I actually built a tool that can do this from camera photos or screenshots. You know, for pentesting purposes :)
De-Googling TOTP Authenticator Codes
11–20 of 138 posts
Re: De-Googling TOTP Authenticator Codes
#12I wish there was a way to export my codes from Microsoft authenticator on iOS. If anyone knows of a way to do this, please feel free to reply. I would like to move to an open source solution.
I also have the same problem, however, I think Microsoft started to use some proprietary protocol wit some challenge / response scheme.
Re: De-Googling TOTP Authenticator Codes
#13To be clear, the point of storing a secret token on your phone and then typing over some codes that prove you have access to the secret still, is to provide 2FA. If you use oathtool on your laptop, and the password is stored there as well, you're back to 1FA
That can be fine if that's what you want, but if you wanted 2FA:
- FreeOTP: https://f-droid.org/packages/org.fedorahosted.freeotp
- someone forked that and called it FreeOTP+: https://f-droid.org/packages/org.liberty.android.freeotpplus
- FreeOTP again but from the dark side of the internet: https://play.google.com/store/apps/details?id=org.fedorahost...
- etc. It's a dead simple protocol so there'll be lots of options. Pick one that you trust
Edit: Even with the PGP option shown at the end of the article, the secret is still accessible to any malware whenever you access it. Unless PGP-based 2FA becomes super widespread, this won't be something malware looks for and so you'll be fine unless you are targeted by intelligence agencies, but still, it's not quite 2FA because it's not something you "have" but something you "know" (the PGP data's unlock password)
Re: De-Googling TOTP Authenticator Codes
#14For years I've managed all my TOTP codes with KeepassXC. Not a single problem, great software.
Just consider that storing TOTP codes in the password manager negates the advantage of two factors authentication, namely the added security of needing a second device. This would keep your logins safe even if somebody managed to breach your KeePassXC database.
You are allowed to have two separate databases, with different passwords. You can even store them on different devices!
Re: De-Googling TOTP Authenticator Codes
#15Go for Aegis if you're on Android, 2FA Authenticator (2FAS) or Authenticator (by Matt Rubin) if you're on iOS.
Re: De-Googling TOTP Authenticator Codes
#16+1. I stopped using google authenticator when they randomly wiped the app for me and lost all the codes.
Re: De-Googling TOTP Authenticator Codes
#17Go for Aegis if you're on Android, 2FA Authenticator (2FAS) or Authenticator (by Matt Rubin) if you're on iOS.
+1 for Aegis. Encrypted backups, easy to import/export multiple formats, and very customizable.
Re: De-Googling TOTP Authenticator Codes
#18Earlier quoted context omitted.
Just consider that storing TOTP codes in the password manager negates the advantage of two factors authentication, namely the added security of needing a second device. This would keep your logins safe even if somebody managed to breach your KeePassXC database.
You are allowed to have two separate databases, with different passwords. You can even store them on different devices!
It’s still one device.
Re: De-Googling TOTP Authenticator Codes
#19I get the feeling. Got a pretty bad experience with google when I migrated phones, and it messed up the data for a pretty important app (no damage, because I'm paranoid and have backups). I keep an offline phone with synced Authenticator because of this.
Re: De-Googling TOTP Authenticator Codes
#20To be clear, the point of storing a secret token on your phone and then typing over some codes that prove you have access to the secret still, is to provide 2FA. If you use oathtool on your laptop, and the password is stored there as well, you're back to 1FA That can be fine if that's what you want, but if you wanted 2FA: - FreeOTP: https://f-droid.org/packages/org.fedorahosted.freeotp - someone forked that and calle…
> you're back to 1FA
Which might be exactly what I need if another dumb website wants me add 2fa where I don't want to.
Considering just making a publicly accessible webpage for those codes at this point lol.