks it is just fine to store you TOTP seed in 1PW. Unlike TOTP, passkeys _do_ buy you additional security in their phishing resistance. So you should always prefer passkeys/fido2 keys to TOTP if that is an option. Its still fine for most users to use 1PW as your passkey storage.
    - xyzzy_plugh 4y ago
      Furthermore the risk exposure to using TOTO in 1pw is almost insignificant. You can configure your 1password account to require 2FA when setting up new devices, and unlike Google here the decryption requires manual knowledge not shared with the cloud. The only argument I can imagine is that if someone gets ahold of your phone it's either locked and they can unlock it or it's unlocked, in which case either your 1pw account and/or other TOTP apps are either locked or unlocked. In the worst case scenario where everything is unlocked, having a separate app is negligible. Besides, AFAIK Google Authenticator doesn't require additional unlock steps, unlike authy or 1password. You're better off worrying about how to avoid TOTP and securing 1password than about having TOTP codes stored alongside your passwords.
heliophobicdude 4y ago
I recently had a broken phone replaced and had depended on a backup to have my TOTP keys on my new phone. It was not a part of the phone backup. :(
- svachalek 4y ago
  Same. Someone needs to make all this both secure and usable. For now, I'll even take "this is going to ruin your day but at least there's a standard and consistent way to deal with this" as usable, maybe we don't want anything easier than that for security reasons.
obarthelemy 4y ago
I'm not really in favor of putting 2FA codes in the Cloud, see that password manager that got hacked a few months ago. Granted, we can expect better from Google, but still, they're not accepting any liability. Google Authenticator already has a QR-Code based very easy export procedure, I just backup my GAuth to my spare phone and tablet. It feels safer because it's physical. Of course, not everyone has several devices, and physical security is not granted to everyone. I guess cloud-backedup 2FA is better than no 2FA, or than 2FA with no backup at all. But... Cloud ? for security stuff ?
- ris 4y ago
  This. For me a TOTP app/tool will only ever output codes. If it offers to let me do anything else with the key, it's a no-go.
  - bombolo 4y ago
    So what do you do when your phone falls down and breaks?
    - obarthelemy 4y ago
      I take my previous phone out of its drawer. Or my tablet.
      - bombolo 4y ago
        Very funny. But how do you login into things without the otp seed?
        iavael 3y ago
        Use another device with _another_ seed (since this is auth factor of ownership you must not share seed between multiple devices just like pki private keys and pgp keys). Or if you don't have backup otp generator then use backup codes.
        4y ago
divan 4y ago
Regular reminder for Apple users that iOS/MacOS has support for TOTP codes out of the box. It fills the code like an autocomplete. https://support.apple.com/en-gb/guide/iphone/ipha6173c19f/ios https://support.apple.com/en-gb/guide/iphone/ipha6173c19f/io...
- tough 4y ago
  So are you telling me you can just use vanilla iOS to store TOTP like with Authy or Google's Authneticator or 1PAssword but directly into the apple keychain? That seems nice Honestly I think apple could do a better job at camera -> qr ux flow
  - Eric_WVGG 4y ago
    Yup. The catch is, it's kind of buried in System Settings. Cable Sasser wrote a blog post that was making the rounds a few weeks ago, advocating for a dedicated app. He's right, the existing Apple implementation works great but it's still a lot for normies. https://cabel.com/2023/03/27/apple-passwords-deserve-an-app/ https://cabel.com/2023/03/27/apple-passwords-deserve-an-app/
  - xp84 4y ago
    > camera -> qr ux flow You mean the idiotic little tiny yellow popup which only stays on the screen while the QR in view and must be tapped to activate... WTF were they thinking right? (You can add a "QR reader" button to your control center though which functions in a more sane way.) Anyway yes you can do that, but I wouldn't use iCloud keychain at all because your Apple account, including ICKC, can be fully hijacked using one factor only - the passcode of the device an attacker has. People watch you unlocking in a bar, then grab your phone and run. Google "joanna stern iphone passcode" before moving any precious data into Apple's control.
    - divan 4y ago
      Thanks for the Joanna Stern story, didn't know that. But if an attacker has your iPhone with passcode they surely get access to your Google Authenticator or Auth app. How "not storing TOTP keys in iCloud" way is better in this case?
justeleblanc 4y ago
Nice to see it catching up. It feels like competitors (MS authenticator, 1P, the iOS thing...) have had it for ages.
bilal4hmed 4y ago
I have started using Aegis on android which is fantastic. Backup and restore anywhere. My advice would be to not have everything in one place, no matter which ecosystem you are on. Going all in is never a good idea whether its Google or Apple. Its great that Google has done this, but just use another app to manage that.
ec109685 4y ago
I’ve been using Authy because it supports syncing to the cloud (encrypted with a key that you control). Glad Google finally has this.
manv1 4y ago
Years ago I updated authenticator and it wiped out all my entries, which led to an incredibly aggravating week of account recovery. What happens to your data when google decides to lock your google account? Does your device keep a local copy or will it just shut down?
xyzzy_plugh 4y ago
Too little too late. Everyone I know has moved to 1password or authy or yubikeys (or some combination). I'll never understand why they didn't do this many years ago.
- ClassyJacket 4y ago
  Yep, way too late to keep me on it. I don't trust them anymore. You cannot just burn your users over and over and expect them to stay forever.
- neop1x 4y ago
  Yes. And also I don't trust Google that my Google account will keep working in the future. I am glad Authy has its own account.
leo150 4y ago
It's interesting to see some movement in this area. Is Google finally feeling some competition? I was looking for this feature years ago and had to switch to Authy and then to 1P. I'm wondering how many users did GA loose for not adding this basic functionality for years.
- eastbound 4y ago
  It would be awesome if Google were innovating again. That was a good company on the good days.
psanford 4y ago
TOTP seed migrations are a real pain. Its good to see Google offering a solution to that problem. I've moved to using the pass otp extension[0] which gives me secure storage of the totp seeds without being tied to a single device. [0]: https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp
0xbadcafebee 4y ago
I'm also on 1Password. No idea why I would use Google Authenticator. "Hey we have Google Password Manager" - that's great, so I can be locked into your platform while you take another 13 years to implement a basic feature? No thanks? I'd rather pay a company that cares about my experience, thanks.
exabrial 4y ago
Is this the same way Google Podcasts works, where I "have to" have "web, location, and usage history tracking" enabled to subscribe to a podcast? lol
dirtyid 4y ago
[flagged]
ajonit 4y ago
If Google ever decides to kick you out of your account, Authenticator data will be gone. Google has done this on several occasions in the past. I would still prefer independent app for password manager and another for TOTP with backup enabled for all.
mullingitover 4y ago
Google's authenticator has been outright harmful in how neglected it has been, especially when it comes to backing up your codes outside the app. This should be a very full-featured and well-maintained application considering how essential it is for security. For years I've been telling anyone who'd listen to use Authy instead.
amaccuish 4y ago
Such a bizarre app. Instead of implementing push notifications in the "Google Authenticator" app, Google decided to add the logic to all other apps like YouTube. Before we introduced Okta, our users would get notifications like "Open the YouTube app on your phone to approve this login". Whilst clever for the people who don't have Google Authenticator installed, it's just bizarre to ignore it when it's there.
- elnr 4y ago
  Google's preference of their weird, bespoke authenticator over TOTP is also very annoying to anyone who would rather not. (it is required to add any additional authenticators, and the default authenticator)
  - joshuamorton 4y ago
    It's more secure though. TOTP are still phishable, the push notification includes information on where you're logging in from, so you at least have a chance to notice that the login is coming from Croatia and not your house. FIDO is still vastly better though.
    - mgbmtl 4y ago
      With Google Authenticator, there is no notification, is there? As a user, you have to open your phone, open the app, then scroll to the right code, and copy/paste it. (The lack of search in one of the reasons that made me switch to Aegis) I always thought Okta was kind of weird, because it's just a notification that says "allow/deny" and it's easy to click the wrong one.
      - joshuamorton 4y ago
        It's possible I'm confused by GP, but there's two things being discussed here I think: First, Google Authenticator, which is in fact just totp which can be used for both Google 1p and any 3p TOTP thing. And second Google's push-notification based auth checks which are used for only certain 1P Google apps (like logging into your gmail or youtube).
fullstop 4y ago
Too late, Google, I already switched to Yubikey. I kind of like that my TOTP keys are a separate entity from my phone.
- bombolo 4y ago
  If only that was more broadly supported.
  - fullstop 4y ago
    Where is it missing support? edit: I want to reiterate that these are still TOTP codes and not WebAuth/FIDO2.
    - bombolo 4y ago
      Oh I thought you meant those usb devices that need to be set up, like google titan and similar.
      - fullstop 4y ago
        Ah, no, these can connect to a PC over USB and to a smart phone over USB or NFC to generate a 6 digit TOTP code, just like Google Authenticator does. They can also do more sophisticated things, but that's not what I was referring to here. Those sophisticated and more secure things are supported by Google, Facebook, Dropbox, Github, etc, but not by most banks. Banks are so slow with this stuff and still do SMS-based 2FA which is absurd to me.
    - jve 4y ago
      Yesterday was trying to pay with PayPal (protected by hardware key/yubikey) via Android and it said: Supported on desktop only... And another thing: https://www.paypal-community.com/t5/Managing-Account/Why-am-I-only-allowed-to-create-one-security-device-for-2-factor/td-p/2920679 https://www.paypal-community.com/t5/Managing-Account/Why-am-...
      - 4y ago
throw7 4y ago
Storing it in the google cloud doesn't satisfy me. I just simply want the codes under my control. The current authenticator did finally allow export to qr code, but google still makes it stupendously difficult to just get a simple text export to a file. It's not been a problem for me though as I've just always saved the otpauth code from the start.
- kobalsky 4y ago
  I save the qrcodes in an encrypted folder than I can quickly import into a yubikey with: for i in *.png; do uri=`zbarimg -q --raw "$i"` && ykman oath accounts uri --touch --password "MYYUBIPASS" "$uri"; done
PenguinRevolver 4y ago
And it only took them 12 years to do it. Authy had already implemented syncing to different devices for a long while.
camhart 4y ago
Another request -- let me archive them (instead of only delete).
- xp84 4y ago
  True, or be able to keep them in folders. Imagine trying to manage your TOTPs if you, say, are a freelancer who does work for 25 different clients.
tzs 4y ago
Note that there are two kinds of backups possible for TOTP secrets: 1. Backups that are specific to the app that made them. They can be used to restore the secrets to that same app on a new or replacement device, but might not help if you want to migrate to a different app. 2. Backups that can be restored to other apps. If you aren't sure you are going to stick with the same TOTP app long term this could be important. Sometimes there are third party tools that can take #1 type backups and give you back the secrets in a form suitable for other apps. For example, Google Authenticator can export the secrets in the form of a QR code that contains the secrets for multiple account. Another instance of Google Authenticator can read that, but other TOTP apps might not be able to. But this tool [1] knows how to take the information in that QR code and decode it and split it into the individual secrets for each site. It can even generate QR codes of those for scanning into another TOTP app. If you want #2 type backups that just work with most TOTP apps, there is a fairly easy way to get them. Whenever you set up a new account and a site gives you a QR code, simply take a screenshot before using that QR code to finish setting up the new account. Store your collection of QR code screenshots somewhere safe. If you ever want to migrate to a new TOTP app or to the same app on a new device open those saved screenshots and scan the codes. If you've got an image display program that will let you open many at once restoring can be pretty fast. On my Mac for example I just do "open *.png" in the place I have the screenshots. That opens them all in Preview, with each one being a separate page. Then I tell preview to show one page at a time. Then it is a matter of scanning one, hitting "page down" on the keyboard, and repeating until they are done. After two or three I'm in the groove and it goes pretty fast. [1] https://github.com/dim13/otpauth https://github.com/dim13/otpauth
- TacticalCoder 4y ago
  > backups possible for TOTP secrets: > > 1. Backups that are specific to the app that made them I never thought about that. I always backup the key before I first use it, when it's shown for the very first time. Heck, I've written a CLI / text TOTP app (using some Java TOTP library) for my own use (fully offline / airgapped / paasword protected / showing six codes at once for the same code [+1 hour / now / -1 hour and previous code / current code / next code] and which also shows a public/commonly used example code, which is convenient to diagnose sync/clock issues). > But this tool [1] knows how to take the information in that QR code and decode it and split it into the individual secrets for each site. Like JBSW Y3DP EHPK 3PXP ? In my experience every site that shows the QR code offers the possibility to see that secret (and those that don't are misleading users into thinking it's more complicated than it is). A TOTP secret is just that: 16 or 24 or whatever characters. The QR is just an encoding of these characters. The "issuer" serves no role other than autofill the name of the service for you (and you're not forced to use the issued nameL you can use any name you want). I never ever scanned a QR code to configure 2FA / TOTP for any site. I write the 2FA code down, then encode what I've written down (in at least two devices).
crossroadsguy 4y ago
Quite interesting to see that Google Accounts, known for locking users out i.e AI auto-banning without recourse, might become a major gatekeeper of other accounts as well.
- xp84 4y ago
  Indeed. I find it extra concerning because their "risk based" system which can simply decide you're locked out -- even when you know your login! -- just because it doesn't recognize your IP or cookies, offers no guaranteed from-scratch recovery unless you have set up the glaring security hole that is SMS. I have an extra throwaway Google account (thankfully for nothing important) whose password I never forgot, but which I simply cannot log into ever again because I didn't set up any 2FA or recovery email, and Google just decided it didn't like the look of me one time.
- jve 4y ago
  This only helps to get out of that gatekeeping, i.e if you loose your phone now, you're done. This gives you a chance. If they locked you out from your account, you are back to square 1. You can still export TOTPs to other phone directly. You can still make sure you store TOTP secrets on multiple devices/password manager.
nikeee 4y ago
Does that mean one can use adb to backup Google Authenticator's data as well? Last time I tried, the app data was explicitly marked as excluded in backups. I started saving the secrets somewhere else because otherwise, I wouldn't be able to have _any_ backup.
exoji2e 4y ago
If you are concerned with lockout and want offline, interoperable backups of your 2auth codes I strongly recommend Raivo. It can’t import from google authenticator directly, but it’s possible to extract the secrets with some docker script, and then enter them manually into Raivo.
kramerger 4y ago
Pro tip: Aegis works offline and can export and import to file.
gigatexal 4y ago
If any PMs at Google are reading this for this product please, please, please, for the love of god let me export my Google Authenticator TOTPs back and forth from other managers like Bitwarden or 1password etc. I know it's against your interest but it's in the interest of the end user.[1] [1] yes I know there are github projects that make this doable but it's super involved whereas it doesn't need to be.
murat124 4y ago
Why did it take so long? 2FA has been around for quite some time now. Was there a push back at Google? Or, just neglect?
izacus 4y ago
If anyone is looking for good alternatives on Android - Aegis and Authenticator Pro are both good opensource apps, available on F-Droid/Play and also allow easy backup to a cloud (or storage) of choice.
- amiga-workbench 4y ago
  Thumbs up for Aegis, I've been using it for years and the backup & import/export has saved my ass several times now.
mmh0000 4y ago
If you're on Android, you should checkout FreeOTP+[1], a far better OTP client. FreeOTP Plus forked the same functionality of FreeOTP provided by RedHat with the following enhancement: * Export settings to Google Drive or other document providers * Import settings from Google Drive or other document providers * Enhanced UI with material design with dark theme support * Search bar to search token * Provide more token details for better interoperatibility with other apps * Utilize modern camera hardware to scan QR code faster * Option to require Biometric / PIN authentication to launch the app * Heuristic based offline icon for tokens of 250+ websites. * More settings to customize the app functionality [1] https://f-droid.org/en/packages/org.liberty.android.freeotpplus/ https://f-droid.org/en/packages/org.liberty.android.freeotpp...
- moogly 4y ago
  Or Aegis Authenticator. It is basically a perfect app IMO.
- nashashmi 4y ago
  I recommend http://totp.app http://totp.app for Android. You can even set the app as default on Android.
tacker2000 4y ago
To be honest i wouldnt trust google with any accounts anymore. If you somehow get your account locked or banned, for whatever reason, youre screwed forever.
explodingwaffle 4y ago
While we’re complaining about Google’s 2FA offering… The issue described here started happening to me recently: https://www.googlenestcommunity.com/t5/Apps-Account/Why-is-Google-using-YouTube-instead-of-text-for-2-step-verification-for/m-p/155159 https://www.googlenestcommunity.com/t5/Apps-Account/Why-is-G... Summary- Google has added a “match the numbers in the app” style 2FA to YouTube. Makes sense- their video monopoly means that for many iOS users like myself it’s the only Google app they’ve got. Except… 1) It’s the default, and there’s no apparent way to change it, or even turn it off. This is annoying- I prefer TOTP since it’s more secure. There’s a Google Prompts section in the 2FA settings, but it says that I don’t have any supported devices. This actually makes sense, because 2) It doesn’t f*king work! Ever since they changed it from “press yes” to “match number”, the screen opens in the YouTube app and then loads forever. Which means I’ve got a spurious notification on my phone, a screen to dismiss next time I open the YouTube app (or several, because for some reason they can stack), and two extra clicks every time I log into Google on a new device. Actually, I lied earlier- there is one way to disable it, and it’s to DISABLE ALL 2FA, as you can see people doing in that support thread. I honestly don’t blame them, but clearly less 2FA was not the plan of whoever’s idea this was. Speaking of support forums- I don’t think anyone at Google reads them, but they do read HN :))))
- lasr_velocirptr 4y ago
  One of the potential solutions might be to just treat youtube as a separate service i.e. create a separate account for YouTube with 2fa disabled. It’s not ideal since you need to deal with two accounts but that’s what password managers are for.
- hyperdimension 4y ago
  Wow, that link is such a great example of Google's "support." "This channel is for troubleshooting Google devices. It is best to report this with YouTube support for better assistance. [...] I'll be locking this thread after 24 hours." ...just because the initial report contained the keyword 'YouTube', presumably. The reporter clarified the situation, and a different "support" team member comes in and regurgitates the same canned response! On Google's side, why even bother replying at all if that's all you're going to do?
Kiro 4y ago
> To try the new Authenticator with Google Account synchronization, simply update the app and follow the prompts. Not seeing anything new on Android and it's fully updated.
glintik 4y ago
OMG, aftet so many years Google was able to hear users! Before this update I had to use two phones synching them manually.
tonymet 4y ago
Good move . for too long usability suffered . most of these security protocols fail to scale . what happens when you have 30 tokens and you get a new device ? many vendors are still requiring a phone call. security without usability is just cosplay
getpost 4y ago
A certain webhost requires me to Authenticator for 2FA, and I did so. I also configured my iPhone to delete unused apps. Authenticator was unused, and got deleted, so naturally, I had to open a support ticket with the webhost to remove 2FA to regain access to my webhost account. I hope this feature will maintain my setup if the app gets deleted.
flippinburgers 4y ago
There are alternatives like aegis. People should just turn their backs on google auth all together.
sgloutnikov 4y ago
If you are on the Apple ecosystem, I highly recommend OTP Auth [0]. Very friendly UI with encrypted cloud backup where you control the key. [0] https://cooperrs.de/otpauth.html https://cooperrs.de/otpauth.html
- FabHK 4y ago
  Could you compare and contrast to Authy, which also offers that functionality?
  - sgloutnikov 4y ago
    Last I tried Authy I think it wanted me to create an account and give my phone number, so I noped out.
RileyJames 4y ago
Tangential complaint on google account sign ins. If I remove an account from an app / device, I expect it to be gone. But they clearly shadow it. I have three google accounts (work, work and personal). And when I log into my personal account, which I have removed from the gmail app. It still uses that app as it’s “2FA”, and then reactivates the account. 1) if I remove the account, actually do it!!! 2) if I’m not logged into any apps, then use a 2FA method I DO have active (google auth app)
elif 4y ago
so... the new feature is you can turn your 2FA into a 1FA google login... if you think this is a good idea, i highly recommend you add a second 2FA device to the account you're worried about instead of... centralizing your "have" factor into a "know" factor.
ikiris 4y ago
So I'm curious what happened for them to do a complete 180 in belief as to the security implications of syncing tokens off the phone? Did the holdouts on the relevant team not make it through the layoff rounds or something?
spullara 4y ago
Too late. Switched to Authy the first time I got a new phone.
greatgib 4y ago
How awful that they don't add "backup options" but just "backup to their cloud". How nice it is for all 3 letters agencies and google employees that they have your passwords and your otp all in their cloud. In clear. All that is needed for having the keys to all your other kingdoms.
WaitWaitWha 4y ago
I cannot rely on Google. Too many times have I shifted to something by Google, to have them stop supporting it or completely shutting it down. I use Keepass/Keepass2Android for 2FA wherever possible.
cocacola1 4y ago
Lol I think I lost the only 2FA I had stored in Google Auth. It was for a RuneScape account I had for a decade plus, that I had long ago deleted the Gmail for. I had moved everything to another app and that was the only thing remained in Google Auth. It somehow survived transferring phones, too. I wonder how I’m gonna access that account now? Every time I’ve tried to change the email, I’ve been unsuccessful.
nhumrich 4y ago
Years ago, this might have mattered. But I have moved on. Now an authy user, and not sure why that should change.
nikolay 4y ago
Well, not yet - just installed it and... there's nothing.
nikolay 4y ago
One would be crazy to keep their passwords and 2FA with a company, which does not provide customer service (unless you pay for Google One, which still doesn't cover all of Google)! I know, it's bad to store both passwords and OTPs in one place, but 1Password does this for me smoothly, and I trust time orders of magnitude more than Google, so, no, Google, you're too late to the party, plus, you need to regain our trust, which seems impossible at this point!
- bombcar 4y ago
  Pro tip- when presented with an OTP QR code, you can read it with as many things as you want.
  - kotatsuyaki 4y ago
    Except for Microsoft’s. It took me twenty minutes of trying to realize that they have their own non-standard QR codes, and that I had to click “use another authenticator app” to get a standard one.
- tantalor 4y ago
  What does customer service have to do with trust? Personally I would be a little weirded out if a customer service rep could access my account over the phone, especially in an account recovery situation where "I lost credentials oops".
  - nikolay 4y ago
    Getting locked out and having nobody to talk to is a matter of trust!
    - tantalor 4y ago
      Sure but just because you can call them doesn't mean you can trust them.
      - 4y ago
shaggie76 4y ago
I find it curious that they're continuing to develop it; when I found that Authenticator wasn't a 2FA option for my google account I figured it had been abandoned.
sasas 4y ago
This is great, although Google decided there was malware on my iPhone. False positive? After following all the steps it asked, now when logging in to any google service, google throws an error making it impossible to log in to any google service on the phone. I haven’t done a factory reset as I don’t want to loose the google auth tokens. Catch 22.
lawrenceyan 4y ago
This would have been so useful three or four weeks ago. Good to have for the future I guess. Alas. Google is pretty on top of things in terms of service updates on products that have core adoption / pmf.
NoZebra120vClip 4y ago
It would seem that the "secrets roach motel" model was the most secure and sane option for Authenticator. In that way, it mimicks the Yubikey or other hardware TOTP keys, where the secrets go in but they can't come out. Everyone with a Yubikey knows that the secrets aren't coming out and they will need a backup. It would be foolhardy to rely on a Yubikey alone, when the risk model obviously entails loss or theft of the device itself. That's what paper codes are for. It would seem that the QR export, and now this account sync, is Google weakening security as a concession to intense end-user pressure. Yeah, it sucks to lose all your TOTP secrets at once; that's why you form a contingency plan and stow your paper backup or maintain a spare device.
- batiudrami 4y ago
  You are of course completely correct, but this is a letting perfect be the enemy of good situation. I lost my phone overseas (my backup code was at home) and losing access to everything was so annoying I turned 2FA off on my google account for years.
- dvzk 4y ago
  Yes. When TOTP debuted, it was aimed at and designed by security engineers. Keeping secrets on-device was and is correct for serious uses. Google Authenticator is a victim of its own popularity. Fortunately, the field moved on, and we now have WebAuthn and Passkeys for non-exportable private authentication keys.
  - computerfriend 4y ago
    Sadly, WebAuthn is also becoming a victim in the same way (at least on iOS). The expectation is that WebAuthn private keys are stored in the secure enclave, which would be a comparable security guarantee to YubiKeys and other hardware devices. "Passkeys" are now forcibly synced via iCloud, you can't use WebAuthn on iOS without enabling iCloud Keychain.
    - dvzk 4y ago
      Huh, thanks, I wrongly assumed that Passkeys inherited WebAuthn’s attestations for hardware-backed keys. I guess organizations will need to ban Passkeys internally.
lopkeny12ko 4y ago
I had always thought that the lack of cloud synchronization was a deliberate security feature. If my TOTP secrets sync to the cloud, doesn't that defeat the entire point of 2FA? Now, instead of my physical device being the sole second factor for authentication, anyone who is able to breach/intercept/coerce someone at Google into divulging/etc the TOTP secrets from Google's cloud storage, my accounts are toast...
- saddist0 4y ago
  While I agree and wouldn't use this personally, I do have argument in favor of it. 1) Attack vector reduced to one account which you maintain with healthy hygiene, and hopefully don't use with public systems, etc. 2) You can keep backup 2FA for single account instead of keeping for N accounts.
- wankle 4y ago
  Agreed, it seems bizarre to me that any company especially Google would roll out something like this.
deleted 4y ago
[deleted]
rswail 4y ago
Microsoft Authenticator has had backup for ages. Uses iCloud on iOS and pre-encrypts the info.
pqs 4y ago
It is not clear to me if this will be by default and applied to everyone in the next update, or if I have to setup something.
- smarnach 4y ago
  Once the app is updated, you will be asked at the next app start. You can either choose a Google account to sync your TOTP secrets to, or you can continue without a Google account, in which case your secrets won't be synced.
  - pqs 4y ago
    Thanks for the very informative comment.
rcarmo 4y ago
Only took them 13 years, and you can likely get locked out of that too if you loose access to your Google account. Anyone know if this includes any form of export?
NoZebra120vClip 4y ago
Is there a way to opt out of this? If I installed Authenticator on my Android phone, would it immediately and gratuitously sync everything to my account? Can I log out and stay logged out on the app so that it never syncs? If someone uses Chrome's password manager and Authenticator's TOTP, this seems to make account takeovers an exceptionally juicy prize. Capture a Google account and you've captured credentials and all necessary factors in one fell swoop. Well done, bravo. I mean, account takeover already means game over because you can read/send email, but the whole idea of device-based TOTP is to isolate it from anything with an attack surface.
timvdalen 4y ago
Haha, I just transferred them to a new device last week! I will say that the previous migration path was super simple as well. The old device generates a number of QR codes that the new device scans, in sequence.
anotherhue 4y ago
Two days later: Gmail spam detection auto deletes user's Google account and all of their synchronised keys. User looses their entire digital identity.
justinclift 4y ago
Of particular importance is the related article and HN thread about this: Article: "Google Authenticator cloud sync: Google can see the secrets, even while stored" - https://defcon.social/@mysk/110262313275622023 https://defcon.social/@mysk/110262313275622023 HN thread: https://news.ycombinator.com/item?id=35708869 https://news.ycombinator.com/item?id=35708869
AshLeece 4y ago
In case anyone sees this, someone found this: https://defcon.social/@mysk/110262313275622023 https://defcon.social/@mysk/110262313275622023 TL;DR don't use it as there is no encryption.

468 points by ortusdux 4y ago

sylware 4y ago

... and noscript/basic (x)html browsers ? mmmmh....

hammyhavoc 4y ago

Too little too late. Moved to BitWarden with a VaultWarden server.

ianopolous 4y ago

How about they support the algorithm parameter in the TOTP spec, rather than silently ignoring it and hard-coding hmacSha1?

fabian2k 4y ago

Ahem, I think making it much easier to transfer and backup 2FA codes is extremely important to make this area more useable. But I'm missing some parts here in this announcement how the data is protected? Is the security the same as for the Google Account itself, or are there additional checks or protection for the case where you need to restore 2FA to another phone? And how are you supposed to handle the 2FA for your Google account? I mean I have U2F tokens which remove that concern, but that is far from the typical case. If you have the 2FA for your Google account in the Google Authenticator, which is probably a very common case, how does this entire thing work then when you need it, which is when you lose your phone?

charcircuit 4y ago
I believe the idea is that for as long as you still have 1 device signed in you can recover it by using one of the codes.
ocrow 4y ago
Yep. Also missing from the announcement are any instructions on what people need to do to use the feature.
- kevincox 4y ago
  > To try the new Authenticator with Google Account synchronization, simply update the app and follow the prompts.
- xattt 4y ago
  Nor the follow-up necessary should your account happen to be randomly blocked.
- nixcraft 4y ago
  Here they have support page https://support.google.com/accounts/answer/1066447 https://support.google.com/accounts/answer/1066447
  - vb6sp6 4y ago
    [dead]
justeleblanc 4y ago
> And how are you supposed to handle the 2FA for your Google account? I mean I have U2F tokens which remove that concern, but that is far from the typical case. If you have the 2FA for your Google account in the Google Authenticator, which is probably a very common case, how does this entire thing work then when you need it, which is when you lose your phone? You open your safe and you use one of the recovery codes that you wrote down when you setup 2FA.
- tasuki 4y ago
  Do you and people you know have a safe? Where I'm from, we generally don't use safes. Do you consider your safe to be... safe? I'd imagine it to be relatively easy to get into, by picking the lock or sawing through the safe.
  - cyberbanjo 4y ago
    Relatively easy? Relative to what?
    - jaggederest 4y ago
      Relative to the wrench attack, I guess: https://xkcd.com/538/ https://xkcd.com/538/
    - saltcured 4y ago
      Relative to a naively imagined abstraction of a safe, perhaps. A decent home safe can be reasonable protection against that loose scrap of paper with backup codes ending up in the trash can and may even keep it legible in the event of a house fire. But it is true, it won't be much help if you are targeted by safe crackers.
  - maxfurman 4y ago
    A safe is extremely safe against hackers on the other side of the world. Quite safe against more local threats without special equipment and time on their hands. Security is relative to your threat model!
  - 4y ago
jbverschoor 4y ago
Post by "Group Product Manager". It's a pretty useless post. Could've been 2 sentences. From the support page: > If you’re signed in to their Google Account within Google Authenticator, your codes will automatically be backed up and restored on any new device you use. Still doesn't explain how it works. On the same page they're talking about synchronization: > Google Authenticator 6.0 on Android and 4.0 on iOS introduces the option to keep all your verification codes synchronized across all your devices, simply by signing into your Google Account. I don't understand why "people" think it's a good idea to hide any form of mental model or technicalities. Provide people with a mental model. It will make it easier to understand all the Ws. People are not stupid. They will understand, as long as you can describe it properly.

roopakv 4y ago

I remember pushing for this when i was at Google ~5 years ago. I wasn't on the team but I wrote 2 proposals, one to do QR code export and imports and another to sync codes using the google backup framework. Neither was approved nor denied, just in limbo. But nice to see that both features have finally shipped. Sadly I have switched away to 1P, too much effort to move it all back.

briffle 4y ago
> Sadly I have switched away to 1P, too much effort to move it all back. It seems like a very, very bad thing to store both your passwords, and TOTP codes in the same tool...
- bdcravens 4y ago
  I agree, and I'm a huge 1Password fan. I use Authy instead, which also backs up TOTPs. I'm also having the same thoughts about Google Auth: my email (Gmail) is a big target for gaining access to the rest of my digital life, and putting 2FA in the same hands seems risky. I'd need to do more evaluation to consider leaving Authy.
- psanford 4y ago
  The main point of TOTP is that users passwords are mostly weak and reused across sites. TOTP protects those users from password stuffing and similar attacks. If you are using a strong random password generated from 1PW you've already mitigated against that threat. TOTP isn't buying you much additional security. So for most folks it is just fine to store you TOTP seed in 1PW. Unlike TOTP, passkeys _do_ buy you additional security in their phishing resistance. So you should always prefer passkeys/fido2 keys to TOTP if that is an option. Its still fine for most users to use 1PW as your passkey storage.
  - xyzzy_plugh 4y ago
    Furthermore the risk exposure to using TOTO in 1pw is almost insignificant. You can configure your 1password account to require 2FA when setting up new devices, and unlike Google here the decryption requires manual knowledge not shared with the cloud. The only argument I can imagine is that if someone gets ahold of your phone it's either locked and they can unlock it or it's unlocked, in which case either your 1pw account and/or other TOTP apps are either locked or unlocked. In the worst case scenario where everything is unlocked, having a separate app is negligible. Besides, AFAIK Google Authenticator doesn't require additional unlock steps, unlike authy or 1password. You're better off worrying about how to avoid TOTP and securing 1password than about having TOTP codes stored alongside your passwords.

heliophobicdude 4y ago

I recently had a broken phone replaced and had depended on a backup to have my TOTP keys on my new phone. It was not a part of the phone backup. :(

svachalek 4y ago
Same. Someone needs to make all this both secure and usable. For now, I'll even take "this is going to ruin your day but at least there's a standard and consistent way to deal with this" as usable, maybe we don't want anything easier than that for security reasons.

obarthelemy 4y ago

I'm not really in favor of putting 2FA codes in the Cloud, see that password manager that got hacked a few months ago. Granted, we can expect better from Google, but still, they're not accepting any liability. Google Authenticator already has a QR-Code based very easy export procedure, I just backup my GAuth to my spare phone and tablet. It feels safer because it's physical. Of course, not everyone has several devices, and physical security is not granted to everyone. I guess cloud-backedup 2FA is better than no 2FA, or than 2FA with no backup at all. But... Cloud ? for security stuff ?

ris 4y ago
This. For me a TOTP app/tool will only ever output codes. If it offers to let me do anything else with the key, it's a no-go.
- bombolo 4y ago
  So what do you do when your phone falls down and breaks?
  - obarthelemy 4y ago
    I take my previous phone out of its drawer. Or my tablet.
    - bombolo 4y ago
      Very funny. But how do you login into things without the otp seed?
      - iavael 3y ago
        Use another device with _another_ seed (since this is auth factor of ownership you must not share seed between multiple devices just like pki private keys and pgp keys). Or if you don't have backup otp generator then use backup codes.
      - 4y ago

divan 4y ago

Regular reminder for Apple users that iOS/MacOS has support for TOTP codes out of the box. It fills the code like an autocomplete. https://support.apple.com/en-gb/guide/iphone/ipha6173c19f/ios https://support.apple.com/en-gb/guide/iphone/ipha6173c19f/io...

tough 4y ago
So are you telling me you can just use vanilla iOS to store TOTP like with Authy or Google's Authneticator or 1PAssword but directly into the apple keychain? That seems nice Honestly I think apple could do a better job at camera -> qr ux flow
- Eric_WVGG 4y ago
  Yup. The catch is, it's kind of buried in System Settings. Cable Sasser wrote a blog post that was making the rounds a few weeks ago, advocating for a dedicated app. He's right, the existing Apple implementation works great but it's still a lot for normies. https://cabel.com/2023/03/27/apple-passwords-deserve-an-app/ https://cabel.com/2023/03/27/apple-passwords-deserve-an-app/
- xp84 4y ago
  > camera -> qr ux flow You mean the idiotic little tiny yellow popup which only stays on the screen while the QR in view and must be tapped to activate... WTF were they thinking right? (You can add a "QR reader" button to your control center though which functions in a more sane way.) Anyway yes you can do that, but I wouldn't use iCloud keychain at all because your Apple account, including ICKC, can be fully hijacked using one factor only - the passcode of the device an attacker has. People watch you unlocking in a bar, then grab your phone and run. Google "joanna stern iphone passcode" before moving any precious data into Apple's control.
  - divan 4y ago
    Thanks for the Joanna Stern story, didn't know that. But if an attacker has your iPhone with passcode they surely get access to your Google Authenticator or Auth app. How "not storing TOTP keys in iCloud" way is better in this case?

justeleblanc 4y ago

Nice to see it catching up. It feels like competitors (MS authenticator, 1P, the iOS thing...) have had it for ages.

bilal4hmed 4y ago

I have started using Aegis on android which is fantastic. Backup and restore anywhere. My advice would be to not have everything in one place, no matter which ecosystem you are on. Going all in is never a good idea whether its Google or Apple. Its great that Google has done this, but just use another app to manage that.

ec109685 4y ago

I’ve been using Authy because it supports syncing to the cloud (encrypted with a key that you control). Glad Google finally has this.

manv1 4y ago

Years ago I updated authenticator and it wiped out all my entries, which led to an incredibly aggravating week of account recovery. What happens to your data when google decides to lock your google account? Does your device keep a local copy or will it just shut down?

xyzzy_plugh 4y ago

Too little too late. Everyone I know has moved to 1password or authy or yubikeys (or some combination). I'll never understand why they didn't do this many years ago.

ClassyJacket 4y ago
Yep, way too late to keep me on it. I don't trust them anymore. You cannot just burn your users over and over and expect them to stay forever.
neop1x 4y ago
Yes. And also I don't trust Google that my Google account will keep working in the future. I am glad Authy has its own account.

leo150 4y ago

It's interesting to see some movement in this area. Is Google finally feeling some competition? I was looking for this feature years ago and had to switch to Authy and then to 1P. I'm wondering how many users did GA loose for not adding this basic functionality for years.

eastbound 4y ago
It would be awesome if Google were innovating again. That was a good company on the good days.

psanford 4y ago

TOTP seed migrations are a real pain. Its good to see Google offering a solution to that problem. I've moved to using the pass otp extension[0] which gives me secure storage of the totp seeds without being tied to a single device. [0]: https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp

0xbadcafebee 4y ago

I'm also on 1Password. No idea why I would use Google Authenticator. "Hey we have Google Password Manager" - that's great, so I can be locked into your platform while you take another 13 years to implement a basic feature? No thanks? I'd rather pay a company that cares about my experience, thanks.

exabrial 4y ago

Is this the same way Google Podcasts works, where I "have to" have "web, location, and usage history tracking" enabled to subscribe to a podcast? lol

dirtyid 4y ago

[flagged]

ajonit 4y ago

If Google ever decides to kick you out of your account, Authenticator data will be gone. Google has done this on several occasions in the past. I would still prefer independent app for password manager and another for TOTP with backup enabled for all.

mullingitover 4y ago

Google's authenticator has been outright harmful in how neglected it has been, especially when it comes to backing up your codes outside the app. This should be a very full-featured and well-maintained application considering how essential it is for security. For years I've been telling anyone who'd listen to use Authy instead.

amaccuish 4y ago

Such a bizarre app. Instead of implementing push notifications in the "Google Authenticator" app, Google decided to add the logic to all other apps like YouTube. Before we introduced Okta, our users would get notifications like "Open the YouTube app on your phone to approve this login". Whilst clever for the people who don't have Google Authenticator installed, it's just bizarre to ignore it when it's there.

elnr 4y ago
Google's preference of their weird, bespoke authenticator over TOTP is also very annoying to anyone who would rather not. (it is required to add any additional authenticators, and the default authenticator)
- joshuamorton 4y ago
  It's more secure though. TOTP are still phishable, the push notification includes information on where you're logging in from, so you at least have a chance to notice that the login is coming from Croatia and not your house. FIDO is still vastly better though.
  - mgbmtl 4y ago
    With Google Authenticator, there is no notification, is there? As a user, you have to open your phone, open the app, then scroll to the right code, and copy/paste it. (The lack of search in one of the reasons that made me switch to Aegis) I always thought Okta was kind of weird, because it's just a notification that says "allow/deny" and it's easy to click the wrong one.
    - joshuamorton 4y ago
      It's possible I'm confused by GP, but there's two things being discussed here I think: First, Google Authenticator, which is in fact just totp which can be used for both Google 1p and any 3p TOTP thing. And second Google's push-notification based auth checks which are used for only certain 1P Google apps (like logging into your gmail or youtube).

fullstop 4y ago

Too late, Google, I already switched to Yubikey. I kind of like that my TOTP keys are a separate entity from my phone.

bombolo 4y ago
If only that was more broadly supported.
- fullstop 4y ago
  Where is it missing support? edit: I want to reiterate that these are still TOTP codes and not WebAuth/FIDO2.
  - bombolo 4y ago
    Oh I thought you meant those usb devices that need to be set up, like google titan and similar.
    - fullstop 4y ago
      Ah, no, these can connect to a PC over USB and to a smart phone over USB or NFC to generate a 6 digit TOTP code, just like Google Authenticator does. They can also do more sophisticated things, but that's not what I was referring to here. Those sophisticated and more secure things are supported by Google, Facebook, Dropbox, Github, etc, but not by most banks. Banks are so slow with this stuff and still do SMS-based 2FA which is absurd to me.
  - jve 4y ago
    Yesterday was trying to pay with PayPal (protected by hardware key/yubikey) via Android and it said: Supported on desktop only... And another thing: https://www.paypal-community.com/t5/Managing-Account/Why-am-I-only-allowed-to-create-one-security-device-for-2-factor/td-p/2920679 https://www.paypal-community.com/t5/Managing-Account/Why-am-...
    - 4y ago

throw7 4y ago

Storing it in the google cloud doesn't satisfy me. I just simply want the codes under my control. The current authenticator did finally allow export to qr code, but google still makes it stupendously difficult to just get a simple text export to a file. It's not been a problem for me though as I've just always saved the otpauth code from the start.

kobalsky 4y ago
I save the qrcodes in an encrypted folder than I can quickly import into a yubikey with: for i in *.png; do uri=`zbarimg -q --raw "$i"` && ykman oath accounts uri --touch --password "MYYUBIPASS" "$uri"; done

PenguinRevolver 4y ago

And it only took them 12 years to do it. Authy had already implemented syncing to different devices for a long while.

camhart 4y ago

Another request -- let me archive them (instead of only delete).

xp84 4y ago
True, or be able to keep them in folders. Imagine trying to manage your TOTPs if you, say, are a freelancer who does work for 25 different clients.

tzs 4y ago

Note that there are two kinds of backups possible for TOTP secrets: 1. Backups that are specific to the app that made them. They can be used to restore the secrets to that same app on a new or replacement device, but might not help if you want to migrate to a different app. 2. Backups that can be restored to other apps. If you aren't sure you are going to stick with the same TOTP app long term this could be important. Sometimes there are third party tools that can take #1 type backups and give you back the secrets in a form suitable for other apps. For example, Google Authenticator can export the secrets in the form of a QR code that contains the secrets for multiple account. Another instance of Google Authenticator can read that, but other TOTP apps might not be able to. But this tool [1] knows how to take the information in that QR code and decode it and split it into the individual secrets for each site. It can even generate QR codes of those for scanning into another TOTP app. If you want #2 type backups that just work with most TOTP apps, there is a fairly easy way to get them. Whenever you set up a new account and a site gives you a QR code, simply take a screenshot before using that QR code to finish setting up the new account. Store your collection of QR code screenshots somewhere safe. If you ever want to migrate to a new TOTP app or to the same app on a new device open those saved screenshots and scan the codes. If you've got an image display program that will let you open many at once restoring can be pretty fast. On my Mac for example I just do "open *.png" in the place I have the screenshots. That opens them all in Preview, with each one being a separate page. Then I tell preview to show one page at a time. Then it is a matter of scanning one, hitting "page down" on the keyboard, and repeating until they are done. After two or three I'm in the groove and it goes pretty fast. [1] https://github.com/dim13/otpauth https://github.com/dim13/otpauth

TacticalCoder 4y ago
> backups possible for TOTP secrets: > > 1. Backups that are specific to the app that made them I never thought about that. I always backup the key before I first use it, when it's shown for the very first time. Heck, I've written a CLI / text TOTP app (using some Java TOTP library) for my own use (fully offline / airgapped / paasword protected / showing six codes at once for the same code [+1 hour / now / -1 hour and previous code / current code / next code] and which also shows a public/commonly used example code, which is convenient to diagnose sync/clock issues). > But this tool [1] knows how to take the information in that QR code and decode it and split it into the individual secrets for each site. Like JBSW Y3DP EHPK 3PXP ? In my experience every site that shows the QR code offers the possibility to see that secret (and those that don't are misleading users into thinking it's more complicated than it is). A TOTP secret is just that: 16 or 24 or whatever characters. The QR is just an encoding of these characters. The "issuer" serves no role other than autofill the name of the service for you (and you're not forced to use the issued nameL you can use any name you want). I never ever scanned a QR code to configure 2FA / TOTP for any site. I write the 2FA code down, then encode what I've written down (in at least two devices).

crossroadsguy 4y ago

Quite interesting to see that Google Accounts, known for locking users out i.e AI auto-banning without recourse, might become a major gatekeeper of other accounts as well.

xp84 4y ago
Indeed. I find it extra concerning because their "risk based" system which can simply decide you're locked out -- even when you know your login! -- just because it doesn't recognize your IP or cookies, offers no guaranteed from-scratch recovery unless you have set up the glaring security hole that is SMS. I have an extra throwaway Google account (thankfully for nothing important) whose password I never forgot, but which I simply cannot log into ever again because I didn't set up any 2FA or recovery email, and Google just decided it didn't like the look of me one time.
jve 4y ago
This only helps to get out of that gatekeeping, i.e if you loose your phone now, you're done. This gives you a chance. If they locked you out from your account, you are back to square 1. You can still export TOTPs to other phone directly. You can still make sure you store TOTP secrets on multiple devices/password manager.

nikeee 4y ago

Does that mean one can use adb to backup Google Authenticator's data as well? Last time I tried, the app data was explicitly marked as excluded in backups. I started saving the secrets somewhere else because otherwise, I wouldn't be able to have _any_ backup.

exoji2e 4y ago

If you are concerned with lockout and want offline, interoperable backups of your 2auth codes I strongly recommend Raivo. It can’t import from google authenticator directly, but it’s possible to extract the secrets with some docker script, and then enter them manually into Raivo.

kramerger 4y ago

Pro tip: Aegis works offline and can export and import to file.

gigatexal 4y ago

If any PMs at Google are reading this for this product please, please, please, for the love of god let me export my Google Authenticator TOTPs back and forth from other managers like Bitwarden or 1password etc. I know it's against your interest but it's in the interest of the end user.[1] [1] yes I know there are github projects that make this doable but it's super involved whereas it doesn't need to be.

murat124 4y ago

Why did it take so long? 2FA has been around for quite some time now. Was there a push back at Google? Or, just neglect?

izacus 4y ago

If anyone is looking for good alternatives on Android - Aegis and Authenticator Pro are both good opensource apps, available on F-Droid/Play and also allow easy backup to a cloud (or storage) of choice.

amiga-workbench 4y ago
Thumbs up for Aegis, I've been using it for years and the backup & import/export has saved my ass several times now.

mmh0000 4y ago

If you're on Android, you should checkout FreeOTP+[1], a far better OTP client. FreeOTP Plus forked the same functionality of FreeOTP provided by RedHat with the following enhancement: * Export settings to Google Drive or other document providers * Import settings from Google Drive or other document providers * Enhanced UI with material design with dark theme support * Search bar to search token * Provide more token details for better interoperatibility with other apps * Utilize modern camera hardware to scan QR code faster * Option to require Biometric / PIN authentication to launch the app * Heuristic based offline icon for tokens of 250+ websites. * More settings to customize the app functionality [1] https://f-droid.org/en/packages/org.liberty.android.freeotpplus/ https://f-droid.org/en/packages/org.liberty.android.freeotpp...

moogly 4y ago
Or Aegis Authenticator. It is basically a perfect app IMO.
nashashmi 4y ago
I recommend http://totp.app http://totp.app for Android. You can even set the app as default on Android.

tacker2000 4y ago

To be honest i wouldnt trust google with any accounts anymore. If you somehow get your account locked or banned, for whatever reason, youre screwed forever.

explodingwaffle 4y ago

While we’re complaining about Google’s 2FA offering… The issue described here started happening to me recently: https://www.googlenestcommunity.com/t5/Apps-Account/Why-is-Google-using-YouTube-instead-of-text-for-2-step-verification-for/m-p/155159 https://www.googlenestcommunity.com/t5/Apps-Account/Why-is-G... Summary- Google has added a “match the numbers in the app” style 2FA to YouTube. Makes sense- their video monopoly means that for many iOS users like myself it’s the only Google app they’ve got. Except… 1) It’s the default, and there’s no apparent way to change it, or even turn it off. This is annoying- I prefer TOTP since it’s more secure. There’s a Google Prompts section in the 2FA settings, but it says that I don’t have any supported devices. This actually makes sense, because 2) It doesn’t f*king work! Ever since they changed it from “press yes” to “match number”, the screen opens in the YouTube app and then loads forever. Which means I’ve got a spurious notification on my phone, a screen to dismiss next time I open the YouTube app (or several, because for some reason they can stack), and two extra clicks every time I log into Google on a new device. Actually, I lied earlier- there is one way to disable it, and it’s to DISABLE ALL 2FA, as you can see people doing in that support thread. I honestly don’t blame them, but clearly less 2FA was not the plan of whoever’s idea this was. Speaking of support forums- I don’t think anyone at Google reads them, but they do read HN :))))

lasr_velocirptr 4y ago
One of the potential solutions might be to just treat youtube as a separate service i.e. create a separate account for YouTube with 2fa disabled. It’s not ideal since you need to deal with two accounts but that’s what password managers are for.
hyperdimension 4y ago
Wow, that link is such a great example of Google's "support." "This channel is for troubleshooting Google devices. It is best to report this with YouTube support for better assistance. [...] I'll be locking this thread after 24 hours." ...just because the initial report contained the keyword 'YouTube', presumably. The reporter clarified the situation, and a different "support" team member comes in and regurgitates the same canned response! On Google's side, why even bother replying at all if that's all you're going to do?

Kiro 4y ago

> To try the new Authenticator with Google Account synchronization, simply update the app and follow the prompts. Not seeing anything new on Android and it's fully updated.

glintik 4y ago

OMG, aftet so many years Google was able to hear users! Before this update I had to use two phones synching them manually.

tonymet 4y ago

Good move . for too long usability suffered . most of these security protocols fail to scale . what happens when you have 30 tokens and you get a new device ? many vendors are still requiring a phone call. security without usability is just cosplay

getpost 4y ago

A certain webhost requires me to Authenticator for 2FA, and I did so. I also configured my iPhone to delete unused apps. Authenticator was unused, and got deleted, so naturally, I had to open a support ticket with the webhost to remove 2FA to regain access to my webhost account. I hope this feature will maintain my setup if the app gets deleted.

flippinburgers 4y ago

There are alternatives like aegis. People should just turn their backs on google auth all together.

sgloutnikov 4y ago

If you are on the Apple ecosystem, I highly recommend OTP Auth [0]. Very friendly UI with encrypted cloud backup where you control the key. [0] https://cooperrs.de/otpauth.html https://cooperrs.de/otpauth.html

FabHK 4y ago
Could you compare and contrast to Authy, which also offers that functionality?
- sgloutnikov 4y ago
  Last I tried Authy I think it wanted me to create an account and give my phone number, so I noped out.

RileyJames 4y ago

Tangential complaint on google account sign ins. If I remove an account from an app / device, I expect it to be gone. But they clearly shadow it. I have three google accounts (work, work and personal). And when I log into my personal account, which I have removed from the gmail app. It still uses that app as it’s “2FA”, and then reactivates the account. 1) if I remove the account, actually do it!!! 2) if I’m not logged into any apps, then use a 2FA method I DO have active (google auth app)

elif 4y ago

so... the new feature is you can turn your 2FA into a 1FA google login... if you think this is a good idea, i highly recommend you add a second 2FA device to the account you're worried about instead of... centralizing your "have" factor into a "know" factor.

ikiris 4y ago

So I'm curious what happened for them to do a complete 180 in belief as to the security implications of syncing tokens off the phone? Did the holdouts on the relevant team not make it through the layoff rounds or something?

spullara 4y ago

Too late. Switched to Authy the first time I got a new phone.

greatgib 4y ago

How awful that they don't add "backup options" but just "backup to their cloud". How nice it is for all 3 letters agencies and google employees that they have your passwords and your otp all in their cloud. In clear. All that is needed for having the keys to all your other kingdoms.

WaitWaitWha 4y ago

I cannot rely on Google. Too many times have I shifted to something by Google, to have them stop supporting it or completely shutting it down. I use Keepass/Keepass2Android for 2FA wherever possible.

cocacola1 4y ago

Lol I think I lost the only 2FA I had stored in Google Auth. It was for a RuneScape account I had for a decade plus, that I had long ago deleted the Gmail for. I had moved everything to another app and that was the only thing remained in Google Auth. It somehow survived transferring phones, too. I wonder how I’m gonna access that account now? Every time I’ve tried to change the email, I’ve been unsuccessful.

nhumrich 4y ago

Years ago, this might have mattered. But I have moved on. Now an authy user, and not sure why that should change.

nikolay 4y ago

Well, not yet - just installed it and... there's nothing.

nikolay 4y ago

One would be crazy to keep their passwords and 2FA with a company, which does not provide customer service (unless you pay for Google One, which still doesn't cover all of Google)! I know, it's bad to store both passwords and OTPs in one place, but 1Password does this for me smoothly, and I trust time orders of magnitude more than Google, so, no, Google, you're too late to the party, plus, you need to regain our trust, which seems impossible at this point!

bombcar 4y ago
Pro tip- when presented with an OTP QR code, you can read it with as many things as you want.
- kotatsuyaki 4y ago
  Except for Microsoft’s. It took me twenty minutes of trying to realize that they have their own non-standard QR codes, and that I had to click “use another authenticator app” to get a standard one.
tantalor 4y ago
What does customer service have to do with trust? Personally I would be a little weirded out if a customer service rep could access my account over the phone, especially in an account recovery situation where "I lost credentials oops".
- nikolay 4y ago
  Getting locked out and having nobody to talk to is a matter of trust!
  - tantalor 4y ago
    Sure but just because you can call them doesn't mean you can trust them.
    - 4y ago

shaggie76 4y ago

I find it curious that they're continuing to develop it; when I found that Authenticator wasn't a 2FA option for my google account I figured it had been abandoned.

sasas 4y ago

This is great, although Google decided there was malware on my iPhone. False positive? After following all the steps it asked, now when logging in to any google service, google throws an error making it impossible to log in to any google service on the phone. I haven’t done a factory reset as I don’t want to loose the google auth tokens. Catch 22.

lawrenceyan 4y ago

This would have been so useful three or four weeks ago. Good to have for the future I guess. Alas. Google is pretty on top of things in terms of service updates on products that have core adoption / pmf.

NoZebra120vClip 4y ago

It would seem that the "secrets roach motel" model was the most secure and sane option for Authenticator. In that way, it mimicks the Yubikey or other hardware TOTP keys, where the secrets go in but they can't come out. Everyone with a Yubikey knows that the secrets aren't coming out and they will need a backup. It would be foolhardy to rely on a Yubikey alone, when the risk model obviously entails loss or theft of the device itself. That's what paper codes are for. It would seem that the QR export, and now this account sync, is Google weakening security as a concession to intense end-user pressure. Yeah, it sucks to lose all your TOTP secrets at once; that's why you form a contingency plan and stow your paper backup or maintain a spare device.

batiudrami 4y ago
You are of course completely correct, but this is a letting perfect be the enemy of good situation. I lost my phone overseas (my backup code was at home) and losing access to everything was so annoying I turned 2FA off on my google account for years.
dvzk 4y ago
Yes. When TOTP debuted, it was aimed at and designed by security engineers. Keeping secrets on-device was and is correct for serious uses. Google Authenticator is a victim of its own popularity. Fortunately, the field moved on, and we now have WebAuthn and Passkeys for non-exportable private authentication keys.
- computerfriend 4y ago
  Sadly, WebAuthn is also becoming a victim in the same way (at least on iOS). The expectation is that WebAuthn private keys are stored in the secure enclave, which would be a comparable security guarantee to YubiKeys and other hardware devices. "Passkeys" are now forcibly synced via iCloud, you can't use WebAuthn on iOS without enabling iCloud Keychain.
  - dvzk 4y ago
    Huh, thanks, I wrongly assumed that Passkeys inherited WebAuthn’s attestations for hardware-backed keys. I guess organizations will need to ban Passkeys internally.

lopkeny12ko 4y ago

I had always thought that the lack of cloud synchronization was a deliberate security feature. If my TOTP secrets sync to the cloud, doesn't that defeat the entire point of 2FA? Now, instead of my physical device being the sole second factor for authentication, anyone who is able to breach/intercept/coerce someone at Google into divulging/etc the TOTP secrets from Google's cloud storage, my accounts are toast...

saddist0 4y ago
While I agree and wouldn't use this personally, I do have argument in favor of it. 1) Attack vector reduced to one account which you maintain with healthy hygiene, and hopefully don't use with public systems, etc. 2) You can keep backup 2FA for single account instead of keeping for N accounts.
wankle 4y ago
Agreed, it seems bizarre to me that any company especially Google would roll out something like this.

deleted 4y ago

[deleted]

rswail 4y ago

Microsoft Authenticator has had backup for ages. Uses iCloud on iOS and pre-encrypts the info.

pqs 4y ago

It is not clear to me if this will be by default and applied to everyone in the next update, or if I have to setup something.

smarnach 4y ago
Once the app is updated, you will be asked at the next app start. You can either choose a Google account to sync your TOTP secrets to, or you can continue without a Google account, in which case your secrets won't be synced.
- pqs 4y ago
  Thanks for the very informative comment.

rcarmo 4y ago

Only took them 13 years, and you can likely get locked out of that too if you loose access to your Google account. Anyone know if this includes any form of export?

NoZebra120vClip 4y ago

Is there a way to opt out of this? If I installed Authenticator on my Android phone, would it immediately and gratuitously sync everything to my account? Can I log out and stay logged out on the app so that it never syncs? If someone uses Chrome's password manager and Authenticator's TOTP, this seems to make account takeovers an exceptionally juicy prize. Capture a Google account and you've captured credentials and all necessary factors in one fell swoop. Well done, bravo. I mean, account takeover already means game over because you can read/send email, but the whole idea of device-based TOTP is to isolate it from anything with an attack surface.

timvdalen 4y ago

Haha, I just transferred them to a new device last week! I will say that the previous migration path was super simple as well. The old device generates a number of QR codes that the new device scans, in sequence.

anotherhue 4y ago

Two days later: Gmail spam detection auto deletes user's Google account and all of their synchronised keys. User looses their entire digital identity.

justinclift 4y ago

Of particular importance is the related article and HN thread about this: Article: "Google Authenticator cloud sync: Google can see the secrets, even while stored" - https://defcon.social/@mysk/110262313275622023 https://defcon.social/@mysk/110262313275622023 HN thread: https://news.ycombinator.com/item?id=35708869 https://news.ycombinator.com/item?id=35708869

AshLeece 4y ago

In case anyone sees this, someone found this: https://defcon.social/@mysk/110262313275622023 https://defcon.social/@mysk/110262313275622023 TL;DR don't use it as there is no encryption.