18

You need backup codes to "an account" not to Authenticator itself. Authenticator has one entry for each 2FA-enabled account of yourself - without needing an account for its own use. So the concept of backup codes for GA doesn't apply. If for example, you have an account (say GMail) that you've protected with GA-based 2FA, then you could generate backup ...


10

these apps are use the same algorithm which is a generic algorithm not an application developer's algorithm. Am I right ? Yes. There are two commonly used protocol for authenticator apps: HOTP (HMAC-based one time password), which is specified in RFC 4226 TOTP (Time-based one time password), which is specified in RFC 6238 The algorithms for the two ...


7

I agree with you that the "philosophy" behind Google Authenticator's "only one device" is profoundly broken, because in as much as it tries to avoid "copying" the keys, it exposes you to the risk of a broken device. Electronic devices can fail. You need a backup. Happily, Google Authenticator's keys can be extracted: http://eduncan911.com/technology/...


3

On Google Auth and any other service using TOTP provides you the time-based tokens, but they understand the possibility of losing the device or not being able to access the codes. Eg. Your phone got stolen or heavily damaged. So when you add a service like this they provide you Another login mechanism apart from TOTP, those are the backup codes, they are ...


2

You are looking for a technical solution for a social problem. That usually doesn't work. If you have a dishonest workforce who is collaborating against the company, they will always find a way to cheat the system. The only real solution is to fix the trust issues between your company and your employees. But if you really want a technical solution, you ...


2

A second factor is not inherently more secure than a password. In many cases (like an RSA SecurID Token) the second factor is vulnerable to physical theft - whereas a memorized password isn't. It would be more secure to ask for both authentication factors. I imagine github have chosen not to do this for convenience - after-all this is re-authenticating a ...


2

Using a QR code in the process you described basically just ensures that the user has a cell phone, if I understand it right. So, yes, your suspicion is correct. The way that apps like Google Authenticator are used is that the QR code is generated one time, when the account is set up (or when the user chooses to enable 2FA). The QR code is a way of sharing ...


2

An authenticator can optionally store a User Handle specified by the Relying Party when a new credential is created, however for backwards compatibility with U2F authenticators the User Handle is also allowed to be null. Regardless, the Relying Party still needs to know which credentials are associated with each user, so that it can verify the credential ...


1

This prompted me to download an authenticator by DUO security This was merely a suggested app. It was basically an ad. It now noticed I had installed the DUO authenticator, but instead opened the Microsoft authenticator. No, it didn't. I do not have DUO installed, but on my Instagram, when I tried to set up 2FA, it mentioned DUO, but it opened my Google ...


1

For example, if someone somehow finds my Twitter password and installs the Twitter app on their smartphone wouldn't they get instantaneous access to my Twitter account? So how exactly does Google Authenticator on my device stop the hacker from accessing my account when they are not going to access it over the web in the first place? (Say they'll use a "...


1

All of the apps you listed share an algorithm. This allows them to be compatible and largely interchangeable. However, there are other schemes that appear nearly identical from a user standpoint but do not use the same algorithm. For example RSA Authenticate uses a proprietary algorithm which is a type of TOTP, but is not compatible with RFC 6238.


1

Goolge Authenticator, and the underlying TOTP concept, does not have backup codes. These are a different concept, provided by Google, alongside their TOTP implementation.


1

I don't think there is really anything we as a group can do to contrast those in terms of security of the app out-of-hand, since they're at least all reputable organizations(though hey, maybe someone here has actually tested them, who knows!), so all other things being equal there's only really one question I can think of: Which auth app will incur the ...


1

You need in Appenter link description here 2FA, see the attached image as an example in gmail. Above most operators are installing SS7/Signalling firewall to ensure that subscribers are secure from SMS interception and redirection attacks.


1

SO i found out lots of people lost their GA id, can't open their accounts I found out the easy way to crack it down. First you need to download DB BROWSER FOR SQLITE and if you had android reset and had backed up the android data files in your computer (which you must do before resetting). Move to FILE MANAGER\ANDROID\DATA\com.google.android.apps....


Only top voted, non community-wiki answers of a minimum length are eligible