Hacker News Reader

Comment by tfmatt | Hacker News Reader

How did you change the two factor authorization codes from Google Authenucator? I think they are needed for crypto sites like Kracken.

View on HN

It's an open standard and many other apps support it. You just need to go to each service where you've set it up and redo it with your new app.

I'm now using OTP Auth in iOS, which allows backing up the codes. For me the risks in that are worth being able to easily restore my codes.

Alternatively, if you use GAuth on Android and you have root, you can backup them up and migrate them yourself (it's just an SQLite file).

I never used Google Authenticator. Instead, I use 1Password's 2FA functionality.

Not a great idea to combine your first factor and second factor in the same place.

Backup codes and then the protection is against illegal SMS porting which is a social engineering attack hard to otherwise defeat. Your phone is fulfilling a different function and yes it does collapse both factors onto one device but the primary risk wasn't loss of phone, it was weak password and no variant second factor and then porting attacks on SMS.

I didn't understand the point your are making. I'm referring to the overall attack surface area of apps like 1password (which I think also have browser extensions ?). TOTP is better than sms, but why put it in the same app as your password ?

You have to ask yourself what's the primary threat. Yes,the point in strong sense of a second factor is a fully independent test. But the actual threat it mostly protects against is credentials threats. Not loss of devices or compromise of a keystore. SMS as second factor is way way worse because of the porting problem. Otp inside 1password is a compromise but it protects against the primary threat.

If you crypt your disk and use a good passphrase or a long pin and passphrase on a phone you are not that badly exposed.

Don't you loose the benefit of 2FA then, an adversary only needs to obtain your 1Password password.

I too replaced Google Authenticator with 1Password, for much the same reasons. The Google Analytics tracker in 1Password is concerning though.

Reply on news.ycombinator.com