Hacker News Reader

Comment by RamRodification | Hacker News Reader

Any clear reason to go for Google for TOTP? As opposed to Authy or something else.

There's actually a very good reason to not use Google Authenticator actually.

They don't offer any backups (at least on iOS) and as a result, if you lose your phone, you are hosed. Google Authenticator also doesn't use iCloud for backup for files like other apps. I also just assume at this point no one owns that app and that it'll never get backups because that's how Google operates.

I've seen multiple people lose their TOTP codes this way and have been locked out of their accounts. Or even the more simple case, they buy a new phone, restore from backup and just assume everything is peachy then send their old phone back and then don't realize it until they open the app for the first time.

Use something with cloud backups for your safety.

I got scared as hell a few years ago when an update bricked the app, so launching it caused it to immediately crash. Fortunately, reinstalling the app fixed it without losing any data.

But since then I started actually backing up my recovery codes, and whenever I create a new account somewhere, I set up 2FA on three separate apps on my phone just in case.

Authy does not allow to make local backup (export) and it is fully closed source, not really transparent. I wish there were better alternatives.

Ravio OTP on iOS

They offer one-time backup codes that can be used if a device is lost. I'm not sure if this is Google or the site, but for every login where I've set up Google Authenticator I have copied the backup codes to my password manager for that account. I'd agree that a lot of people might not do that however.

Google the site has backup codes for logging in to Google. Completely unrelated to the data in Google Authenticator.

Google Authenticator used to have no way to get the data out, but does now have an export. It still has no normal backups.

Luckily services makes clear that you should print backup codes in case you lose 2FA.

As for Android Google authenticator - there is export function, that generates QR code for all tokens. You can't screenshot it, but can take a photo with different device and print.

I suppose you're talking about automatic backups, but at least on Android you can manually "transfer accounts" to export to another device over QR codes.

On iOS, I do see this feature, but it claims it will move the account, as opposed to "copy" it, and so, if it is a backup mechanism, they are explicitly pretending it isn't one.

Although it is primarily designed and labeled as an export mechanism, I can verify that it does work as a backup mechanism. I regularly use it to sync up new 2FA accounts to a backup phone. Simply choose to keep the accounts after exporting.

There is a clear reason not to use Authy, which is that making your data portable is extremely annoying. No export function. I ended up writing a 3rd party Authy client just to get my TOTP keys out.

For iOS users, I cannot say enough good things about https://apps.apple.com/us/app/otp-auth/id659877384. Author is responsive, encrypted backups, portable data format.

For android users, Aegis provides much of these benefits (as does andOTP). Both are open source, I like aegis a bit better.

andOTP has just worked for me across multiple device migrations for years. Encrypted backups to a git repo for mobile files managed with MGit.

Thanks. I have been looking replacement for Authy for quite some time because of no export function.

That's good one. Thanks.

Those were examples I thought people were likely to recognize, not vendor recommendations. I edited for clarity.

No, it's all the same.

You do realize that TOTP is a standard that doesn't require you to use either, that you can use the same secrets for any TOTP app, right?

You did read my comment where I suggested "Authy or something else", as in any TOTP app, right?

Reply on news.ycombinator.com