21–30 of 139 posts
My Google Authenticator data survived me migrating to a different phone because my flow is: 1. Backup old phone using Titanium Backup. 2. Get new Android phone. 3. Root it. 4. Copy TB backup files from old phone to new. 5. Restore apps and data on new phone using Titanium Backup. Obviously it's not a procedure a normal user is expected to do...
I stopped using Google Authenticator in 2013 when my tokens disappeared after a software update [1]. They were restored in the next update, but I didn't like not having access to the raw TOTP data. I switched to Authy after the incident, and now use 1Password after I discovered their TOTP feature. [1] https://news.ycombinator.com/item?id=6325760
Strongly disagree with the premise of this article: - Passcode or biometric locks on an app are a gimmick and offer negligible value. - The keys not being backed up or or synchronised across devices is not a bug, but a feature. You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. - In particular, Authy, LastPass and 1password have a giant attack surface compar…
I agree with this comment completely. Adding a biometric lock would turn it into 3FA. Not sure if HN allows to plug your own apps, so please forgive: I made an app a while ago that aims to replace Google Authenticator for some of the reasons mentioned: it allows to back-up and transfer tokens without creating a large attack factor. Not having sync is a feature in this case as well. In fact, the app does not even have…
It is open source and allows you to export secrets to an encrypted file which you can copy around.
A bit more tedious than Authy and similar cloud sync solutions but lower attack surface and less tedious to back up than Google Authenticator.
Available on F-droid. Beware of Aegis knock-offs on Google Play Store that use similar name.
> Is it risky "centralizing" this data? Sure, but I don't see it any more risky as using a cloud-based password manager. Using a cloud-based password manager is a huge risk though. And if you've put both your passwords and your 2FA generators in the cloud, you now have single-factor authentication.
It is a real problem that a lot of people fail to understand why this is an issue.
Earlier quoted context omitted.
All my 2FA codes are backed up. On paper. I have a physically-secured cache of the QR codes which can be pretty quickly imported into a new app.
Do you trust the security of your printer when you print codes? They are historically one of the biggest attack surfaces.
Worst case, i doubt it would be that difficult to hand draw the qr codes on graph paper. Would be quite tedious, but they should be error correcting to some extent.
Use an alternative like andOTP or Authenticator Plus which allow you to backup your keys.
Strongly disagree with the premise of this article: - Passcode or biometric locks on an app are a gimmick and offer negligible value. - The keys not being backed up or or synchronised across devices is not a bug, but a feature. You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. - In particular, Authy, LastPass and 1password have a giant attack surface compar…
I feel you're letting perfect be the enemy of the good. The baseline isn't centralized 2FA. The baseline is not using 2FA at all. While you may be willing to accept usability trade-offs associated with the lack of synchronization, a lot of people aren't. We shouldn't let better security be accessible only to tech-savvy people.
Earlier quoted context omitted.
All my 2FA codes are backed up. On paper. I have a physically-secured cache of the QR codes which can be pretty quickly imported into a new app.
Do you trust the security of your printer when you print codes? They are historically one of the biggest attack surfaces.