Excuse me if my question is a little bit convoluted. I prefer to share the full story, background information, so that accidentally I'm not asking XY question.

Background info

I'm using 2FA pretty much everywhere.

It leaves me with a single point of failure - Google Authenticator app running on my phone.

I made some effort to have the seeds backed up and even if the app does not suggest an option "please backup the seed" I'm using QR code reader and backing up manually. Same applies to recovery codes and SMS backup - whenever possible I took precaution measures.

Ideally, I would like to have an online service - see question on software recs: https://softwarerecs.stackexchange.com/questions/40380/looking-for-a-service-to-display-2-factor-auth-codes-online-rather-than-on-my-p

I believe it would be safe - I provide login / password / guid / secret URL - and even if someone gets access, for the attacked it will be just a page with 1000+ random numbers, it will be me who will know which 2FA goes where (I can attach some mnemonics to know which is which).

Actual question

Is it a sensible feature request for Google Authenticator app to offer an option extract seed?

In that way I could backup my seeds directly from the app.

I'm not sure how exactly Google Authenticator app works - I assume it stores the seed internally and based on the timer it displays the 2FA code.

I also assume that if the hacker has access to my unlocked phone - they can simply open the app and get the code. Allowing them to access the seed - gives them the advantage of using it any time. I believe than my convenience of backing up the seed has more value.

Are there any other security consequences of allowing me to extract the seed?

  • Some alternative 2FA applications allow for extracting the seed for token generation. Google appears to consider not allowing the extraction to be a better default behaviour, but there is nothing to keep you from using another 2FA generator app - the algorithms used are well known and documented. – Matthew Oct 30 '17 at 12:04
  • Using another 2FA does not solve my current problem at hand. Google should allow extracting the seed, I'll submit feedback report when I have the chance. – Mars Robertson Nov 1 '17 at 5:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.