Hacker News Reader

Comment by greggman | Hacker News Reader

AFAIK your Two-Factor is not connected to your google account. Or maybe we're talking about different things. Mine is an app that happens to be made by Google but it has no connection to my google account. If I Google kicked me off the two factor app would keep running

https://github.com/google/google-authenticator

View on HN

Eh, it should be highlighted that the Google Authenticator app on the Play Store is NOT the one on GitHub, which is a much older version. The current version is closed source, and cannot be assumed to keep working if a Google account is banned.

(I strongly recommend people compile and switch back to the old open source version.)

F-Droid has an .apk of the old FOSS version: https://f-droid.org/repository/browse/?fdfilter=otp&fdid=com...

Along with multiple alternative apps: https://f-droid.org/repository/browse/?fdfilter=otp&fdpage=1...

Maybe use an alternative TOTP 2FA app such as Authy (closed-source but not tied to a Google account)

Maybe for something important like account access, keep things open-source and use FreeOTP as a drop-in replacement. It's on F-Droid here: https://f-droid.org/repository/browse/?fdid=org.fedorahosted...

Is there a simple CLI TOTP client? Or what do you use a backup system if/when your phone fails?

My recommendation for backing up 2FA is to print the QR code that you set up your phone with, and lock it in a very safe real world place. Do not keep a copy on a digital format.

I don't know of any CLI clients (that would be perfect with a Bash alias) but I just store the initial 'seed' passcode in my password manager. When setting up a new device, I manually enter that instead of scanning a QR code and it works perfectly.

If you store your 2FA recovery codes in the same place as your passwords, there is effectively no point in you having 2FA, because compromising one factor, your password manager, compromises both.

You are correct but in my use-case I have my browser remember the passwords and use a standalone password manager for storing credentials that I infrequently access. An exploit compromising the browser would next have to compromise the password manager's encrypted database.

Admittedly this is not perfect, but I am comfortable with the level of security it provides. I think it is also roughly comparable to users who have a 2FA app on their mobile and a password manager syncing to the same device.

Reply on news.ycombinator.com