3

My understanding is that in TOTPs are like HMAC where code is derived from time.

However, I am struggling to understand the concept of Backup Codes in Google Authenticator, and how are they calculated as they are not time sensitive and can be used in any sequence. So how Google has implemented that?

Improve this question
1
  • Could you clarify - are you talking about backup codes for a service using TOTP (e.g. Google Account), or backup codes for Google Authenticator App (e.g. if your phone breaks, you can restore access to all TOTP tokens without interacting with individual services).
    – domen
    Commented Feb 17, 2020 at 16:39

2 Answers 2

Reset to default
3

On Google Auth and any other service using TOTP provides you the time-based tokens, but they understand the possibility of losing the device or not being able to access the codes.

Eg. Your phone got stolen or heavily damaged.

So when you add a service like this they provide you Another login mechanism apart from TOTP, those are the backup codes, they are not part from TOTP but remediation method if you lose access to them.

Improve this answer
3
  • I'm not sure @blackbox007 is talking about backup for individual services. Looks to me it's about backup for the Authenticator itself (I don't use that, but I do use Authy, which provides similar functionality and does have backup for the authenticator itself).
    – domen
    Commented Feb 17, 2020 at 16:37
  • On google 2fa when you set up the TOTP method, just when you confirm the code from the web view and the app, it automatically enables the backup codes. As UX visualization it seems to be part of TOTP but as you can see on their [documentation] (support.google.com/accounts/answer/…) On Step 2, you can choose the 2fa method, after you finish setting up the app codes, it auto-enables the backup codes.
    – Fabian Diaz
    Commented Feb 18, 2020 at 0:12
  • It appears you're right, Google Authenticator does not support the feature I had in mind (authy.com/blog/how-the-authy-two-factor-backups-work), so there's only one way to interpret OP's question.
    – domen
    Commented Feb 18, 2020 at 9:11
1

Goolge Authenticator, and the underlying TOTP concept, does not have backup codes. These are a different concept, provided by Google, alongside their TOTP implementation.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .