News for hackers. Stuff that matters.

A comment on OnlyKey: Open-Source Alternative to YubiKey. Parent comment

Re:OnlyKey: Open-Source Alternative to YubiKey by 91iejrj20310 on Thursday December 26, 2019 @03:34PM (#21886522)
Is Google Authenticator tied to your smartphone, to your account, or a combination of both? Can you transfer it to another smartphone? Is it being backupped automatically?

We're amongst a very technologically educated part of the population here, and honestly, I'm not sure about the scope of Google Authenticator. Quite sure that many aren't.

[ Parent | on HN ]
Re:OnlyKey: Open-Source Alternative to YubiKey by dbrgn on Friday December 27, 2019 @04:40AM (#21890242)
Google Authenticator implements TOTP, which is actually a very simple standard: https://pthree.org/2014/04/15/time-based-one-time-passwords-...

If you can extract the private key, you can transfer it to another phone or device.

On Android, AndOTP is open source (available on F-Droid) and allows encrypted backups. As for Google Authenticator, I don't think you can create backups.

[ Parent | on HN ]
Re:OnlyKey: Open-Source Alternative to YubiKey by spockz on Thursday December 26, 2019 @04:06PM (#21886774)
With Authy, a Google Authenticator, on iOS the codes are backed up in iCloud and protected with a pass code. I’m not sure whether the pass code is used to actually encrypt things or just as a soft lock.
[ Parent | on HN ]