10 ms·

I remember pushing for this when i was at Google ~5 years ago. I wasn't on the team but I wrote 2 proposals, one to do QR code export and imports and another to

I remember pushing for this when i was at Google ~5 years ago. I wasn't on the team but I wrote 2 proposals, one to do QR code export and imports and another to sync codes using the google backup framework. Neither was approved nor denied, just in limbo. But nice to see that both features have finally shipped. Sadly I have switched away to 1P, too much effort to move it all back.

briffle 3y ago
> Sadly I have switched away to 1P, too much effort to move it all back. It seems like a very, very bad thing to store both your passwords, and TOTP codes in the same tool...
- bdcravens 3y ago
  I agree, and I'm a huge 1Password fan. I use Authy instead, which also backs up TOTPs. I'm also having the same thoughts about Google Auth: my email (Gmail) is a big target for gaining access to the rest of my digital life, and putting 2FA in the same hands seems risky. I'd need to do more evaluation to consider leaving Authy.
- psanford 3y ago
  The main point of TOTP is that users passwords are mostly weak and reused across sites. TOTP protects those users from password stuffing and similar attacks. If you are using a strong random password generated from 1PW you've already mitigated against that threat. TOTP isn't buying you much additional security. So for most folks it is just fine to store you TOTP seed in 1PW. Unlike TOTP, passkeys _do_ buy you additional security in their phishing resistance. So you should always prefer passkeys/fido2 keys to TOTP if that is an option. Its still fine for most users to use 1PW as your passkey storage.
  - xyzzy_plugh 3y ago
    Furthermore the risk exposure to using TOTO in 1pw is almost insignificant. You can configure your 1password account to require 2FA when setting up new devices, and unlike Google here the decryption requires manual knowledge not shared with the cloud. The only argument I can imagine is that if someone gets ahold of your phone it's either locked and they can unlock it or it's unlocked, in which case either your 1pw account and/or other TOTP apps are either locked or unlocked. In the worst case scenario where everything is unlocked, having a separate app is negligible. Besides, AFAIK Google Authenticator doesn't require additional unlock steps, unlike authy or 1password. You're better off worrying about how to avoid TOTP and securing 1password than about having TOTP codes stored alongside your passwords.
  - tasuki 3y ago
    > If you are using a strong random password generated from 1PW you've already mitigated against that threat. TOTP isn't buying you much additional security. Why isn't TOTP buying much additional security? It seems to me that apart from password reuse it's mitigating many other potential problems: keyloggers leaking passwords from your device, passwords leaking from the authenticating server, etc.
    - lll-o-lll 3y ago
      Totp seeds leak from servers just as easily as passwords do.
      - computerfriend 3y ago
        One way passwords leak from servers is when they're being inappropriately logged (like at the POST-level), which is not going to happen for TOTP seeds.
        lll-o-lll 3y ago
        True enough. However, unlike a password, you can’t take a hash of it and thus reduce the consequence of exposure. It’s just another shared secret, albeit one that doesn’t rely on the fallibility of human creation. The only good solution is WebAuthn and related technologies (phone passkeys for disaster recovery), so that server side needs nothing more than a public key.
    - tedd4u 3y ago
      Not exactly the question you asked but one reason FIDO/Ubikey provides more protection than TOTP is that it won't send codes to the wrong website. If you're being phished skillfully, and don't notice the URL is wrong, you're protected in that way. If you use TOTP you have to verify the URL manually.
  - Takennickname 3y ago
    It literally protects you from key loggers. Isn't that important?
    - psanford 3y ago
      In practice, no. Key loggers are a minuscule threat to account security compared to weak passwords and password reuse. But lets say you are in fact a user that gets targeted by an adversary capable of deploying a key logger against you. Does TOTP protect you? No! If you are compromised to that point, the attacker is also in a position to just hijack your sessions. There isn't a threat model out there that is trying to solve the problem of "my end user device has been compromised but I still want to be able to use it to access sensitive systems without those systems being compromised."
      - hirsin 3y ago
        Token binding was the closest we had - still lets a compromised endpoint in the right position steal and use the tokens from that device, but it's at least not persistent.
      - Takennickname 3y ago
        True
      - NoZebra120vClip 3y ago
        Keyloggers may not threaten people who habitually use personal devices, but I can see them still looming large for those who rely on public computers, in libraries, schools, coworking spaces, etc. YMMV.
- r00fus 3y ago
  As a former Google Auth user, who bungled my own phone migration a few years ago - yeah, defense in depth is better but at the time, I was furious there was no way to recover my Google Auth and I had to go to every single service and reset my 2FA. Storing both on 1Pass is not as secure, but the option is that once in a while you misstep and spend a week restoring TOTP setup (or lose entire accounts because your service provider has no functional customer support) then I'm amenable to stable but less secure options.
- nighthawk454 3y ago
  Eh, it's still better than not having it. Which is likely the bar for a lot of casual users. Mostly the goal is to prevent password reuse I think, which comes down to convenience. And unless 1pass gets hacked (which could happen! see: LastPass) it's relatively secure for that purpose.
- roopakv 3y ago
  Very true, however as others have pointed out it all comes down to levels of security. There are many non important accounts where I have 2FA, and both the password and the TOTP is in 1p. This should suffice for any brute force password attacks. However there are some accounts (like google) which one can consider more important for which I keep the TOTP on a separate app like Authy. More recently I've been switching to yubikeys where possible.
- unethical_ban 3y ago
  I'm more concerned about the one tool being cloud-based than anything. I keep my 2fa backup codes in my Keepass safe. Where else will I keep them?
- jwr 3y ago
  > It seems like a very, very bad thing to store both your passwords, and TOTP codes in the same tool Yes. It defeats the purpose. But whenever you mention it, you will get lots of replies with plenty of hand-waving why this is still better and why it doesn't matter "much". If you go to the effort of doing 2FA, do it right. Two Yubikeys, and a reasonably decent TOTP app (Authy qualifies as "reasonable") for those sites that do TOTP.
et-al 3y ago
fwiw, Google Authenticator starting with 3.1.0 started supporting exports via QR code.
- nonfamous 3y ago
  Yeah, but only as a means of transferring them to another device. Sure, you could abort the flow before the existing codes were deleted, but it was far from ideal. I’m glad there’s finally real support for backing up codes.
  - mgbmtl 3y ago
    Hmm no, I use this from time to time, and it really is just a way to copy the codes to another device. It won't delete them from the original device. It notifies the device owner after a few minutes that the TOTP have been exported, and it keeps a log of exports. I'm in the process of moving to Aegis. It's FOSS, encrypts the file on the device, and supports the biometric lock. It can do a daily backup to a few sources, including the Google backup (I think) and personally I dump it to a folder that my Nexcloud will automatically upload to my personal server.
  - ClassyJacket 3y ago
    It doesn't delete them from the existing device. However, it exports them via qr code, which it prevents you from screenshotting, meaning you can never factory reset your phone or protect yourself from theft or loss. You can only transfer to another phone when you have both devices working at the same time.
    - account42 3y ago
      How does a QR code prevent screenshotting?
      - bberrry 3y ago
        Apps can set a flag disallowing screenshots by the operating system
neves 3y ago
QR code export is an old feature. I have an Android emulator in my desktop justo to have backup of my codes.
adrr 3y ago
That was worst thing about google Authenticator was migrating to another device and amount of support my IT team had to deal with people upgrading phones. I can’t believe how long it took for an export feature.
- admn2 3y ago
  Yeah, I switched away from Google for this reason. Pretty wild to think of the implications of losing your phone and having no backup. Even switching phones required resettings all your codes. Authy is a mess, but at least had this functionality when they were still actively worked on.
- princevegeta89 3y ago
  All you need is the OTP secret. I have all of mine stored in my bitwarden. I can plug and play them in any supporting app to keep generating the 2fa codes.
Gareth321 3y ago
Years ago I got FUCKED when I used Authenticator and bought a new phone. I just assumed everything would be backed up to iCloud, like everything else. I lost access to accounts which were almost impossible to retrieve. Millions of people have been screwed thus, turning people away from 2FA. I can't believe it has taken this long to enable sync.
- pkaye 3y ago
  Why couldn't you use your old phone to get access and switch over?
  - nness 3y ago
    If you damage your Android screen it is basically useless unless you have pre-emptively set up some kind of remote access process... Twice I've had to spend hours manually resetting/renabling my 2FA after a phone was damaged, and sans buying a new screen just to get a backup of the phone, there aren't many other options. (Similarly, this was the time I learnt that the UK gov does not issue backup codes for their 2FA and you just have to spend 45 mins on hold to have them reset it for you.)
    - TeMPOraL 3y ago
      Exactly this. I bought my current phone after I dropped my previous one and cracked its screen. I was only able to recover access to critical services because I have previously set up some Tasker automation connected to my Pebble watch, which enabled me to navigate the phone "in the dark" enough to turn on AirDroid, allowing me to screen-mirror the phone to the PC. Of course, all the 2FA tools have this stupid idea of blacking the screen when it's being mirrored - but fortunately, I was able to turn on USB debugging this way, at which point I plugged the phone in and used scrcpy to show a fat middle finger to Google and plain recover everything from Authenticator.
      - dcchambers 3y ago
        Now imagine trying to explain this to anyone outside of the tech industry. I imagine only a small percentage of software engineers and IT folks in general would be able to accomplish what you did. How easy it is to accidentally fuck yourself over with app-based 2FA is one reason I've been hesitant to recommend it to my non tech savvy friends and family. While SMS 2FA is a lot less secure, it's at least pretty much idiot-proof.
ClassyJacket 3y ago
I would've even been happy if they didn't block you from screenshotting the QR export code. This has caused me so much pain over the years but nope, they refuse to change it. This basically means you can never factory reset your phone without someone else using their phone to help you, which means you're forced to share your entire account and all your codes with a third party who might keep them forever. You also can't preemptively back it up in case your phone is stolen or lost. But nope, Google thinks they know best and in 2023 they still actively block you from keeping your accounts safe. It's mad.
- tzs 3y ago
  You can go to a place that has self-service photocopiers and copy the QR code(s) from the export screen(s) to paper that way. I just tested this using the copy function of my Brother printer/scanner, and my phone was able to successfully import from the printed export code. I've only got 4 accounts in Google Authenticator (because I only have it because I wanted to help someone else once who was using it figure out something). The more accounts you have the denser the QR code will be, so it is possible that you might have to split the export into multiple passes with this method if you have a lot of accounts.

briffle 3y ago

> Sadly I have switched away to 1P, too much effort to move it all back. It seems like a very, very bad thing to store both your passwords, and TOTP codes in the same tool...

bdcravens 3y ago
I agree, and I'm a huge 1Password fan. I use Authy instead, which also backs up TOTPs. I'm also having the same thoughts about Google Auth: my email (Gmail) is a big target for gaining access to the rest of my digital life, and putting 2FA in the same hands seems risky. I'd need to do more evaluation to consider leaving Authy.
psanford 3y ago
The main point of TOTP is that users passwords are mostly weak and reused across sites. TOTP protects those users from password stuffing and similar attacks. If you are using a strong random password generated from 1PW you've already mitigated against that threat. TOTP isn't buying you much additional security. So for most folks it is just fine to store you TOTP seed in 1PW. Unlike TOTP, passkeys _do_ buy you additional security in their phishing resistance. So you should always prefer passkeys/fido2 keys to TOTP if that is an option. Its still fine for most users to use 1PW as your passkey storage.
- xyzzy_plugh 3y ago
  Furthermore the risk exposure to using TOTO in 1pw is almost insignificant. You can configure your 1password account to require 2FA when setting up new devices, and unlike Google here the decryption requires manual knowledge not shared with the cloud. The only argument I can imagine is that if someone gets ahold of your phone it's either locked and they can unlock it or it's unlocked, in which case either your 1pw account and/or other TOTP apps are either locked or unlocked. In the worst case scenario where everything is unlocked, having a separate app is negligible. Besides, AFAIK Google Authenticator doesn't require additional unlock steps, unlike authy or 1password. You're better off worrying about how to avoid TOTP and securing 1password than about having TOTP codes stored alongside your passwords.
- tasuki 3y ago
  > If you are using a strong random password generated from 1PW you've already mitigated against that threat. TOTP isn't buying you much additional security. Why isn't TOTP buying much additional security? It seems to me that apart from password reuse it's mitigating many other potential problems: keyloggers leaking passwords from your device, passwords leaking from the authenticating server, etc.
  - lll-o-lll 3y ago
    Totp seeds leak from servers just as easily as passwords do.
    - computerfriend 3y ago
      One way passwords leak from servers is when they're being inappropriately logged (like at the POST-level), which is not going to happen for TOTP seeds.
      - lll-o-lll 3y ago
        True enough. However, unlike a password, you can’t take a hash of it and thus reduce the consequence of exposure. It’s just another shared secret, albeit one that doesn’t rely on the fallibility of human creation. The only good solution is WebAuthn and related technologies (phone passkeys for disaster recovery), so that server side needs nothing more than a public key.
  - tedd4u 3y ago
    Not exactly the question you asked but one reason FIDO/Ubikey provides more protection than TOTP is that it won't send codes to the wrong website. If you're being phished skillfully, and don't notice the URL is wrong, you're protected in that way. If you use TOTP you have to verify the URL manually.
- Takennickname 3y ago
  It literally protects you from key loggers. Isn't that important?
  - psanford 3y ago
    In practice, no. Key loggers are a minuscule threat to account security compared to weak passwords and password reuse. But lets say you are in fact a user that gets targeted by an adversary capable of deploying a key logger against you. Does TOTP protect you? No! If you are compromised to that point, the attacker is also in a position to just hijack your sessions. There isn't a threat model out there that is trying to solve the problem of "my end user device has been compromised but I still want to be able to use it to access sensitive systems without those systems being compromised."
    - hirsin 3y ago
      Token binding was the closest we had - still lets a compromised endpoint in the right position steal and use the tokens from that device, but it's at least not persistent.
    - Takennickname 3y ago
      True
    - NoZebra120vClip 3y ago
      Keyloggers may not threaten people who habitually use personal devices, but I can see them still looming large for those who rely on public computers, in libraries, schools, coworking spaces, etc. YMMV.
r00fus 3y ago
As a former Google Auth user, who bungled my own phone migration a few years ago - yeah, defense in depth is better but at the time, I was furious there was no way to recover my Google Auth and I had to go to every single service and reset my 2FA. Storing both on 1Pass is not as secure, but the option is that once in a while you misstep and spend a week restoring TOTP setup (or lose entire accounts because your service provider has no functional customer support) then I'm amenable to stable but less secure options.
nighthawk454 3y ago
Eh, it's still better than not having it. Which is likely the bar for a lot of casual users. Mostly the goal is to prevent password reuse I think, which comes down to convenience. And unless 1pass gets hacked (which could happen! see: LastPass) it's relatively secure for that purpose.
roopakv 3y ago
Very true, however as others have pointed out it all comes down to levels of security. There are many non important accounts where I have 2FA, and both the password and the TOTP is in 1p. This should suffice for any brute force password attacks. However there are some accounts (like google) which one can consider more important for which I keep the TOTP on a separate app like Authy. More recently I've been switching to yubikeys where possible.
unethical_ban 3y ago
I'm more concerned about the one tool being cloud-based than anything. I keep my 2fa backup codes in my Keepass safe. Where else will I keep them?
jwr 3y ago
> It seems like a very, very bad thing to store both your passwords, and TOTP codes in the same tool Yes. It defeats the purpose. But whenever you mention it, you will get lots of replies with plenty of hand-waving why this is still better and why it doesn't matter "much". If you go to the effort of doing 2FA, do it right. Two Yubikeys, and a reasonably decent TOTP app (Authy qualifies as "reasonable") for those sites that do TOTP.

et-al 3y ago

fwiw, Google Authenticator starting with 3.1.0 started supporting exports via QR code.

nonfamous 3y ago
Yeah, but only as a means of transferring them to another device. Sure, you could abort the flow before the existing codes were deleted, but it was far from ideal. I’m glad there’s finally real support for backing up codes.
- mgbmtl 3y ago
  Hmm no, I use this from time to time, and it really is just a way to copy the codes to another device. It won't delete them from the original device. It notifies the device owner after a few minutes that the TOTP have been exported, and it keeps a log of exports. I'm in the process of moving to Aegis. It's FOSS, encrypts the file on the device, and supports the biometric lock. It can do a daily backup to a few sources, including the Google backup (I think) and personally I dump it to a folder that my Nexcloud will automatically upload to my personal server.
- ClassyJacket 3y ago
  It doesn't delete them from the existing device. However, it exports them via qr code, which it prevents you from screenshotting, meaning you can never factory reset your phone or protect yourself from theft or loss. You can only transfer to another phone when you have both devices working at the same time.
  - account42 3y ago
    How does a QR code prevent screenshotting?
    - bberrry 3y ago
      Apps can set a flag disallowing screenshots by the operating system

neves 3y ago

QR code export is an old feature. I have an Android emulator in my desktop justo to have backup of my codes.

adrr 3y ago

That was worst thing about google Authenticator was migrating to another device and amount of support my IT team had to deal with people upgrading phones. I can’t believe how long it took for an export feature.

admn2 3y ago
Yeah, I switched away from Google for this reason. Pretty wild to think of the implications of losing your phone and having no backup. Even switching phones required resettings all your codes. Authy is a mess, but at least had this functionality when they were still actively worked on.
princevegeta89 3y ago
All you need is the OTP secret. I have all of mine stored in my bitwarden. I can plug and play them in any supporting app to keep generating the 2fa codes.

Gareth321 3y ago

Years ago I got FUCKED when I used Authenticator and bought a new phone. I just assumed everything would be backed up to iCloud, like everything else. I lost access to accounts which were almost impossible to retrieve. Millions of people have been screwed thus, turning people away from 2FA. I can't believe it has taken this long to enable sync.

pkaye 3y ago
Why couldn't you use your old phone to get access and switch over?
- nness 3y ago
  If you damage your Android screen it is basically useless unless you have pre-emptively set up some kind of remote access process... Twice I've had to spend hours manually resetting/renabling my 2FA after a phone was damaged, and sans buying a new screen just to get a backup of the phone, there aren't many other options. (Similarly, this was the time I learnt that the UK gov does not issue backup codes for their 2FA and you just have to spend 45 mins on hold to have them reset it for you.)
  - TeMPOraL 3y ago
    Exactly this. I bought my current phone after I dropped my previous one and cracked its screen. I was only able to recover access to critical services because I have previously set up some Tasker automation connected to my Pebble watch, which enabled me to navigate the phone "in the dark" enough to turn on AirDroid, allowing me to screen-mirror the phone to the PC. Of course, all the 2FA tools have this stupid idea of blacking the screen when it's being mirrored - but fortunately, I was able to turn on USB debugging this way, at which point I plugged the phone in and used scrcpy to show a fat middle finger to Google and plain recover everything from Authenticator.
    - dcchambers 3y ago
      Now imagine trying to explain this to anyone outside of the tech industry. I imagine only a small percentage of software engineers and IT folks in general would be able to accomplish what you did. How easy it is to accidentally fuck yourself over with app-based 2FA is one reason I've been hesitant to recommend it to my non tech savvy friends and family. While SMS 2FA is a lot less secure, it's at least pretty much idiot-proof.

ClassyJacket 3y ago

I would've even been happy if they didn't block you from screenshotting the QR export code. This has caused me so much pain over the years but nope, they refuse to change it. This basically means you can never factory reset your phone without someone else using their phone to help you, which means you're forced to share your entire account and all your codes with a third party who might keep them forever. You also can't preemptively back it up in case your phone is stolen or lost. But nope, Google thinks they know best and in 2023 they still actively block you from keeping your accounts safe. It's mad.

tzs 3y ago
You can go to a place that has self-service photocopiers and copy the QR code(s) from the export screen(s) to paper that way. I just tested this using the copy function of my Brother printer/scanner, and my phone was able to successfully import from the printed export code. I've only got 4 accounts in Google Authenticator (because I only have it because I wanted to help someone else once who was using it figure out something). The more accounts you have the denser the QR code will be, so it is possible that you might have to split the export into multiple passes with this method if you have a lot of accounts.