News for hackers. Stuff that matters.

A comment on Flaw has Microsoft Authenticator overwriting MFA accounts, locking users out. Parent comment

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by josteink on Sunday August 18, 2024 @04:02AM (#41280892)
> apparently the Google Authenticator doesn’t back something up.

This is widely known and IMO a very good argument to use a different TOTP/2FA app than Google Authenticator. There's plenty out.

Personally I use Bitwarden pro, which lets you add TOTP keys directly to the account you're using it for, integrating it into the login-process. Very smooth.

And it sync/backs up across all my devices.

[ Parent | on HN ]
Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by felipelemos on Sunday August 18, 2024 @10:03AM (#41282447)
One could say you shouldn't store the 2FA along with your password.
[ Parent | on HN ]
Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by numpad0 on Sunday August 18, 2024 @11:41AM (#41283026)
But 2FA on a phone had been awkwardly okay. Could be because it's just too silly that adversaries can't take it seriously, but it's been okay.
[ Parent | on HN ]
Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by smitelli on Sunday August 18, 2024 @10:55AM (#41282739)
Not the parent, but I look at it this way…

Something I have: the database file.

Something I know: the master password to that file.

I figure the sprit of the advice is preserved for the most part. (Doesn’t keep me awake at night, anyway.)

[ Parent | on HN ]