The Google Authenticator ruse

Use andotp

I don't get Google Authenticator. I use it, but it didn't require my registration. so anyone could download GA, and use the numbers to access my linux box right?

Every time you set up an account to 2fa there is a backup code that come with it to write down. It's your fault if you didn't write it down.

This. Lets you create backup files, too, so a bricked device won't always mean getting locked out of all your accounts. Learnt this lesson with my last device and Google authenticator.

Not having the possibility to backup/restore the keys locally is also retarded

I did not lose access to any of my accounts
my point is google authenticator is not tied to your google id, nor is included in the android backup system

Yes, but more importantly
>He doesn't generate backup codes and store them in keepassxc

AndOTP lets you have local backups.

This.

>tied to your phone number
OTP has nothing to do with a phone number.

Titanium backup

>OTP has nothing to do with a phone number.
yes, when you are using a service like authy

Google authentication has nothing to do with a phone number. It never did. If you're using a phone number for something then it's not the standardized OTP and is some random bullshit the site made up.

you are still missing the point
nobody said OTP is a system that needs a phone number
I am stating that Google does not carry your OTP stuff in backups nor your google id, so if you miss or reset your device you are done
google does not warn you about this situation, and you can check in the reviews in google play, and how everyone is finding out the hard way

Google Authenticator isn't synced to your Google account? What a blunder. What happens if my phone breaks?

(cont) other OTP systems does that for you, like authy
it creates an encrypted backup protected by your fingerprint, so if you lose your phone, you just login using YOUR PHONE NUMBER (my point), and it downloads the backup

exactly
you are literally done, and have to rely on backup codes (if you stored them somewhere other than your phone)

The whole point is to keep it offline. You don't even have to use it on a phone or your main device.
>everyone is finding out the hard way
You're literally warned on every site to keep your device safe and back up manually if necessary. Retarded users can never be helped and the only way they'll learn is from mistakes.

This sounds retarded and useless. You can literally copy the backup files from andOTP or google auth to your computer or an online host manually if that's what you want. From what I see authy is fucking spyware anyways.

If your phone breaks then copy the OTP backup file to a working phone. If you didn't make one then it's your fault for not thinking.

Attached: Screenshot_20190213-115518.png (1080x1855, 158K)

you can't seem to accept people EXPECT google services to carry on with your google id, and backup the app in the android backup cloud thing
it is not rocket science, lad

>This sounds retarded and useless
not it does not, and it is quite easier and faster than making it yourself, other than that your solution needs root access

>If your phone breaks then copy the OTP backup file to a working phone. If you didn't make one then it's your fault for not thinking.
no it is not
the phone uses its own backup system in the cloud for that, and you expect that it works as it should
if you can't understand my point, and I am not wasting my time any further, lad

>google services
Google auth isn't google services just because it's a google app. That's like complaining about snapseed not backing up images in the (((cloud)))
>your solution needs root access
You don't, are you fucking retarded? Pic related.
>phone uses its own backup system in the cloud for that
No.
>if you can't understand my point, and I am not wasting my time any further
I can see that you don't understand how technology works.

Attached: Screenshot_20190213-122710.png (1080x1861, 128K)

>You don't, are you fucking retarded? Pic related.
we are talking about authenticator, not andotp, retard
>No android backup
yes, there is an official google android backup in the cloud. if you don't use it or don't know about it is not my problem
>I can see that you don't understand how technology works.
have fun with your backups, fag

Attached: file.png (573x1208, 152K)

thanks for this thread op. i wouldn't have known.

btw
>claims storing your encrypted otp entries in authy is retarded
>claims storing the otp entries anywhere other than your phone is retarded
>shows andotp doing exactly that
the current state of Jow Forums

>authenticator
It's the same shit except it became proprietary recently. Why the fuck are you trusting your security to a proprietary app? You clearly don't give a shit about security so why bother complaining?

I said storing it on the cloud is retarded. I don't expect a 2-digit IQ monkey like you to understand.

>I said storing it on the cloud is retarded. I don't expect a 2-digit IQ monkey like you to understand.
it is encrypted in the cloud, asshat
>authenticator
it is opensource, iirc
you are discussing 2FA systems while I am discussing integrated services, such as having cloud backups of your OTP enabled site entries

you are welcome
the app looks pretty abandoned

The backup support is there but there's plenty of reports that it's broken and does not copy the sites

Attached: Screenshot_20190213-124735.png (1080x1920, 138K)

>it is opensource
It stopped being open source 3 years ago.
>having cloud backups of your OTP enabled site entries
Syncthing

>Syncthing
long time user
I honestly stopped using it because it polled my SD card so much at that time (before the new inotify thing) that it left a burn-in mark on the screen of the phone
I would probably go andotp if I follow the "manual" route, although I find Authy quite easy and care free

I never thought of that

Attached: 1549151206028.jpg (1440x1440, 230K)

I used to use FreeOTP. Then one day it wouldn't open on my phone. Instant crash when you try to launch it. I tried everything, and then finally gave up. What a complete fucking nightmare.

I've seen a lot on this board, but complaining about having no botnet in google app is something new

Attached: 1550031710089.png (1080x801, 825K)

it is the only thing good about the botnet: careless backup support tied to a user/password

What you want defeats the purpose of 2fa

Way ahead of you. I have it set up on 5 different Android devices.

What are recovery keys?

not at all, because the backup is encrypted behind your login + your phone number + your fingerprint
a hassle

You can keep ignoring the whole point of 2FA but it won't change.
Write the codes down next time

I've got my PC and google auth, how do I back up my stuff on the phone in case it breaks?

>You can keep ignoring the whole point of 2FA but it won't change.
2FA is two factor authentication, using whatever method you want
having the QR entries of the services you use backed up by a cloud service does not render the 2FA system purpose invalid in any way
the cloud service is not giving you the codes: they are just storing the services QR codes you have stored for you in case of a stolen/broken/obsolete device being replaced
if someone hacks your cloud they still need the password of that specific service, which they don't have
add encryption to that database
add biometric security...

in terms of security, there is hardly an issue, but in terms of getting kicked you out of the services you use, it is a hassle to say the least
I will personally go back to Authy

afaik there is no way other than using root to backup the entire app data folder
in theory, the android backup solution is doing it, but it does not restore the info later

If you get a Yubikey and use their authenticator app, it stores the TOTP codes and info on your key, but there is a hard limit to how many you can store per key.

You fucking retard. GA is meant to do that. It offers backup codes which you can use to transfer your credentials to a new device. If you forgot your backup codes, then you fucked up.

There are other authenticators based off of GA, such as AndOTP, which supports local backups. I use it.

>Not having an old phone/tablet running cyanogenmod with 2FA set up locked in your safe alongside a glock

Nu-g dissapoints me once again

Attached: ztfgE55.jpg (261x148, 6K)

I've already rooted my android phone and now using a custom ROM. Do I just copy paste the files?

Play stupid games?

I reccommend using oandbackup, makes it less prone to corruption and incompatibility, however my Brave backup for 7.1 doesn't launch on 8.1

Are you fucking retarded

That’s like locking your house but hanging the key on the doorknob. The right way to use the app is to write down the recovery phrase and keep it in a safe place, ideally your safe deposit box.

2FA is a buzzword, and a really bad one for everyone. Service providers force you to use it "for safety" by locking unrelated useful features if you don't. Worse still, some services even force you to use their own proprietary 2FA (Steam, to name one), generally without cloud or external backup/transfer feature, and you're stuck with a handful of one-time backup codes that you'll either leave unsecured anyway or never remember where they're kept.
If you're targeted, the attacker will have your life in his hands (literally) with your 2FA device, and the providers will use the fact that you provided a valid code against you when you seek support.
There are many Steam scam-sites that instantly take over your account, change your contact info and setup a new 2FA once you try to sign in and send your 2FA code - since the code was provided, Steam doesn't bat an eye to the unusual activity. This kind of scam could be avoided with a simple "Unusual Activity Detected" confirmation email or SMS, but this will only be triggered if you don't provide a valid 2FA code.

2FA, biometry, it's all a scam

Only passwords remain a good option

use Authy you retard

>tell people to use a botnet
>calls *them* retards
Kys

>botnet
>just use google goy

This is why you write down your recovery codes....

2FA is made with the idea that it never leaves the house baaaaaaka~

>SIM cards aren't botnet
>built-in GOOGLE TRACKERS aren't botnet
See and kys. andOTP exists.

yeah but that is not GA, that is google giving you codes to recover your 2FA in GA
the thing is, once again, that the backup android does of the app does not restore the application data