Hacker News Reader

Comment by ocdtrekkie | Hacker News Reader

It's truly and deeply frustrating to me how many sites and services push "Google Authenticator" branding instead of specifying that it's TOTP or that literally any good 2FA app will work. It's almost to that "Google" = "search" level, but for a more niche aspect.

View on HN

I'm not sure why you're being down voted, but I agree. I've had several discussions where people think Authy is incompatible with sites that prompt for Google Authenticator, like it's some special more-secure TOTP app.

In Fortune 1000 land, Microsoft Authenticator rules the land. I love it because most have implemented notification push-authentication with biometric verification. Some sites will use that in lieu of any password at all.

The worst is when separate apps & companies roll their own authenticator app.

For me personally, Microsoft Authenticator started ruling as well recently, after 5+ years with Google Authenticator. Why? I have already mentioned it in other comments before, and it is due to Google’s insistence on not implementing recovery from backup.

If i store my 2FA in google authenticator and something happens to my phone? I am in a world of serious pain. If i upgrade phones? I have to disable and re-enable 2FA on my new phone manually for every single service I use.

Microsoft Authenticator solves both of those problems, as they have recently (less than a year ago iirc) added a “backup to cloud” feature. No more stressing about something happening to my phone, as long as i have my (single) primary recovery key stored on a piece of paper somewhere safe (as opposed to having a paper recovery key for every 2fa service i use).

Prior to this, i was seriously considering getting a cheap backup phone to which i set up all the 2fa codes simultaneously with my main phone, then put that cheap phone in a bank cell/safe/etc., and then rely on it in case something happens to my main phone. That would still not solve the problem of manual transfer and disabling/re-enabling 2fa for every single service, but that would be much better than losing the device.

Note: I know Authy exists and had this functionality of cloud syncing 2FA keys between logged in devices for years, but for some irrational reason i was sticking with the “simpler is better, and i somehow trust google more with this one”, but luckily, I trust MSFT with my 2FA no less than i would google, perhaps even moreso. And the biometric 2FA for services that support it (so far, I’ve only seen it used with certain corporate MSFT services) are a nice cherry on top.

Google Authenticator has added account transfer at some point in the recent couple years - you get a QR code that you can scan on another device to transfer stuff. It's not automated backup, but it makes migration to new devices easier.

Can I print that QR code and stuff it in a safe to scan 3 years from now, or does it expire? It isn't clear from the export screen.

I'm pretty sure the QR codes actually encode your secrets so if you want to print them out you're good to go. Obviously won't include any new ones you add in in the meantime though.

>Can I print that QR code and stuff it in a safe to scan 3 years from now, or does it expire?

Given the protocol/algorithm, it shouldn't expire.

This is only for Google-specific services that use 2FA (and it works with any authenticator apps, not just Google Authenticator, because this functionality is dependent on the service, not the app).

So if I try to do this for my Google account 2FA (with Google Authenticator, Microsoft Authenticator, or literally any other authenticator app), it works. But it won’t work for any of my other 2FA accounts, like MSFT, Discord, etc., no matter which authenticator app I use.

To your defense, Google Authenticator added the option for restoring from local backup fairly recently, but only for Android. And even then, no ability to sync it with multiple devices.

That doesn't make much sense to me. If the app has the state necessary to generate TOTP codes, why couldn't it transfer that state to a different device? How could it be dependent on the service?

This isn't the case.

I recently changed phones from Android to iOS and the export/import from Google Authenticator was fine for non-Google services.

Edit: I think there was a bug where it seemed to only export the tokens visible on the page, so I had to scroll and do it again for additional tokens. Maybe you are hitting that.

> If i store my 2FA in google authenticator and something happens to my phone? I am in a world of serious pain

On iOS, you can back up Google Authenticator. It then restores with your 2FA codes intact. (I don't do this, because I feel it weakness 2FA's security and am decent about saving recovery codes. But everyone's tolerance for B.S. is different.)

> On iOS, you can back up Google Authenticator. It then restores with your 2FA codes intact.

Source needed. I just opened Google Authenticator on iOS, and it isn’t an option. Googling confirmed that it isn’t supported on iOS.

If you try to restore the phone from the backup (whether iCloud or local backup), it will restore the app, but it will have no 2FA codes present.

> I just opened Google Authenticator on iOS, and it isn’t an option

Why would it be an option in the app? Go to your phone's backup settings and select Google Authenticator. When I had this on, it worked. (It might have since changed.)

Google being Google, there is zero reliable documentation on anything, but here's a community thing from a few years ago [1].

[1] https://support.google.com/mail/forum/AAAAK7un8RUcSLd5H1MpO4...

Are you sure this actually works?

My understanding is that iCloud backup is specified by the user per app (can default to on). Going into my iPhone->Settings->Authenticator there are no iCloud settings and iPhone->Settings->iCloud shows lots of apps but Authenticator is not one of them.

I have iCloud backup on, have switched through at least 2 phones (as in 6+->10->11) where I have Google Authenticator on. The new phone never had any of the Authenticator codes after restoring yet all the other apps restored their data.

Exact same experience. The app backs up into icloud and gets restored on backup restore just fine. But no 2FA codes are present after restoring, so I had to enter them manually.

Settings->User->iCloud->Manage Storage->Backups.

> Microsoft Authenticator solves both of those problems, as they have recently (less than a year ago iirc) added a “backup to cloud” feature.

Is this to the same cloud that Microsoft gives unfettered access to all its customer’s Cosmos DB data?

2FA backups are fine but they need to be onto local, offline, disks. Automated cloud backups that can be decrypted at rest are no longer “something only you have”.

It isn’t “the same cloud” that you were talking about, it is iCloud.

Microsoft's stuff all wants you to install the Microsoft Authenticator which needs a Microsoft account for some reason and that (for me anyway) then immediately wanted me to setup 2FA, for which it required me to install the Microsoft Authenticator, which ... you can see how that goes.

As I began to experience Déjà vu on the first day of a new job I snapped out of it, removed the Microsoft Authenticator and told it nah, I'm OK actually, show me that QR code for "other authenticators" and never looked back.

Microsoft Authenticator is more than just TOTP, which is why it wants a Microsoft account. It also supports push approvals.

I'm a little surprised Google hasn't don't this but I guess they have give gmail. Sign into google and it will ask me to approve on my gmail app.

Not entirely sure I like these "authenticate on from another device". Just yesterday I mis-placed my phone. I wanted to sign into iCloud.com for use "find my phone" feature from my PC. It required me to use apple's authentication via a code sent to the phone, the exact thing I was looking for! :(

Back in the day it was the best-known and most reliably available cross-platform (iOS, android) code generator - so many sites just assume it as a de facto standard. It also reduces support burden to tell people this is the officially supported code generator, that way you don’t need to struggle understanding why a random app might be having trouble with codes.

These days it’s much less of an issue as there are many more clients - the IdP I manage now mentions authy, tofu and 1password as also supported.

Also Google Authenticator does not allow you to include your codes in your backup, even when it’s encrypted. So due to Google Authenticator, losing your 2fa codes is an expected problem and many companies allow you to reset it by simply calling them.

It sounds really secure but it really is not.

Google Authenticator has a feature to allow export of all saved codes into one QR code for re-import into Google Authenticator running on another device. I printed a copy of my export QR code for use in case my device is lost or stolen.

Thanks! I hadn't seen that feature. Just checked it out. It shows multiple QR codes (in my case 2 QR codes which contain 11 TOTPs total) that you can scan from another device running Google Authenticator to transfer to codes. I guess I can screenshot those QR goes to back up (scary)

It's about the perception of security and reducing friction. Everyone knows Google, so you don't have to convince users of the trustworthiness of a lesser-known brand or open source project within the sensitive context of increasing security.

Have you seen users? I have to convince users not to install random crap.

On the one hand, I agree but on the other, this is the one case where you cannot take any chance of having your user install some random dodgy app that promises the same functionality.

Reply on news.ycombinator.com