Google Authenticator did this to me once before, way back in 2013 [1].
After that, it was vaults that were easily exportable and backed up all the way (like most password managers).
Authy corrupted my 2FA backup and all I got was this lousy blogpost
11–20 of 28 posts
Re: Authy corrupted my 2FA backup and all I got was this lousy blogpost
#12Just got off Authy. They've done everything to trap customers into their broken platform, primarily by never allowing the user to export their tokens, either to file, or to another MFA application. They also stopped supporting their desktop app, forcing users back onto a single point of failure: the mobile app. If Twilio isn't going to support Authy in good faith, they should stop holding their remaining users hostag…
Most 2FA apps don't allow export for security reasons. I usually just re-generate all my TOTP keys manually. It's terribly painful, but I used to do it with every phone upgrade.
"Security reasons" is pretty insane, considering how easy it is to lose access to a good number of accounts if any 2FA app breaks from a bad update.
Google Authenticator has done this before too, way back in 2013: https://news.ycombinator.com/item?id=6325760
Re: Authy corrupted my 2FA backup and all I got was this lousy blogpost
#13Earlier quoted context omitted.
Most 2FA apps don't allow export for security reasons. I usually just re-generate all my TOTP keys manually. It's terribly painful, but I used to do it with every phone upgrade.
"Security reasons" is pretty insane, considering how easy it is to lose access to a good number of accounts if any 2FA app breaks from a bad update. Google Authenticator has done this before too, way back in 2013: https://news.ycombinator.com/item?id=6325760
It is indeed the very epitome of sanity, if you simply consider that the codes are secrets, and this entire practice is derived from having hardware dongles with secure enclaves, where secrets go in but never come out. It is the utmost in security when this one-way relationship is observed.
The ability to export secrets is an unfortunate compromise which vendors make for consumer markets. The MFA apps were not designed for exportability. If you own any Yubikeys you will know this. The whole idea is that this factor is "something you have", in other words, possession of the item containing your secret. An exported secret is no longer a secret, no longer something you have; it's just another password you're shuffling around.
The reason that you don't lose access to accounts when losing your MFA apps is that you took down the emergency backup codes and you committed them to paper, or some other durable medium, in a place where they can easily be accessed during a crisis. You did this scrupulously with each MFA activation, didn't you? Didn't you?
Re: Authy corrupted my 2FA backup and all I got was this lousy blogpost
#14I use KeePass as main TOTP app but migrated from Authy to Aegis (open source, great app) years ago which I use as sort of secondary backup, which also allows you to create backups and import/export data. I sync those off my phone using Syncthing. There is absolutely zero reason to use Authy for standard TOTP these days.
Re: Authy corrupted my 2FA backup and all I got was this lousy blogpost
#15Just got off Authy. They've done everything to trap customers into their broken platform, primarily by never allowing the user to export their tokens, either to file, or to another MFA application. They also stopped supporting their desktop app, forcing users back onto a single point of failure: the mobile app. If Twilio isn't going to support Authy in good faith, they should stop holding their remaining users hostag…
Most 2FA apps don't allow export for security reasons. I usually just re-generate all my TOTP keys manually. It's terribly painful, but I used to do it with every phone upgrade.
It's only a security issue if you don't secure the cloud storage that's used for backups.
Google Authenticator and some other 2FA apps allow the user to export their tokens to other apps so you don't need to redo TOTP on every website.
The most secure method is to only have tokens on the 2FA device and to avoid using TOTP backup/restore altogether (or manually copy the tokens on a secondary 2FA device). It's a tradeoff between security vs. convenience.
Re: Authy corrupted my 2FA backup and all I got was this lousy blogpost
#16Earlier quoted context omitted.
Most 2FA apps don't allow export for security reasons. I usually just re-generate all my TOTP keys manually. It's terribly painful, but I used to do it with every phone upgrade.
It's only a security issue if you don't secure the cloud storage that's used for backups. Google Authenticator and some other 2FA apps allow the user to export their tokens to other apps so you don't need to redo TOTP on every website. The most secure method is to only have tokens on the 2FA device and to avoid using TOTP backup/restore altogether (or manually copy the tokens on a secondary 2FA device). It's a tradeo…
Yeah, the iron triangle of security, convenience, and privacy rears it's ugly head again.
Re: Authy corrupted my 2FA backup and all I got was this lousy blogpost
#17Earlier quoted context omitted.
Most 2FA apps don't allow export for security reasons. I usually just re-generate all my TOTP keys manually. It's terribly painful, but I used to do it with every phone upgrade.
"Security reasons" is pretty insane, considering how easy it is to lose access to a good number of accounts if any 2FA app breaks from a bad update. Google Authenticator has done this before too, way back in 2013: https://news.ycombinator.com/item?id=6325760
Typically the way these codes are compromised is when they are stored in a non-HSM location like Google drive or transferred somehow. Then again, if you are just trying to keep people out of your Facebook account it's not a big deal. But if you are trying to keep people from financial accounts I wouldn't recommend transferring TOTP keys. Instead using a backup method like a printed out one time use sheet would be better.
Unfortunately most such websites use KBA or Text based authentication as a backup for TOTP so you may as well just stick it in Google drive.
Re: Authy corrupted my 2FA backup and all I got was this lousy blogpost
#18Earlier quoted context omitted.
"Security reasons" is pretty insane, considering how easy it is to lose access to a good number of accounts if any 2FA app breaks from a bad update. Google Authenticator has done this before too, way back in 2013: https://news.ycombinator.com/item?id=6325760
It is indeed the very epitome of sanity, if you simply consider that the codes are secrets , and this entire practice is derived from having hardware dongles with secure enclaves, where secrets go in but never come out. It is the utmost in security when this one-way relationship is observed. The ability to export secrets is an unfortunate compromise which vendors make for consumer markets. The MFA apps were not desig…
In an ideal world, I'd just use Yubikeys for everything. The problem is that it's not universally supported (or only supports a limited number of keys), so now I have a hodgepodge of 2FA app or Yubikeys or, even worse, phone/email 2FA.
The great thing about Yubikeys is that I can associate backup keys for accounts (when they are supported), so if I lose one key, I can deactivate the lost key and use a backup key in its place.
With heavily locked-down 2FA apps, I have to hope I can do a full recovery on a new device, or go through the recovery code process, or start all over again w/ new 2FA codes. If I'm lucky, the app allowed me to have it installed onto a backup device.
It's way more complicated that just swapping in a new Yubikey.
Re: Authy corrupted my 2FA backup and all I got was this lousy blogpost
#19Earlier quoted context omitted.
"Security reasons" is pretty insane, considering how easy it is to lose access to a good number of accounts if any 2FA app breaks from a bad update. Google Authenticator has done this before too, way back in 2013: https://news.ycombinator.com/item?id=6325760
Typically the way these codes are compromised is when they are stored in a non-HSM location like Google drive or transferred somehow. Then again, if you are just trying to keep people out of your Facebook account it's not a big deal. But if you are trying to keep people from financial accounts I wouldn't recommend transferring TOTP keys. Instead using a backup method like a printed out one time use sheet would be bet…
It sucks Yubikey (or other hardware based auth) isn't more prevalent in the financial/banking world. It helps mitigate a lot of types of attacks:
- No tokens to exfiltrate off a computer
- Avoids keylogger style attacks
- More durable than cell phones
That said, for people that have high amounts of money in certain accounts (> 1m), it might also present physical dangers (e.g. kidnapping, home invasion) for thieves attempting to get access to the hardware key.
Re: Authy corrupted my 2FA backup and all I got was this lousy blogpost
#20Earlier quoted context omitted.
Most 2FA apps don't allow export for security reasons. I usually just re-generate all my TOTP keys manually. It's terribly painful, but I used to do it with every phone upgrade.
It's only a security issue if you don't secure the cloud storage that's used for backups. Google Authenticator and some other 2FA apps allow the user to export their tokens to other apps so you don't need to redo TOTP on every website. The most secure method is to only have tokens on the 2FA device and to avoid using TOTP backup/restore altogether (or manually copy the tokens on a secondary 2FA device). It's a tradeo…
I think Microsoft Authenticator is the smartest right now because it's a "two-cloud" solution partly out of necessity, but also that seems a trustworthy architecture more generally. Since almost no one's phone runs Windows anymore, the raw app data backups "naturally" go to either iCloud or Google Drive. Then Microsoft keeps other (HSM) decryption keys in OneDrive. The threat model requires compromises of two clouds, so Microsoft Authenticator can be way more generous on how often and easily it backs up. It's an interesting point in the security vs. convenience tradeoff.