5 ms·

Google Authenticator is not iOS 7 compatible, will erase your tokens

40 points by benguild 13y ago

37prime 13y ago
Google Authenticator Version: 1.1.4.755, last updated: Jul 19, 2011. I’m assuming that there are a lot of under the hood changes in iOS 7. It is up to Google to update Google Authenticator so it would be compatible with iOS 7. Then again, iOS 7 is still in beta.
hippee-lee 13y ago
It's been working fine for me. First and second beta images that have been pushed.
- dan1234 13y ago
  Works fine for me, too (beta 3 on iPhone 4S, iPhone 5, iPad 3). Not the best looking app in the world, though!
- benguild 13y ago
  It works until it breaks, just FYI. I would switch to another App. I had been using it until tonight but after touching the add button, I rebooted my device and found that several tokens were missing. Upon rebooting the App again, they were all gone.
- zuppy 13y ago
  The account labels are missing, which is a problem if you have multiple accounts.
  - benguild 13y ago
    Yes, and if you try to edit them, it will wipe out the other tokens.
Watabou 13y ago
FWIW, I use "HDE OTP" (https://itunes.apple.com/us/app/hde-otp-generator/id571240327?mt=8 https://itunes.apple.com/us/app/hde-otp-generator/id57124032...), which works pretty well for my google and dropbox account. It works on iOS7 and it looks better.
flyt 13y ago
DuoSec's iOS app replaced the never-updated Google Authenticator app for me after they added support for third-party token generation. It even works with QR-code scanning, just like the Google App. The advantage here is obvious: it's an app that is a primary business concern for a security-focused company. It's unlikely it'll go out of date as long as Duo is around. https://blog.duosecurity.com/2012/11/announcing-two-factor-authenticaton-for-third-party-accounts/ https://blog.duosecurity.com/2012/11/announcing-two-factor-a...
- stock_toaster 13y ago
  I use Duo as well. The only thing I miss is a countdown timer.
- mseebach 13y ago
  Never mind that the Google Authenticator app does get updated, why would it be suspect that it wasn't? Since when did it become a mark of quality that something changes constantly? It's sole purpose in life is to run a well-defined, never-changing calculation and display a 6 digit number on the screen. Not changing is absolutely preferred here.
  - kalleboo 13y ago
    It's not confidence-inspiring when an app you use is missing both retina graphics and iPhone 5 support.
    - rdl 13y ago
      And if a security bug did pop up, I'd sure rather bet on Duo, Authy, etc. fixing their app quickly than Google doing so, given that I don't think anyone is actually on the Authenticator team. I'm sure someone within Google would consider it a high priority to fix, but it wouldn't be as easy for them to quickly address something.
      - icebraining 13y ago
        What kind of security bug? The only thing the program should need is a secure place to store the tokens - which I expect is provided by Android, no? - and to read the time from the system. It shouldn't be exposed to anything else.
Soliah 13y ago
I've been using Authy[1] without any problems on iOS7. Great thing is that it can also be used for other services that use OTP (AWS, Cloudflare, Facebook etc). [1] https://www.authy.com/ https://www.authy.com/
- shinratdr 13y ago
  Count me as another vote for Authy. One more amazing feature: Your tokens stick to your Authy account instead of your physical device. If you need to restore your phone or delete the app, you don't need to disable two-factor on all your accounts and then set it up again. Just reinstall Authy, reauthorize with your Authy account, and you're done! Helped me countless times, from when I had to rebuild my iOS install because of a backup problem to when I got a replacement device due to a hardware issue.
  - oakwhiz 13y ago
    Doesn't giving the device keys to a third party, while also authenticating using a password with that third party, sort of defeat the whole purpose of two-factor authentication?
    - acchow 13y ago
      Yes. Unfortunately, their marketing is highly convincing. Most people (even most engineers) won't realize the tradeoff here: Authy replaces "two factor authorization" with "two password authorization". It should be clear which is more secure. The "two factors" with GA are a knowledge factor (something you know - your password) and a possession factor (something you have - your phone number for SMS or phone for GA app). See also https://en.wikipedia.org/wiki/Multi-factor_authentication https://en.wikipedia.org/wiki/Multi-factor_authentication
      - _djo_ 13y ago
        Although using Authy's backup service is optional and the app works just fine with local-only storage and no Authy account, which is how I have it set up.
harshreality 13y ago
Google doesn't take updating their Authenticator app seriously, even the android version. But why is it deleting the tokens? Can anyone who does iOS development comment?
- mkuhn 13y ago
  Regarding Android that is just not true. The last update is from July 18 [1] and the App gets updated frequently and for me it has worked flawlessly. A while back the Authenticator was not updated automatically but you were asked to switch to a new App [2]. Maybe that happened to you. [1] https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en https://play.google.com/store/apps/details?id=com.google.and... [2] https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator&hl=en https://play.google.com/store/apps/details?id=com.google.and...
  - harshreality 13y ago
    App updates do not imply the app is being adequately maintained. https://code.google.com/p/google-authenticator/issues/detail?id=118 https://code.google.com/p/google-authenticator/issues/detail... If that's your idea of a maintained app, I think we have differing ideas of what that means. Users with more totp tokens than will fit on one screen tend to ditch google authenticator because of that issue.
- tiziano88 13y ago
  the android app gets updated more often than I would expect actually
peterkelly 13y ago
I'm not sure why this is on the front page. iOS 7 is still in beta, and there's still quite a lot of bugs in it (hence... beta). Google maps doesn't work either (it always reports a server connection error for me). I would assume that these are problems with iOS 7, not the apps in question, since iOS should provide backwards compatibility. These bugs should be reported to Apple (ideally by Google or authors of other specific apps, who can narrow down exactly what's going on) so that Apple can fix whatever bug is causing the incorrect behaviour. A better title might have been "Current iOS 7 beta is not Google Authenticator compatible"
pearjuice 13y ago
So how big is the leap between iOS 6 and 7 exactly in terms of app compatibility? Did they do a major API overhaul and will we have to wait for every developer to port its app but also maintain backwards compatibility?

40 points by benguild 13y ago

Google Authenticator Version: 1.1.4.755, last updated: Jul 19, 2011. I’m assuming that there are a lot of under the hood changes in iOS 7. It is up to Google to update Google Authenticator so it would be compatible with iOS 7. Then again, iOS 7 is still in beta.

hippee-lee 13y ago

It's been working fine for me. First and second beta images that have been pushed.

dan1234 13y ago
Works fine for me, too (beta 3 on iPhone 4S, iPhone 5, iPad 3). Not the best looking app in the world, though!
benguild 13y ago
It works until it breaks, just FYI. I would switch to another App. I had been using it until tonight but after touching the add button, I rebooted my device and found that several tokens were missing. Upon rebooting the App again, they were all gone.
zuppy 13y ago
The account labels are missing, which is a problem if you have multiple accounts.
- benguild 13y ago
  Yes, and if you try to edit them, it will wipe out the other tokens.

Watabou 13y ago

FWIW, I use "HDE OTP" (https://itunes.apple.com/us/app/hde-otp-generator/id571240327?mt=8 https://itunes.apple.com/us/app/hde-otp-generator/id57124032...), which works pretty well for my google and dropbox account. It works on iOS7 and it looks better.

flyt 13y ago

DuoSec's iOS app replaced the never-updated Google Authenticator app for me after they added support for third-party token generation. It even works with QR-code scanning, just like the Google App. The advantage here is obvious: it's an app that is a primary business concern for a security-focused company. It's unlikely it'll go out of date as long as Duo is around. https://blog.duosecurity.com/2012/11/announcing-two-factor-authenticaton-for-third-party-accounts/ https://blog.duosecurity.com/2012/11/announcing-two-factor-a...

stock_toaster 13y ago
I use Duo as well. The only thing I miss is a countdown timer.
mseebach 13y ago
Never mind that the Google Authenticator app does get updated, why would it be suspect that it wasn't? Since when did it become a mark of quality that something changes constantly? It's sole purpose in life is to run a well-defined, never-changing calculation and display a 6 digit number on the screen. Not changing is absolutely preferred here.
- kalleboo 13y ago
  It's not confidence-inspiring when an app you use is missing both retina graphics and iPhone 5 support.
  - rdl 13y ago
    And if a security bug did pop up, I'd sure rather bet on Duo, Authy, etc. fixing their app quickly than Google doing so, given that I don't think anyone is actually on the Authenticator team. I'm sure someone within Google would consider it a high priority to fix, but it wouldn't be as easy for them to quickly address something.
    - icebraining 13y ago
      What kind of security bug? The only thing the program should need is a secure place to store the tokens - which I expect is provided by Android, no? - and to read the time from the system. It shouldn't be exposed to anything else.

Soliah 13y ago

I've been using Authy[1] without any problems on iOS7. Great thing is that it can also be used for other services that use OTP (AWS, Cloudflare, Facebook etc). [1] https://www.authy.com/ https://www.authy.com/

shinratdr 13y ago
Count me as another vote for Authy. One more amazing feature: Your tokens stick to your Authy account instead of your physical device. If you need to restore your phone or delete the app, you don't need to disable two-factor on all your accounts and then set it up again. Just reinstall Authy, reauthorize with your Authy account, and you're done! Helped me countless times, from when I had to rebuild my iOS install because of a backup problem to when I got a replacement device due to a hardware issue.
- oakwhiz 13y ago
  Doesn't giving the device keys to a third party, while also authenticating using a password with that third party, sort of defeat the whole purpose of two-factor authentication?
  - acchow 13y ago
    Yes. Unfortunately, their marketing is highly convincing. Most people (even most engineers) won't realize the tradeoff here: Authy replaces "two factor authorization" with "two password authorization". It should be clear which is more secure. The "two factors" with GA are a knowledge factor (something you know - your password) and a possession factor (something you have - your phone number for SMS or phone for GA app). See also https://en.wikipedia.org/wiki/Multi-factor_authentication https://en.wikipedia.org/wiki/Multi-factor_authentication
    - _djo_ 13y ago
      Although using Authy's backup service is optional and the app works just fine with local-only storage and no Authy account, which is how I have it set up.

harshreality 13y ago

Google doesn't take updating their Authenticator app seriously, even the android version. But why is it deleting the tokens? Can anyone who does iOS development comment?

mkuhn 13y ago
Regarding Android that is just not true. The last update is from July 18 [1] and the App gets updated frequently and for me it has worked flawlessly. A while back the Authenticator was not updated automatically but you were asked to switch to a new App [2]. Maybe that happened to you. [1] https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en https://play.google.com/store/apps/details?id=com.google.and... [2] https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator&hl=en https://play.google.com/store/apps/details?id=com.google.and...
- harshreality 13y ago
  App updates do not imply the app is being adequately maintained. https://code.google.com/p/google-authenticator/issues/detail?id=118 https://code.google.com/p/google-authenticator/issues/detail... If that's your idea of a maintained app, I think we have differing ideas of what that means. Users with more totp tokens than will fit on one screen tend to ditch google authenticator because of that issue.
tiziano88 13y ago
the android app gets updated more often than I would expect actually

peterkelly 13y ago

I'm not sure why this is on the front page. iOS 7 is still in beta, and there's still quite a lot of bugs in it (hence... beta). Google maps doesn't work either (it always reports a server connection error for me). I would assume that these are problems with iOS 7, not the apps in question, since iOS should provide backwards compatibility. These bugs should be reported to Apple (ideally by Google or authors of other specific apps, who can narrow down exactly what's going on) so that Apple can fix whatever bug is causing the incorrect behaviour. A better title might have been "Current iOS 7 beta is not Google Authenticator compatible"

pearjuice 13y ago

So how big is the leap between iOS 6 and 7 exactly in terms of app compatibility? Did they do a major API overhaul and will we have to wait for every developer to port its app but also maintain backwards compatibility?