Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Google Authenticator Now Supports Backing Up 2FA Codes Using Google Account
- Thread starter MacRumors
- Start date
- Sort by reaction score
Hopefully you have a strong (20-30 character) passphrase on your apple ID, and are never a victim of passcode shoulder surfing. The problem with putting this passwords in an ecosystem with other data (especially email) is that you're reliant on the least secure fallback authentication method. Even Apple's recovery key's are now being abused to lock out accounts.
No thanks, I'll stick with 1Password.
Keychain is great if you're solo, but there's no provision for setting up shared vaults they way you can with 1Password and Bitwarden. (That said, it seems like Apple's Family Sharing would really benefit from shared passwords!)
LOL. Storing your codes on a google server is just asking to be pwned, all online services get breached eventually
The entire point of OTP's/authenticators is that it happens ON YOUR DEVICE where nobody else can access it
The entire point of OTP's/authenticators is that it happens ON YOUR DEVICE where nobody else can access it
LOL everyone is complaining about storing stuff on Google's server.
The first mistake is using any Google product in the first place.
The first mistake is using any Google product in the first place.
It's great that Google finally added a backup feature to Google Authenticator after all these years, but it's too late, and are the backups encrypted with a different password? What about a recovery key?
Good thought but about 4-5 years too late. Got tired of losing all my 2FA keys when I restored my iPhone, got a new one, etc. and moved to Authy instead.
Nice convenience at the expense of additional security. I don't use Google services though.
I'm really disappointed in what Microsoft Authenticator is doing to their product so I am trying Google's for awhile on a few users accounts. So far I kind of like it, escially the capability of transferring an account between phones when you get a new one. Microsoft's one can't transfer from an iPhone to an android phone, no matter how much you want it to.
Yes, I'd use the macOS/iOS/iPadOS/iCloud Keychain too if I wanted automated syncing or cloud backup for my OTP code generation. But my privacy and security preferences lead me to go with storage that is under my full control at all times and to not use any outside services to transfer critical information.
Me too, but I'm questioning the logic of keeping my second key on the same keyring, so to speak.
I mean... if you want to completely disregard the fact that hackers exist and that Google would happily hand over your keys to a government for whatever reason they come up with, then yeah... I guess you're safe letting Google store your 2FA keys.
Came here to write the same.
Except never would use a 3rd party authenticator or p/w manager.
Everywhere Authy or goog authenticator works so does iCloud Keychain’s authenticator.
I have used Authy ever since I had an issue with my phone and had to reset all my Authenticator codes.
Also like how it works cross-platform.
I use 1Password for storing usernames/passwords. Is there an advantage to using Authy for OTPs, and 1Pass for credential storage? I feel like having OTPs in 1P, means if 1P ever gets breached (bound to happen someday), then the OTPs get breached also.
Thoughts?
Also like how it works cross-platform.
I use 1Password for storing usernames/passwords. Is there an advantage to using Authy for OTPs, and 1Pass for credential storage? I feel like having OTPs in 1P, means if 1P ever gets breached (bound to happen someday), then the OTPs get breached also.
Thoughts?
I use Raivo for 1Password. I’ve been trying out ente Authenticator and that is cross platform, and looks promising.
Bitwarden started to offer TOTP in their app and I think its time I start to migrate from Authenticator to them.
I use the notes section of each login on my iCloud Keychain to store backup codes. Is that a bad idea?