Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I set up Google 2 Factor Auth to log into other sites. I see there are backup codes if you lose your device.

Are these used only to log into Google, or can they be used to log into other sites?

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

It depends.

If you're using a site that uses Sign in with Google+ (or whatever): yes. It's the exact same authentication endpoint so signin works the same way.

If you had to set up a separate account (only applies to the 2-step verification app): no. An example of this would be Dropbox.

share|improve this answer
add comment

The backup codes provided by Google will only work for Google's services.

The Google Authenticator works on the standard HOTP and TOTP algorithms described in their RFCs. Google just provided a convenient app to use it. HOTP and TOTP are relatively easy to implement algorithms and most popular languages has libraries supporting it. In fact, here is one I wrote for .NET.

It is up to each individual site implementing the HOTP or TOTP algorithms through Google Authenticator to provide a means to recover from the loss of said Authenticator.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.