> Authenticator data is not backed up. Microsoft Authenticator can be backed up, but you need to go through a few extra steps (and have a Microsoft account). Other secrets are not included either - my banks PhotoTAN app doesn’t store any credentials etc.

AFAIK, applications allow their secrets to be backed up or not, and I'm not mad that my 2FA keys are no backed up and shipped overseas. I keep another copy of my 2FA codes in another application, so it's not a very big problem from my PoV, though.

> I keep another copy of my 2FA codes in another application, so it's not a very big problem from my PoV, though.

It's not a problem if you took measures to make sure you have a copy. It's a problem if you just take "full backups" for granted until you figure out that some things don't get included in "full".

It’s not “some things”. Its things where the app developer explicitly chose to tag them to not be included.

And yes, for years one had to do the physical cabled backup restores for this, then these same app developers learned how to exclude their data from those as well. However, as of iOS 12, 13 and 14, there seems to be decreasing to zero effective difference in what’s included between tethered (with password), local WiFi (with password), and OTA iCloud backups.

You may be able to forcibly back these up using a third party tool that also lets you back up sandboxed temp files and the like, tools like iExplorer:

https://macroplant.com/iexplorer/mount-iphone-disk-mode-file...

If you’re jailbroken, that can backup anything under root of course.

1Password has built in authenticator which is obviously backed up to their cloud.

I have Google Authenticator with 5 or 6 2FA accounts. Am I to understand that I can use another app like 1Password for those same accounts? I distinctly remember some of them explicitly telling me to use Google Authenticator.

You should be able to, yes. Google Authenticator is pretty basic where it's simply scanning a QR code to get the TOTP token and storing that locally. It's apps like Authy which screw you over by forcing you to use them and ONLY them for 2FA for websites who opt to use it in their service. They don't make it possible (iirc) to get the token out so you can use your preferred authenticator app.

But back to your point: I used to backup to Google Authenticator and LastPass's Authenticator to prevent me from losing access when I migrated to a new iPhone since they don't backup. They both worked just fine interchangeably.

Absolutely 100% yes, anything that works with Google Authenticator works with 1Password.

Arguably too well, as using 1Password to log in puts the 2FA on the clip board for the next step.

I switched to authy because I can use 2 devices (same "keys") and backup codes easily. I'm too clutzy not to have at least one backup device. I suppose most humans are.

Pretty much noone should be using any of the authenticator apps.

Get Keepass2Android, and it'll track TOTPs just fine. Throw Syncthing on their and you can securely get those to any device you own without involving Google.

Congrats, you have just negated the second factor in 2FA by having all your keys at one place in one application.

2FA is about having a factor which changes everytime you use it so if the medium is intercepted somehow the account isn't permanently compromised.

It's protection for when using untrusted computing devices, or because most people have their passwords in some way visible or shared.

TOTPs can't be reasonably made much longer then they are while still usefully entered, but my password database never leaves my own devices and neither does the password to it.

If someone compromises my phone to the level they can get that database, then they've already got my Google Authenticator or whatever DB as well anyway.

IMO this reduces the protection of 2FA significantly. For me 2FA is primarily not having a single device that's enough to compromise to get access to your important accounts. This means that I never have both factors (password and TOTP key in our case) on a single device. That's why

> they've already got my Google Authenticator or whatever DB as well anyway.

is of course good for them, but they still need to get my password from my other device.

If your device is compromised to the point that someone is reading out the content of non-online, encrypted DBs, or keylogging aggressively, then they've also got your email and can much more easily just send a password reset to 90% of everything out there.

2FA as the internet uses it has always been about dealing with accidental disclosure and public PCs.

As an owner of Xiaomi phone I consider all data on it to be available to mid- and high-profile parties at least in China. Which might eventually leak into my country as well.

That's why my phone doesn't have any bank software installed and doesn't have any password saved. It is logged into my google account though to which you probably can restore some passwords, but for all resources I care about (banking, investements, crypto, etc.) it's not possible. I also use separate email for those. If my HN or reddit account will be compromised via my phone - so be it, I don't really care. I can also tolerate compromised 2FA app as it's useless without passwords which are stored on another machine.

For most of us 2FA as it is works fine. Until I become a CIA operative or drug dealer I suspect the current setups are fine via companies like authy, 1Pass, and google auth.

It's a bit ironic to criticize Apple's mobile solution via an app built by its direct competitor. Google made the choice of not implementing backups for Google Authenticator, so that's really on them. I would recommend Authy for 2FA. It supports backup straight out of the box.