Live data from Hacker News

Warning: Google Authenticator upgrade loses all accounts

news.ycombinator.com

111–120 of 176 posts

Re: Warning: Google Authenticator upgrade loses all accounts

#111

Not an iPhone user, but I wonder if you could access the key data manually and restore it afterwards? On Android that's possible (if you have root....) by accessing the key database (sqlite in that case). I did that to duplicate the keys from my handset to my tablet.

Restoring from an iTunes backup should restore both the old version and the app data.

Re: Warning: Google Authenticator upgrade loses all accounts

#112
Unrelated to this particular snafu but still potentially problematic: if you have your Authenticator account named by its default name (foo@example.com) and you add another account with the same key, it will be blindly overwritten. I found this out the hard way after scanning my Meraki 2FA QR code that was tied to the same email that already had Google 2FA.

ProTip: rename your auth entry to something like "Gmail foo@example" to avoid this problem, whether malicious or accidental.

Re: Warning: Google Authenticator upgrade loses all accounts

#114
post #48
post #7

For those looking for Google Authenticator alternatives, I recommend either Duo Mobile from Duo Security or Authy. I ditched Google Authenticator a while ago and haven't missed it one bit -- having a single app manage my two-factor tokens / keys is much more convenient.

In light of this incident with GA, do either/any of the alternative support "export" of the underlying secrets, for instance to migrate to a new app?

You can store the key (the alternative to using a QR code) you're given to set up 2FA in the first place.

Re: Warning: Google Authenticator upgrade loses all accounts

#116

Chris Messina has a solution: https://twitter.com/chrismessina/status/375118991280205824

That's only good for Google accounts. Dropbox and others aren't reset as easily.

Dropbox has the option to add a backup SMS phone number in addition to offline TOTP code. Here are some other steps you can follow if your Google Auth app got wiped:

- https://www.dropbox.com/help/364/

Re: Warning: Google Authenticator upgrade loses all accounts

#117

When I add sites to Authenticator, I take a screenshot of the QR code and tuck it away in an encrypted document (OneNote for the record, which uses uses AES to encrypt).

Have you tested this? Are the barcodes not time pertinent?

Yes I have tested this and it works. Of course make sure those screenshots are safe and encrypted too.

Re: Warning: Google Authenticator upgrade loses all accounts

#118
I saw Google Authenticator had an update this morning and thought "haha, wouldn't it be awful if it deleted the accounts when I updated!" Well, I guess I'm the goat [1].

I was still signed into Google so that was easy enough to generate a new key, but I believe I'm going to have to use my backup number to get into Dropbox.

[1] http://en.wikipedia.org/wiki/Duck!_Rabbit,_Duck%21

Post reply on HN