Live data from Hacker News

Warning: Google Authenticator upgrade loses all accounts

news.ycombinator.com

71–80 of 176 posts

Re: Warning: Google Authenticator upgrade loses all accounts

#71
post #64

To disable auto-update on recent Android: Play Store -> Search "Authenticator" -> Select "Google Authenticator" -> Press "Menu" -> Deselect "Auto-update"

I don't think this is happening on Android, seems to be an issue with an iOS update.

I think this is a good reminder to use the auto-update feature wisely, on all platforms.

Re: Warning: Google Authenticator upgrade loses all accounts

#72
post #40
post #32

What does it mean that it 'loses all accounts'? I use two factor auth but not this app, so I am not sure why people are going to have such a bad day...

You get greeted by a "let's begin" screen, and all your accounts/credentials have magically gone away. This happened to me 5 minutes ago. Edit: tweet with picture: https://twitter.com/jawj/status/375144792126410752

So your account has not gone away, nor has it been deleted, nor has any magic happened; your account is still there safe and sound on Google's servers, it's just that the settings in this one mobile app have been wiped, correct?

Re: Warning: Google Authenticator upgrade loses all accounts

#73
post #7

For those looking for Google Authenticator alternatives, I recommend either Duo Mobile from Duo Security or Authy. I ditched Google Authenticator a while ago and haven't missed it one bit -- having a single app manage my two-factor tokens / keys is much more convenient.

I switched to HDE-OTP[0] a while ago and never looked back. I've not encountered any bugs with it and it's also better looking.

[0]https://itunes.apple.com/gb/app/hde-otp-generator/id57124032...

Re: Warning: Google Authenticator upgrade loses all accounts

#74

I cannot fathom why people still rely on Google for their core business needs. At my last place of work I built an SMS system to be used as the second factor in the intranet login. I _could_ have used a 3rd party 2FA, but the most _logical_ reason to have our own system was ... well.. we didn't want to rely on anyone except ourselves. Didn't take me long and the most difficult part was finding enough USB-connected ph…

> didn't want to rely on anyone except ourselves.

And the remarkably secure telecom system, of course.

Google's style of 2FA is IMO technologically superior in that there is no communication after the initial seed. It also appears to be somewhat standardized -- see others posting about Authy. You could have your own handwritten program running the algorithm if you wanted to be independent.

The real screw up on Google's part is not instructing users to have an encrypted backup of their 2FA data.

Re: Warning: Google Authenticator upgrade loses all accounts

#75
post #25
post #12

If they had released this two weeks later, iOS 7's auto-update feature would have bricked everyone's accounts. Google Auth 2.0 redefines two-factor auth: something you know + something you DON'T have. Their entire purpose in life is this second part and they completely and absolutely botched it. I can't believe this passed testing at both Google and Apple. There wasn't even a warning in the release notes.

>There wasn't even a warning in the release notes Do you think they would have released it if they knew about it?

This isn't addressing the (obviously rhetorical) question of whether they knew in advance, but now that they do know, fwiw:

They have the ability to yank the updated version any time, 24/7, at a moment's notice, until a fix is available.

They also have the ability to update the release notes after the fact.

Re: Warning: Google Authenticator upgrade loses all accounts

#76
post #75
post #25

Earlier quoted context omitted.

>There wasn't even a warning in the release notes Do you think they would have released it if they knew about it?

This isn't addressing the (obviously rhetorical) question of whether they knew in advance, but now that they do know, fwiw: They have the ability to yank the updated version any time, 24/7, at a moment's notice, until a fix is available. They also have the ability to update the release notes after the fact.

They have the ability to yank the updated version any time, 24/7, at a moment's notice, until a fix is available.

Not when iTunes Connect is down for maintenance, they don't. Worst possible timing.

Re: Warning: Google Authenticator upgrade loses all accounts

#77

Authy (YC W12, [1]) is a nice replacement for the GA app. Besides being more stable, it has also the "benefit" of allowing you to back up your keys, and recover in the case of a lost phone or deleted app. Thankfully, backing up is entirely optional, and turned off by default. While they claim backups are encrypted with PBKDF2 [3], I still would never ever use something that sends my tokens to a remote server, as it'd…

What do you guys do that duosec doesn't?

Re: Warning: Google Authenticator upgrade loses all accounts

#78
post #72
post #40

Earlier quoted context omitted.

You get greeted by a "let's begin" screen, and all your accounts/credentials have magically gone away. This happened to me 5 minutes ago. Edit: tweet with picture: https://twitter.com/jawj/status/375144792126410752

So your account has not gone away, nor has it been deleted, nor has any magic happened; your account is still there safe and sound on Google's servers, it's just that the settings in this one mobile app have been wiped, correct?

Without the settings in your authenticator you're locked out of accounts that require a 2-factor token from it, unless you've got backup tokens printed out.

Re: Warning: Google Authenticator upgrade loses all accounts

#79
post #72
post #40

Earlier quoted context omitted.

You get greeted by a "let's begin" screen, and all your accounts/credentials have magically gone away. This happened to me 5 minutes ago. Edit: tweet with picture: https://twitter.com/jawj/status/375144792126410752

So your account has not gone away, nor has it been deleted, nor has any magic happened; your account is still there safe and sound on Google's servers, it's just that the settings in this one mobile app have been wiped, correct?

Yes, but this is the mobile app that lets you log into your account on Google.

Re: Warning: Google Authenticator upgrade loses all accounts

#80
post #72
post #40

Earlier quoted context omitted.

You get greeted by a "let's begin" screen, and all your accounts/credentials have magically gone away. This happened to me 5 minutes ago. Edit: tweet with picture: https://twitter.com/jawj/status/375144792126410752

So your account has not gone away, nor has it been deleted, nor has any magic happened; your account is still there safe and sound on Google's servers, it's just that the settings in this one mobile app have been wiped, correct?

[deleted]
Post reply on HN