Hacker News Reader

Comment by trulyrandom | Hacker News Reader

You can set up 2FA through one of the other options first. After that, TOTP should be available as an option as well. After setting TOTP up, you can remove the other one.

They're probably hiding the TOTP option because the backup story for Google Authenticator is really poor. If you lose your device, you lose access to all of the accounts you had set up 2FA for with Google Authenticator. Of course, there are other TOTP apps that are better in this regard, but Google is unlikely to promote those because then they'd lose some control over the authentication flow.

View on HN

I dislike how the only way to get TOTP codes off a device is by rooting. I had a half dozen codes that I had to dump from the sqlite db when I first used authenticator.

Thankfully this has been fixed. You can now choose "Transfer accounts" (from the menu in the top right corner) to copy everything to Google Authenticator on a new (or backup) phone.

Interesting! I ended up going with the LastPass authenticator in the end because of this issue but I am happy to see it fixed.

I use andOTP[1] installed via f-droid. You can easily get a backup file with your codes.

[1] https://github.com/andOTP/andOTP

This!

Though now Google Authenticator supports transfers, there is less of a need.

But I still enjoy using andOTP.

Just FYI, it's possible to backup your codes on Android using Aegis too. No root needed.

https://github.com/beemdevelopment/Aegis

I honestly was wondering about this exact thing for a while -- if you lose your phone, do you use lose access to every account you have, irretrievably? (For that matter, with some apps it wasn't clear to me even what you do if you get a new phone, which everyone does eventually right??) What's the way around all this? I have had trouble getting an answer to this question, so thank you for addressing it somewhat, apparently I'm not totally crazy!

(I am, somewhat shamedly, not yet a user of TOTP 2FA, although I will have to become so soon because of various platfrom and organizational requirements, and am trying to figure it out, and finding it challenging).

What are the options/ways that other TOTP apps handle this better, what are my choices here?

Aegis, available in F-droid as well, is an open source solution that allows you to easily backup and restore your TOTP "devices" (or rather, keys). You'd have to transfer that backup manually between your old and new phone.

A more user friendly cloud solution might be Authy that others have recommended.

This is indeed a big problem. Phone numbers are easy to transfer to a new phone when you drop yours in the toilet. This, however, makes them easier to attack.

The way to handle this correctly is to have backup options. This can be a second device or a printed sheet of backup codes. I’d wager that few people actually do this, though.

What is the mechanism for a "second device" backup option, how does that work an what TOTP products support it how?

The simplest case, applicable if you have access to more than one device that supports generating TOTP codes at the time you are setting up TOTP for a given site, is to simply scan the site's QR code on all the devices.

E.g., when I create an account at a site that uses TOTP I scan the QR code on both my phone and my tablet.

(Actually, I scan it twice on each device, using two different TOTP apps. That way I'm covered if one of the apps stops being supported).

If you don't have all your devices available at the same time, or you want to allow for the possibility of adding a new device later, you can simply save the QR code. When the site gives you the QR code, take a screenshot and save that in some secure fashion. I save it as an encrypted PNG file.

To add a TOTP device later view the screenshot and scan the QR code.

Most sites that give you a TOTP QR code have an option to get the code in text. As an alternative to (or in addition to) saving a screenshot of the QR code you can ask for the text code and save that. Securing a text file might be more convenient for some people than securing an image file, although using the text code to set up a new phone or tablet likely won't be as convenient as using a QR code.

Interesting, thanks!

I guess you need to keep these QR codes/texts as carefully/securely as you would any password....

This is all a lot of work, trying to figure out how to adjust to this world of 2FA.

The good news is that the QR codes and/or texts should be easier to secure than passwords.

You need the password every time you login to a site, so you need to find a way to securely store passwords that also allows easy frequent access to the password.

You only need the QR code when setting up a TOTP application on one of your devices which generally will only be once per device and then once whenever you replace a device. You don't need frequent easy access and so can pick a storage method that is optimized toward ease of initial storage.

For example if I've just signed up for site example.com and I've saved a screenshot of the QR code in example.png, I'd do this:

  $ gpg -ear tzs@mydomain example.png
  $ mv example.png.asc ~/OneDrive/totp-recovery
  $ rm example.png

and then I no longer have to think about it or do anything with it unless I need to set up a new device, which is very rare.

On my banking website I enroll my phone’a TOTP app and my wife’s TOTP app. If I drop my phone in the toilet I can authenticate with her phone.

Thanks for the solution!

Reply on news.ycombinator.com