Post
Topic
Board Serious discussion
Re: 2-Factor Authentication
by
monsanto
on 19/07/2018, 19:08:37 UTC
If you care about your privacy you shouldn't use any Google's product, no matter how good they are. It's how the company make its income, using your privacy.... Who knows if in 10 years we learn that in fact, it was another shady product
This is almost true for anything which isn't open source.

I have read Authy is far better than Google Authenticator.
I would recommend staying away from Authy, but if you are to use it then make sure to turn off multi device in the settings. This prevents recovery from other phones. If you ever want to transfer to another phone though this option will need to be enabled.



if you turn off multi device and lose your phone then you won't be able to recover. So keep that in mind.

I believe with Authy you can still recover password protected backed up 2FA codes, but I think there is a 24 hour waiting period during which they review your request.


What nobody ever really talks about is what happens when you lose your phone. I read that you can transfer it to a new phone, but if you lose it, you can't transfer it. That's really what has me paranoid. I think I might have to invest in a new phone, and keep my current one locked in a safe, and see if I can flash it, for in case something happens to it I can reinstall it to another phone.

You have a couple options. You could use Authy as mentioned above, or use a back up phone with google Authenticator, or use what I think probably is the best option: write down the secret 2FA seed on a piece of paper when you add it to your phone, and keep that list offline. Most sites will provide the seed along with a QR code of the seed when setting up 2FA. If you already have a site's 2FA setup on your phone, you can remove 2FA on that site and then add it again, this time physically writing the seed down at the same time you scan the QR code with Authenticator.