5

So I am using Google Authenticator as my two factor authentication.

I'm not a security expert, but I was thinking late last night as I was about to fall asleep:

How can I login to my favourite 2FA-enabled websites if I lose my Android?

Can someone with knowledge of this kind of thing please advise what I might do to safeguard against losing my Android? I run pretty mission-critical stuff on Amazon EC2 and have 2FA enabled.

Hi everyone, so I ended up going into all my accounts and disabling 2FA. I then re-enabled 2FA in all my accounts, but also saved the QR code in my encrypted folder. I think that's the best solution? This way, I'm not relying on Google...

Improve this question
3
  • 4
    Use your backup codes
    – paj28
    Oct 21, 2014 at 10:00
  • So I'm looking at backup codes... I printed them off. But how does this let me in to the Google Authenticator app?
    – Eamorr
    Oct 21, 2014 at 11:19
  • It doesn't let you into Authenticator. (See my answer for an option using Titanium Backup if you want that.) The backup codes let you log into Google. If Amazon has something similar - I don't know. You should have a backup Authenticator or something.
    – SPRBRN
    Oct 21, 2014 at 12:14

3 Answers 3

Reset to default
3

First make sure nobody can abuse your codes. This may be even more harmfull than you not being able to login for a short time. So encrypt your phone and your external SD card if data is stored there. This requires that you use a PIN or password to use the phone. So nobody can use Authenticator without knowing that PIN. Don't use 0000 or 1234 but something complicated and easy to type that is long enough to make it impossible to break by hand.

Use backup codes, and you can use a backup phone number for Google login, possibly for other logins as well.

Root your phone, use Titanium Backup to backup your phone, including apps like Google Authenticator, including user settings and data. When you restore this - like in a VM - you can keep using your 2FA like normal. Backup to a local computer, and backup to an encrypted drive if you need the security. Keep multiple backups at different locations if necessary.

Create an Android VM, install Google Authenticator on it. Make new syncs. If you want to protect this VM, install the virtualbox disks on an encrypted disk.

Update

Lately I use the Authy app, which makes it possible to make backups and which can be used as a Chrome app.

Improve this answer
10
  • What happens if I accidentally remove the "Google Authenticator" app?
    – Eamorr
    Oct 21, 2014 at 11:20
  • I don't know for sure, but probably your data is deleted and you have to sync again. Use a second authenticator on another device. Make sure you have a backup plan.
    – SPRBRN
    Oct 21, 2014 at 12:15
  • I think developers need to emphasise this more to their users. If I lost my phone tomorrow - I'd be locked out of many mission-critical websites were it not for me going back and ensuring I have a copy of all the QR codes. How many naive users with little or no IT security experience are there out there who aren't asking the questions I'm asking? The language used in IT security is very high brow and I say this as an IT person!
    – Eamorr
    Oct 21, 2014 at 12:18
  • The QR codes are for syncing, and I'm not sure if they can be used twice. Don't rely on it if you haven't tested it. So start over one more time, use the QR code, and see if that works!
    – SPRBRN
    Oct 21, 2014 at 12:18
  • The QR codes I saved can't be used again?!
    – Eamorr
    Oct 21, 2014 at 12:36
1

It's probably too late for some sites, but I would suggest taking a screenshot of any QR codes and saving that somewhere secure. That may mean print them and put them in a fireproof box. That will allow you to re-scan them at a later date. If you have that option on any sites, I recommend you do it.

A similar option is to scan the QR code with Zxing before Google Authenticator, get its text content (which is a url), and store that text somewhere secure. You can then paste that text/url into a desktop QR client to regenerate the QR code at any time.

One suggestion I have is to create backup codes. You can use these as one-time login codes in the event you can get an authenticator code. That will at least get you back into Google/gmail where you can possible receive codes from other services via email. Along similar lines, Google will email or SMS you the codes if you can't use your phone.

Another option is service called Authy. It works the same as Google Authenticator. I have tried the app before and it seems to work fine. They have a desktop client, too. I have not tried it, but that would allow you to generate the same codes as Google Authenticator. Authy also has apps, so you could put it on a tablet or an old phone as a backup generator.

Improve this answer
2
  • So I should securely save all the QR codes before adding them to Google Authenticator? Mmm. I think I'll have to disable 2FA in Amazon and then re-enable 2FA, and then scan and save the QR code.
    – Eamorr
    Oct 21, 2014 at 11:23
  • I have done the solution from the first paragraph: Printed out all those QR Codes and put them in a safe place. After an intentional phone reset, I successfully recreated all those 2-Factor logins in Google Authenticator.
    – Marcel
    Apr 12, 2016 at 10:51
0

I would highly discourage to use Google Authenticator app as it doesn't provide a way to backup and restore your accounts. The idea is that a service should provide a backup code.

Well, Amazon doesn't. The only viable way to restore access to your account (except sending the documents and signing the affidavit) is to receive a phone call. So if you move countries (which is not unusual nowadays) and get a new sim card and something happened to your phone, you're screwed. I moved from Ukraine to Germany and then to Australia. My phone died. As a result, my account got locked and there's no way to restore the access. In Australia, the Justice of Piece does not put a stamp on forms like the one that Amazon asks to fill out. So I sent them my docs and signed by JP affidavit and they rejected it because it didn't have a stamp. Now, I have no idea where my documents are. I asked them to remove them but received no answer. Fantastic! Bravo Amazon, bravo Google!

I am not alone here: https://www.linkedin.com/pulse/why-i-cant-use-amazon-aws-anymore-tony-yustein

Edit: I would recommend to use other apps that provide back up possibilities. Also, when it is about Amazon, keep your SIM card active as the only possibility to recover the access to your account is by receiving a phone call. Access to your protected by 2FA email doesn't count.

Improve this answer
6
  • This does not really answer the question. If you have a different question, you can ask it by clicking Ask Question. You can also add a bounty to draw more attention to this question. - From Review
    – Daisetsu
    Nov 9, 2018 at 4:41
  • @Daisetsu The question was, how can the author safeguard himself against losing his phone. My answer is: do not use the GA app. I backed it up with my story to explain why, in my opinion, GA is a bad choice, especially when it comes to Amazon. It's not that I care about the number next to my name, but I can't see the reason for -1.
    – Ivan Demchenko
    Nov 9, 2018 at 4:48
  • Amazon doesn't appear to offer any other option for 2FA outside of an authenticator app (amazon.com/gp/help/customer/display.html?nodeId=201962420). The question was how to login if they lost their android phone with 2FA enabled. Turning off 2FA just because you MAY lose the backup codes, and MAY lose your phone, and MAY not be able to use a different phone isn't a good solution. You can always activate another phone on the same account, and receive the SMS there. That is, unless Amazon now offers 2FA in a form other than an app. I could be wrong on that...
    – Daisetsu
    Nov 9, 2018 at 5:01
  • @Daisetsu I am not saying one should turn off 2FA. One should pick a better solution for it. And Google Authenticator is not the best out there. If the author loses his phone, the codes should be backed up. For example, iPhone's backup works in a way that it restores the state of apps via iCloud. So if you get a new iPhone and login into your iCloud you get back your codes from google auth. Even if the phone died. While google auth on android does not provide this by default.
    – Ivan Demchenko
    Nov 9, 2018 at 5:15
  • I just did a bit of research, and it appears you can use LastPass Authenticator or Authy on Android. Both of which backup the codes to the cloud for you. Maybe you could edit your answer to suggest a few alternative Android Authenticator apps which support cloud backup (without recommending any specific one, as we want to avoid explicit product recomendations).
    – Daisetsu
    Nov 9, 2018 at 5:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .