Hacker News Reader

Comment by spiritcat | Hacker News Reader

Google authentication is great, until it's time to get a new phone.

If you have 1Password it supports OTP and thus can be used across devices.

LastPass has this too I think. But something seems off to me storing my 2FA with the service that manages my first factor.

YubiKeys can store and access OTP secrets. I put the secret in both Google Authenticator and my YubiKeys as backup.

Lastpass categorically does not have this. We could find no way to use it to share TOTP among administrators for a root account for example.

They refused a refund as well.

Horrifically bad company customer service, UX, UI. Save yourself the trouble and skip them, call 1Password.

Whenever discussing this with colleagues there’s always been a bit of debate about whether OTP inside 1password constitutes 2FA or not.

On the one hand a password could be popped from the target site or phishing, and you’d still need the 2nd factor from 1password to get in.

But on the other hand, if you leave your phone lying around unlocked with a poor master password, both get popped together.

If you leave your phone unlocked with Google Authenticator / SMS 2fa and a weak master password, you still get popped. The only difference to me in convenience of 2fa code auto fill.

Check out Authenticator Plus - its another TOTP app that lets you backup your (encypted) 2FA secrets and optionally syncs them across devices.

Thankfully Google Authenticator is just TOTP, so you can use whatever client you want.

Also, check out andOTP on F-Droid: https://f-droid.org/en/packages/org.shadowice.flocke.andotp/

Open source and supports backups.

andOTP is amazing, I thoroughly recommend it.

Had no idea about this. I liked Google's Auth since it was simple but it missed the crucial backup feature. Authy is nice but you're putting trust in a 3rd party that doesn't have a channel for donations, though it seems they're making money through SMS (Twilio).

andOTP is just what I was looking for since it's FOSS and had backup! This would have been a lifesaver when I lost my phone but glad to have run into it now.

TOTP is old and busted, U2F is the new hotness.

https://en.m.wikipedia.org/wiki/Universal_2nd_Factor

> The device key is secured against duplication by a degree of social trust in the commercial manufacturer

TOTP sounds much better. Also doesn't requires "trusted magic hardware"

U2F prevents some vulnerabilities that TOTP alone can't. It's possible to replicate it in software instead of a hardware token, but so far nobody has. So if you're adopting 2FA, suggestion is to use U2F if you can.

Thanks for the tip, I only knew about authy before

A while back because of shifting mobiles a lot ( due to repairing my mobile and also having a temporary replacement) I ended up making a rudimentary program to store shows codes and even qrcodes for reading from the mobile working in my Linux terminal. https://github.com/lcabral37/terminalOathApp

It did the work and even today I use it every now and then, instead of pulling out the mobile.

1Password can store 2FA and will auto-fill them on desktop and mobile.

I do this too. I guess it sort of undermines the idea of a second factor but the only way someone could get at it would be to break into my 1Password account, which seems unlikely.

Google authenticator allows you to transfer all your codes to a new phone and that includes if you lost your old phone. So they must be backing up to your Google account.

Do you have a source on this ? I don't think google authenticator backs up by design, and that's good.

I store my totp secrets in keepass with everything else and synchronise it to my other devices.

This probably undermines the idea - but phones get lost/destroyed/wiped regularly.

This is why it's best to use something like Authy

Print out the QR code and store it in a safe.

Reply on news.ycombinator.com