FTC fines Twitter $150M for using 2FA phone numbers for ad targeting

Re:FTC fines Twitter $150M for using 2FA phone numbers for a... by davis on Wednesday May 25, 2022 @06:01PM (#31511243)

There's actually a very good reason to not use Google Authenticator actually.

They don't offer any backups (at least on iOS) and as a result, if you lose your phone, you are hosed. Google Authenticator also doesn't use iCloud for backup for files like other apps. I also just assume at this point no one owns that app and that it'll never get backups because that's how Google operates.

I've seen multiple people lose their TOTP codes this way and have been locked out of their accounts. Or even the more simple case, they buy a new phone, restore from backup and just assume everything is peachy then send their old phone back and then don't realize it until they open the app for the first time.

Use something with cloud backups for your safety.

[ Parent | on HN ]

Re:FTC fines Twitter $150M for using 2FA phone numbers for a... by nicce on Wednesday May 25, 2022 @06:08PM (#31511316)

Authy does not allow to make local backup (export) and it is fully closed source, not really transparent. I wish there were better alternatives.

[ Parent | on HN ]

Re:FTC fines Twitter $150M for using 2FA phone numbers for a... by PausGreat on Wednesday May 25, 2022 @06:47PM (#31511818)

Ravio OTP on iOS

[ Parent | on HN ]

Re:FTC fines Twitter $150M for using 2FA phone numbers for a... by 8organicbits on Wednesday May 25, 2022 @06:13PM (#31511363)

I suppose you're talking about automatic backups, but at least on Android you can manually "transfer accounts" to export to another device over QR codes.

[ Parent | on HN ]

Re:FTC fines Twitter $150M for using 2FA phone numbers for a... by saurik on Wednesday May 25, 2022 @06:17PM (#31511405)

On iOS, I do see this feature, but it claims it will move the account, as opposed to "copy" it, and so, if it is a backup mechanism, they are explicitly pretending it isn't one.

[ Parent | on HN ]

Re:FTC fines Twitter $150M for using 2FA phone numbers for a... by MarioMan on Wednesday May 25, 2022 @06:36PM (#31511670)

Although it is primarily designed and labeled as an export mechanism, I can verify that it does work as a backup mechanism. I regularly use it to sync up new 2FA accounts to a backup phone. Simply choose to keep the accounts after exporting.

[ Parent | on HN ]

Re:FTC fines Twitter $150M for using 2FA phone numbers for a... by bogwog on Wednesday May 25, 2022 @06:06PM (#31511297)

I got scared as hell a few years ago when an update bricked the app, so launching it caused it to immediately crash. Fortunately, reinstalling the app fixed it without losing any data.

But since then I started actually backing up my recovery codes, and whenever I create a new account somewhere, I set up 2FA on three separate apps on my phone just in case.

[ Parent | on HN ]

Re:FTC fines Twitter $150M for using 2FA phone numbers for a... by SoftTalker on Wednesday May 25, 2022 @06:11PM (#31511344)

They offer one-time backup codes that can be used if a device is lost. I'm not sure if this is Google or the site, but for every login where I've set up Google Authenticator I have copied the backup codes to my password manager for that account. I'd agree that a lot of people might not do that however.

[ Parent | on HN ]

Re:FTC fines Twitter $150M for using 2FA phone numbers for a... by Dylan16807 on Wednesday May 25, 2022 @06:31PM (#31511590)

Google the site has backup codes for logging in to Google. Completely unrelated to the data in Google Authenticator.

Google Authenticator used to have no way to get the data out, but does now have an export. It still has no normal backups.

[ Parent | on HN ]

Re:FTC fines Twitter $150M for using 2FA phone numbers for a... by jve on Wednesday May 25, 2022 @06:12PM (#31511353)

Luckily services makes clear that you should print backup codes in case you lose 2FA.

As for Android Google authenticator - there is export function, that generates QR code for all tokens. You can't screenshot it, but can take a photo with different device and print.

[ Parent | on HN ]