4 ms·

Which only worked if you had both phones working at the same time... I'd bet a sizable portion of new phone enablements are due to losing the previous phone irr

by hirsin 3y ago

Which only worked if you had both phones working at the same time... I'd bet a sizable portion of new phone enablements are due to losing the previous phone irrevocably.

spear 3y ago
You'd save the QR code at the time you first used it on the old phone, and not wait for when you needed to transfer it. For me, I'd usually be on the desktop when setting up 2FA anyway, so I'd just save the QR code from the desktop browser ("Save image as ..."). When I needed to set up a new phone, I'd open the saved image on the desktop and point my phone at the screen.
- orev 3y ago
  It’s completely outside the realm of reality to expect “normal” people to do this. Most tech people don’t even do it.
- hackmiester 3y ago
  That's an absurd expectation. First of all, many users don't even have or use a computer. Of course, I personally do have one, but I'm often nowhere near one when I set up MFA on a new account. So then I guess I screenshot the QR code to my phone? But if I saved the image to my phone it gets stored in my photos backup anyway. Why would Authenticator not just back its own contents up, to that exact same spot, rather than me doing some crazy runaround that for some reason involves images?
- eviks 3y ago
  Why go through this trouble and risk forgetting and getting locked out when you can simply switch to a better app?
nanidin 3y ago
The QR code encodes the actual secret data for the TOTP, so backing up the QR code is sufficient. Screenshot -> Print is one backup method. Screenshot -> Encrypt -> Save to secure location is another method.
- daydream 3y ago
  Does that mean you need to take a new screenshot every time you add a new account?
  - nanidin 3y ago
    Yes, but for my threat model I avoid 2fa for accounts that don’t really need it so in practice I’m not adding accounts regularly.
semiotic1 3y ago
When doing a factory reset because of whatever reason, this becomes an issue as well. You cannot take screenshots of the bulk export QR-Code on Android because of FLAG_SECURE, so you need to work around that and take a photo of the screen with a different device to import from later. Also, as of last week, there existed an issue with special characters when trying to import and the app would just freeze or not recognize the QR code pattern at all, so you better had backups of all your secret keys. Both issues made me switch to Aegis and appreciate my past self backing up the secrets with KeePassXC.
- Helmut10001 3y ago
  I have long migrated to Aegis and it is pretty awesome. Backups. Copy & Paste. Encryption. Auto-upload to Nextcloud. Better Interface (with names!). etc.

by hirsin 3y ago

Which only worked if you had both phones working at the same time... I'd bet a sizable portion of new phone enablements are due to losing the previous phone irrevocably.

spear 3y ago

You'd save the QR code at the time you first used it on the old phone, and not wait for when you needed to transfer it. For me, I'd usually be on the desktop when setting up 2FA anyway, so I'd just save the QR code from the desktop browser ("Save image as ..."). When I needed to set up a new phone, I'd open the saved image on the desktop and point my phone at the screen.

orev 3y ago
It’s completely outside the realm of reality to expect “normal” people to do this. Most tech people don’t even do it.
hackmiester 3y ago
That's an absurd expectation. First of all, many users don't even have or use a computer. Of course, I personally do have one, but I'm often nowhere near one when I set up MFA on a new account. So then I guess I screenshot the QR code to my phone? But if I saved the image to my phone it gets stored in my photos backup anyway. Why would Authenticator not just back its own contents up, to that exact same spot, rather than me doing some crazy runaround that for some reason involves images?
eviks 3y ago
Why go through this trouble and risk forgetting and getting locked out when you can simply switch to a better app?

nanidin 3y ago

The QR code encodes the actual secret data for the TOTP, so backing up the QR code is sufficient. Screenshot -> Print is one backup method. Screenshot -> Encrypt -> Save to secure location is another method.

daydream 3y ago
Does that mean you need to take a new screenshot every time you add a new account?
- nanidin 3y ago
  Yes, but for my threat model I avoid 2fa for accounts that don’t really need it so in practice I’m not adding accounts regularly.

semiotic1 3y ago

When doing a factory reset because of whatever reason, this becomes an issue as well. You cannot take screenshots of the bulk export QR-Code on Android because of FLAG_SECURE, so you need to work around that and take a photo of the screen with a different device to import from later. Also, as of last week, there existed an issue with special characters when trying to import and the app would just freeze or not recognize the QR code pattern at all, so you better had backups of all your secret keys. Both issues made me switch to Aegis and appreciate my past self backing up the secrets with KeePassXC.

Helmut10001 3y ago
I have long migrated to Aegis and it is pretty awesome. Backups. Copy & Paste. Encryption. Auto-upload to Nextcloud. Better Interface (with names!). etc.