Hacker News Reader

Comment by phreack | Hacker News Reader

Amen. Google is asking me to add 2FA to an account for work, and there's no way to do so except from phone numbers or Google Authenticator which I'd rather not use. It's the only service that doesn't let me use something like Authy for OTP.

View on HN

You know Google Authenticator is just an implementation of the TOTP open standard right? There are plenty of alternative apps that will give you the same number to key in...

Authy included

Totally understandable GP wouldn't know that, from what I recall of logging in to a Google account when I did that at all often (a few years ago, but relatively recently) Google does its best to hide that.

(If you want it, mine's another recommendation for Authy.)

Yeah I did not know you could use any TOTP besides Google Auth but even that that's not an option that's presented to me anymore at the moment now that I'm checking.

The nice thing about TOTP is i can put it in my password manager which makes life a whole lot more convenient. W for open standards.

If you’re on a Mac, in safari you can just right click on the QR code and set it up in keychain, then you can just auto fill from safari, no need for a third party app.

You might want to keep at least your email decoupled from a particular Hardware+OS+Browser combo.

Not if they flag you before, which is the same thing Twitter requests.

I was very pleased to discover that most of the KeePass/KDBX apps (e.g. KeePassXC) also support storing this data and generating the TOTP.

That is not entirely true. If I remember correctly, if you select the Google Authenticator as your option, it will display a QR code. You can then scan the QR code and the OTP information will be in that payload that can then be pasted into you app of choose. (How o got mine I to 1Password)

Replying to everyone who said to use Google Authenticator. I in fact did fall for the devious wording that implied no other Auth app would work but never fear, even that is not an option for my account now that I'm checking. The only available options are physical security keys (which I lack), phone numbers (which I won't disclose), and tapping a notification on an Android phone (which ties me even more into the Google ecosystem and I'd rather not pick). I'll appreciate any comments if anyone knows how to get a TOTP going with Authy for Gmail, don't assume I know everything and I'm willfully ignoring it!

2-step verification can be turned on by going to https://myaccount.google.com/ and selecting security and then "Signing in to Google". The "2-step verification" finally leads to the point where phone number is asked for enabling SMS based verification. Only after enabling SMS based verification it is possible to enable Authenticator App (TOTP) or some other options.

At least I couldn't find other way to enable TOTP i.e. first SMS.

I have the 2FA for my work account in 1Password (if that's reasonable is another discussion) so there should be a way to use something else besides Google Authenticator or phone number.

Google will allow you to use (and they prefer, and you should too) a Security Key. I use this wherever I can. I don't Tweet, but if I did it would be secured with Security Keys. I have Facebook only inside a single contain on one machine, secured with Security Keys. And so on for many services. More services should do WebAuthn.

I hear you but they're expensive where I live. For the moment that's not an option though I'm looking into getting one at some point.

Do you have something against TOTP? Isn't it better than Authy?

Authy is a TOTP app.

Ah, i thought Authy was a service. So.. why can't OP use Authy with Google?

Google Auth is just TOTP, yet Authy is not capable of using it somehow? I'm so confused lol. I've used plenty of TOTP apps with Google.

Who knows. User error or misunderstanding perhaps. I use Authy with many Google accounts without issue.

Reply on news.ycombinator.com