News for hackers. Stuff that matters.
Re:Google Is Eating Our Mail by laurentl on Friday April 26, 2019 @10:31AM (#19757883)
Yes, I lost my Signal conversation history as well and had to be re-added to all group conversations (another PITA).

How do you store seed values in password managers? More specifically: how do you export them from Coogle Authenticator? (I’ve not found that option). And how do you import them again?

Re:Google Is Eating Our Mail by fencepost on Saturday April 27, 2019 @09:56AM (#19765534)
I'm unaware of any options to export, that would be a security issue.

To store the seed values, simply store the text provided for use if you can't use the qr code.

Re:Google Is Eating Our Mail by laurentl on Tuesday April 30, 2019 @02:33AM (#19785623)
ISTR at least one service (AWS or Google) asking for the first 2 codes after scanning the QR code, probably to sync. So I always assumed simply re-scanning the QR code wouldn’t be enough but maybe it is this simple.
Re:Google Is Eating Our Mail by fencepost on Thursday May 02, 2019 @05:29PM (#19813155)
The underlying technology behind (almost?) all of these is TOTP (https://en.wikipedia.org/wiki/Time-based_One-time_Password_a...) which pretty much just depends on both systems having clocks that are reasonably close to synced. The initial value is basically a random number generator seed, and given the seed and a number of iterations (based on the time differential from a set starting point) calculating a code is fairly simple.

There would be problems on fully-isolated systems experiencing clock drift, but on any modern Internet-connected system using NTP or on any cell phone with time synced to the network it shouldn't be a factor. The most likely problem scenario is probably a corporate network using only an internal time source that drifts.

Doing a single code as validation only makes sense to catch transcription errors since in case of problems someone could end up locked out of an account.