Re:Turn on MFA Before Crooks Do It for You
by lambda_tango on Saturday June 20, 2020 @12:35AM
(#23581689)
I had to get the seeds out of Google Authenticator several years ago. The seeds were stored in an SQLite database file in the app directory. I think I used another app to read the DB file and export the seeds to plain text, but you could also conceivably copy the file to a computer and work from there, though you might need root access either way.
Re:Turn on MFA Before Crooks Do It for You
by tgsovlerkhgsel on Sunday June 21, 2020 @12:10PM
(#23592830)
Yes, all of this requires a rooted phone or otherwise subverting the Android security model.
A potential alternative could be finding an ancient APK that didn't have the 'prevent backup' bit set, downgrading via adb install, and pulling an adb backup. Still, massive PITA.
Re:Turn on MFA Before Crooks Do It for You
by NiekvdMaas on Saturday June 20, 2020 @03:05AM
(#23582337)
If your old phone is rooted:
adb root && adb pull /data/data/com.google.android.apps.authenticator2/databases/databases
Re:Turn on MFA Before Crooks Do It for You
by Avamander on Saturday June 20, 2020 @12:29PM
(#23584786)
Yeah, it's very painful to use foreign services, the 2FA solutions are just so annoying. SMS and TOTP? Legit stone-age garbage just like paper signatures.
I have none of these problems with local important services because I can use my goverment-issued ID for those things.
I have 2FA turned on for Github. Since they refuse to recover accounts that have 2FA enabled if you lose your second factor, I have many alternative ways configured: TOTP, U2F, recovery codes, recovery phone number.
I have the recovery codes stored in a secure location, and several U2F tokens enrolled (one of them is also off-site at a different location).
But I didn't back up my TOTP seed. I still have the old phone with Google Authenticator, but it's too old to accept the version that lets me export my keys.
Getting a new TOTP seed requires me to re-setup 2FA, which will invalidate the recovery codes and possibly unenroll my security keys (it says "This will invalidate your current two-factor devices and recovery codes.")
It's also apparently impossible to set up Github 2FA with "only" a set of security keys + recovery methods - you have to first set up an authenticator app or SMS 2FA as a primary method.
So now my options are:
- Leave the dead TOTP on the account, and don't have a working TOTP setup
- Re-setup from scratch, invalidating the recovery codes and possibly U2F tokens, requiring me to visit two distinct off-site locations to re-setup everything, one of which is currently locked down and inaccessible due to Coronavirus.
And Github is one of the better sites when it comes to 2FA!