Issue 247 in google-authenticator: How to transfer data/backup when switching handsets?

[google-aut...@googlecode.com]

Status: New
Owner: ----
Labels: Type-Defect Priority-Medium

New issue 247 by l...@goh.me: How to transfer data/backup when switching
handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

I have the authenticator app loaded on both iOS and Blackberry. When I
change handsets, how do I make a backup of the data and port it over to the
new handset?

[google-aut...@googlecode.com]

Updates:
Owner: klyu...@google.com

Comment #1 on issue 247 by klyu...@google.com: How to transfer data/backup

when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

Google Authenticator does not export/back up key material by design. To add
keys/account to another instance of Google Authenticator, you'll need to
follow account-specific instructions. For example, for Google Accounts, go
to https://accounts.google.com/security, then click on 2-step verification
settings, then click on "Move to a different phone".

[google-aut...@googlecode.com]

Comment #2 on issue 247 by prof7...@gmail.com: How to transfer data/backup

when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

backup functionality should be implemented, otherwise its impossible to
backup the keys without rooting the device. An easy to use backup function
for important data should be considered essential functionality for
**every** app and even more so for an app that manages private keys that
cannot be restored otherwise and whose loss could even result in financial
damage! Users should be enabled to have full control over their data!

--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings

[google-aut...@googlecode.com]

Comment #3 on issue 247 by harni...@gmail.com: How to transfer data/backup

when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

Google allows for this migration path, however there are many cases where
3rd parties use Google Authenticator but do not have the recovery methods
that Google has (ex: one-time use print-out passwords). Ideally 3rd parties
should offer "recovery/migration" methods, but many will not invest the
effort to do this, and some even charge for the service.

It would be preferable to have this be an option, perhaps at installation
time for keys/accounts. If export is allowed, then the given account
information can be exported.

[google-aut...@googlecode.com]

Comment #4 on issue 247 by l...@lukiyanets.com: How to transfer data/backup

when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

I have 10 accounts in Google Authenticator for 6 unique applications. Only
one of those is Google. How do I move all of this to a new device? If I go
to each application and reset 2-factor authentication - that's 1-2 hours of
work.
There absolutely has to be a simple and secure backup/restore functionality.
Since Google Authenticator can be backed up / restored on rooted phones,
you cannot use "security" as the excuse for the absence of this feature. It
is a prime example of security by obscurity - pain for users, but still not
a deterrent for a skilled attacker.

[google-aut...@googlecode.com]

Comment #5 on issue 247 by g1adrift: How to transfer data/backup when
switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

Would it be at all possible to use Google as an intermediary for
transferring all TOTP secret keys stored in g-a to a new device? The app
does have Internet permissions, so it wouldn't need to add a new permission.

I envision it would work exactly like the phone transfer mechanism works
(which I haven not yet tried), but also acquires an encrypted copy of the
secret keys from the mobile app over the Internet. The encryption key could
be exchanged by the two devices visually, via QR code. Google would provide
the transfer authorization (by authenticating the user through the web).
The only attack vector (aside from physically having the devices in hand) I
can see here is a MITM attack where someone fakes the Google server. In
this case, the attacker would still not be able to extract the TOTP keys as
the encryption key protecting the data transfer is exchanged offline.

I suppose you do add a possibility of someone having access to both your
device and Google account (say, by a unlocked laptop), cloning your secret
keys without your knowledge. To mitigate that, you could add a
self-destruct mechanism to it in order to ensure that there are only one
copy of the secret keys.

As a user of the authenticator for 7 different services (one is Google), I
do find it frustrating that I need to go through a lot of effort to migrate
to a new phone.

[google-aut...@googlecode.com]

Comment #6 on issue 247 by jaime...@gmail.com: How to transfer data/backup

when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

Surely Authenticator could support a mechanism that allowed you to export
an encrypted blob, with a strong key inputted at export time. Either
gathered from the user, or generated using entropy on the device from
random swiping or something.

It would be on the onus of the user to safeguard access to this key and to
the encrypted blob. And it would be of little risk provided authenticator
enforced a certain bar for key strength.

I too have 2-factor auth enabled for 10+ services. Many of them financial,
with no way to work around the 2-factor authentication should my phone get
lost, stolen, or bricked. I am absolutely terrified to lose access to my
phone.

2-factor codes are VERY important pieces of data. Too important to not
backup.

[google-aut...@googlecode.com]

Comment #7 on issue 247 by robson...@gmail.com: How to transfer data/backup

when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

This is driving me crazy. I started using 2FA some time ago on many
different sites and migrating to a new phone was a HUGE issue. This is
something that can actually drive me AWAY from using 2FA, I can't image
using it on 2-3 times more sites and having to go through that dreadful
process again.
2FA is great for security, but issues like these won't help making it more
popular and widely used.

[google-aut...@googlecode.com]

Comment #8 on issue 247 by sotir...@gmail.com: How to transfer data/backup

when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

Google Authenticator is great but when it comes to moving all those codes
to a new phone is totally sucks!!! Really Google guys why can't you spend a
couple of hours to create a backup/restore solution. My gut feeling is that
just like most new things young tech folks workout they are always left
half done because its always cool to move to something else.

[google-aut...@googlecode.com]

Comment #9 on issue 247 by jaime...@gmail.com: How to transfer data/backup

when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

I notice there is already a data export and data import package in the
Authenticator source.

https://code.google.com/p/google-authenticator/source/browse/?repo=android#git%2Fsrc%2Fcom%2Fgoogle%2Fandroid%2Fapps%2Fauthenticator%2Fdataimport

@Alex Klyubin I realize this is intended for migrating between App
versions. But surely we could extend this, *without* weakening the security
model, to support exporting encrypted blobs, and importing encrypted blobs.
The important piece being that the secret used to encrypt the blob must NOT
be one guarded by a 2factor account. We could either use a password
generation scheme using swipe+accelerometer entropy gathered at export
time, or simply make it clear to the user that they need to pick a unique
master password.

I know that export/import is not implemented by design. But it is a bit
short sighted to not change your stance on that. People end up either not
using 2factor at all, or doing bad things like saving copies of the
barcodes or serialized seed strings. Or even worse, rooting their devices
and installing third party backup apps that have root access to their
authenticator data.

This is clearly not better. Really hoping to win you over :).

Heck, I am tempted to redo all my 2factor codes and print out paper copies
of my barcodes. But that really seems silly (and painful) when there is a
perfectly reasonable technical solution.

[google-aut...@googlecode.com]

Comment #10 on issue 247 by ozonot...@gmail.com: How to transfer

data/backup when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

...and seems that Google don't give a fuck about this nightmare. I have 45
DIFFERENT ACCOUNTS inside my Authenticator and now I have to change my
cellphone. Damn the day I choose to use this crap...

[google-aut...@googlecode.com]

Comment #11 on issue 247 by dim...@gmail.com: How to transfer data/backup

when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

it's really really important thing to backup-restore such kind of data

[google-aut...@googlecode.com]

Comment #12 on issue 247 by adil.hin...@gmail.com: How to transfer

data/backup when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

Seriously guys, moving "1" google account is not much of an issue, but what
about people who are using several Google accounts + Facebook, Dropbox etc.
etc. Backup/Restore should bring all that stuff back. What is the reason
that this is not happening?

[google-aut...@googlecode.com]

Comment #13 on issue 247 by rayjon...@gmail.com: How to transfer

data/backup when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

I agree, so use this app in the meantime, or use Authy, since Google
Authenticator doesn't allow you to backup/move your 2fas.

https://code.google.com/p/winauth/

[google-aut...@googlecode.com]

Comment #15 on issue 247 by nospam...@gmail.com: How to transfer

data/backup when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

What if you lost your phone then what !

[google-aut...@googlecode.com]

Comment #16 on issue 247 by nospam...@gmail.com: How to transfer

data/backup when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

I think if you can't backup those keys, we probably shouldn't use it, .. i
have one for battle net and some times i had to reset the phone totally
forgot about the battlenet authenticator on it, and now i got to go and
reset it, .. proof of id the whole crap really annoying.

Worse what they consider proof of identity can be faked ! There's no such
thing as proof of identity all those things copies of something can be
acquired from someones mailbox or obtained by hacking into someones
computer, .. and faked or altered through some photoshop, ..

[google-aut...@googlecode.com]

Comment #17 on issue 247 by augu...@favetti.net: How to transfer

data/backup when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

We really need this option of moving all acounts from one device to
another... recreate them all is a way of saying: stop using this app!

[google-aut...@googlecode.com]

Comment #18 on issue 247 by ftmvid...@gmail.com: How to transfer

data/backup when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

I have five 3rd party apps on the authenticator..how can I easily move them
to a new phone without having to have to spend an hour setting everything
up all over again?

[google-aut...@googlecode.com]

Comment #19 on issue 247 by philcal...@gmail.com: How to transfer

data/backup when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

I'm really worried I will lose my phone or something like it, then how will
i access Accounts that I have set up on it? What the hell!? There is really
no way to back up or migrate the data?

[google-aut...@googlecode.com]

Comment #20 on issue 247 by stephen....@gmail.com: How to transfer

data/backup when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

Please implement a secure import/export option in this app. Thank you.

[google-aut...@googlecode.com]

Comment #21 on issue 247 by devendra...@gmail.com: How to transfer

data/backup when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

Glad I found this issue before changing my device, so I can do some
preparations then. But in case we lost our device, what we can do? Not all
sites and applications I used are supported print out code. Google, please
dont make this guardian angel become demon lord that prevent us from heaven
gate. Thanks

[google-aut...@googlecode.com]

Comment #22 on issue 247 by richarda...@gmail.com: How to transfer

data/backup when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

How about a compromise? If Google Authenticator does not allow the
exporting of keys, then it should not allow the importing of keys ! It
should, instead, refer users of services that are non-google to alternative
2FA management services (ie Authy etc).

[google-aut...@googlecode.com]

Comment #23 on issue 247 by mikeraws...@gmail.com: How to transfer

data/backup when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

come on google - you know this is BS - you need to enable a way to recover
from a lost phone

[google-aut...@googlecode.com]

Comment #24 on issue 247 by kyoun...@gmail.com: How to transfer data/backup

when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

The only way to do this currently is to root your phone so that you can do
a true full backup. This would void warranties, though, so not a good
option. Echoing others' sentiments, this *is* possible to do securely, it
just takes some interest and motivation from the maintainers.

It's sad, because you hear frequently that there is a balance of security
and convenience that works well. This is one of those situations that
people are crying out for that balance, but currently the security side is
winning.

Human behavior dictates that people will probably start deciding that the
risk of losing their phone is higher than the risk of non-2FA credentials
being stolen -- which is then a sad day for security.

[google-aut...@googlecode.com]

Comment #25 on issue 247 by sybergh...@gmail.com: How to transfer

data/backup when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

Actually this isn't even security winning; as a result of this, most
providers make it easy to get back in your account without your 2FA.
If it was harder to lose your 2FA, more of them would do like Amazon
and make you jump through hoops to get back into your account without
it.

This ultimately hurts security more than it helps.

[google-aut...@googlecode.com]

Comment #26 on issue 247 by david.ha...@gmail.com: How to transfer

data/backup when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

Google.. this really is a critical issue. Now I have to keep my old phone,
just to access some secure websites. Not good enough.

[google-aut...@googlecode.com]

Comment #27 on issue 247 by Sparrr...@gmail.com: How to transfer

data/backup when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

+ 1 for importance

[google-aut...@googlecode.com]

Comment #28 on issue 247 by nicol...@gmail.com: How to transfer

data/backup when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

I just learned of the inability to move my codes from my old iphone to my
new nexus 5 today. I have 20+ codes and this revelation was quite
disturbing.

But I want to thank you Google. This is the perfect opportunity to drop
Google Authenticator and start using authy.com.

http://techcrunch.com/2013/11/21/authy-goes-where-no-two-factor-authentication-system-has-gone-before-to-multiple-devices/

thanks for everything Google. Really appreciate it.

[google-aut...@googlecode.com]

Comment #29 on issue 247 by Traco...@gmail.com: How to transfer data/backup

when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

Got the same. I had a Google Auth to protect my 7 different business
accounts (mostly trade sites) and then my phone broke and was sent to
warranty repair. I got it back but I lost all my google auth
accounts!!?!!?!? And google don't offer support to customer -there is no
phone number/email/chat !!!?!?!?!?!?!?!? F..... !!! SCAM!!!!!

[google-aut...@googlecode.com]

Comment #30 on issue 247 by dskl...@gmail.com: How to transfer data/backup

when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

This feature would be great. But you always need to back up your 2FA seed
when you enter it.

[google-aut...@googlecode.com]

Comment #31 on issue 247 by m...@teamreed.us: How to transfer data/backup

when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

Uh, and you should also have hard copies of everything on your drive?
Don't ask for flames, bro.

[google-aut...@googlecode.com]

Comment #32 on issue 247 by dskl...@gmail.com: How to transfer data/backup

when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

Bring the flames. If just one person backs up their seed before losing it,
because of reading this, it's worth it.

Don't be terrified to lose your authentication. Reset it while you still
can and keep a copy of the seed you enter.

[google-aut...@googlecode.com]

Comment #33 on issue 247 by m...@teamreed.us: How to transfer data/backup

when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

Its fine advice, but in reality google influences security for the 99% and
this isnt actually protecting anyone. I myself destroyed a phone by
accident. Oops. It was not funny and didnt make things more secure. Now I
use authy. Tl;dr thanks for the debate, gotta go now.

[google-aut...@googlecode.com]

Comment #34 on issue 247 by kisl...@gmail.com: How to transfer data/backup

when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

+1 for the ability to do this. Perhaps a secure way to transfer the URIs
via NFC.

[google-aut...@googlecode.com]

Comment #35 on issue 247 by sybergh...@gmail.com: How to transfer

data/backup when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

You know, guys, "do this or we'll use a different product" isn't really
much of a threat. Google didn't make this product as a revenue stream; they
made it to improve security, which cuts customer service costs and retains
customers. Like many such things, if it creates an ecosystem whereby third
parties make better versions and their customers use those things, it's a
total win for Google.

When you say "I'm going to switch to Authy", Googlers are high-fiving. Some
of them are probably using Authy too.

[google-aut...@googlecode.com]

Comment #36 on issue 247 by sam.ming...@gmail.com: How to transfer

data/backup when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

If you're using the GAuth Authenticator app,
https://marketplace.firefox.com/app/gauth-authenticator/, you can gain
access to your username + secret access key via this file,
$HOME/.gauthauthenticator-XX/YY.default/webappsstore.sqlite. With this info
in hand you can recover the info you need to re-setup another instance of
any Google Authenticator on whatever device you so choose.

This is the command to recover your info from that sqlite .db file.

$ sqlite3
$HOME/.gauthauthenticator-XX/YY.default/webappsstore.sqlite 'select * from
webappsstore2'
1001:f:ln.daarbg.sppa.htuag.:http:80|accounts|
[{"name":"m...@somedom.com","secret":"MYSECRETLONGKEYWOULDBEHERE"}]||

[google-aut...@googlecode.com]

Comment #37 on issue 247 by g33ka...@gmail.com: How to transfer data/backup

[google-aut...@googlecode.com]

Comment #38 on issue 247 by sam.ming...@gmail.com: How to transfer

[google-aut...@googlecode.com]

Comment #39 on issue 247 by asol...@gmail.com: How to transfer data/backup

when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

Switching to Authy because of this.

[google-aut...@googlecode.com]

Comment #40 on issue 247 by its....@gmail.com: How to transfer data/backup

when switching handsets?
http://code.google.com/p/google-authenticator/issues/detail?id=247

I finally gave up on this app and bit the bullet and reset all of the
accounts I had on it. I have completed the migration to Authy and removed
Google Authenticator from my devices. They should really warn people who
are installing Google Authenticator about the lack of backups or migration
paths to save people this kind of hassle in the future.

[google-aut...@googlecode.com]

Comment #41 on issue 247 by Lance.Ba...@gmail.com: How to transfer
data/backup when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

I found the best solution is to just save a copy of the QR code image. I
normal base64 encode the image and just stick it in a password safe program
like keepass.

[google-aut...@googlecode.com]

Comment #42 on issue 247 by cov...@gmail.com: How to transfer data/backup

when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

I have to get the battery replaced on my iPhone, so I'm looking at a pains
taking process of transfer 15 accounts to another device manually? Ouch.

[google-aut...@googlecode.com]

Comment #43 on issue 247 by BenTura...@gmail.com: How to transfer

data/backup when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

So Apple will soon release the iPhone 6. So if I make a backup of my iPhone
5 and restore the backup to my soon to have new iPhone 6, all my 2FA will
not work anymore ?!

Millions of people buy new phones, and they will all lose their 2FA ?!

Seems I'll have to invest some time into authy.com

[google-aut...@googlecode.com]

Comment #44 on issue 247 by BenTura...@gmail.com: How to transfer

data/backup when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

Actually I did some more searching on google and it seems there is a way:
http://easybitinvesting.com/bitcoin-trading/backup-google-2fa-iphone/

I made the backup, now the waiting is for the iPhone 6. Once I got it, I
will make a new backup of my iPhone 5 and restore it to the iPhone 6. I can
only hope 2FA will still work.\

This user confirms it is working:
http://www.geekzone.co.nz/forums.asp?forumid=76&topicid=144259&page_no=1#1048538

[google-aut...@googlecode.com]

Comment #45 on issue 247 by robson...@gmail.com: How to transfer

data/backup when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

So yeah, yesterday I spent my evening moving my 2FA to Authy
(http://goo.gl/PsIbSQ) and it's just so much better.

Since it doesn't seem Google gives a f*** about this issue (it's like 18
months old), I recommend moving to a different app before you lock yourself
out of your accounts.

[google-aut...@googlecode.com]

Comment #46 on issue 247 by pikachu...@gmail.com: How to transfer

data/backup when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

I am moving to Authy too

[google-aut...@googlecode.com]

Comment #47 on issue 247 by edme...@gmail.com: How to transfer data/backup

when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

The solution in #44 works great with itune backup..... iphone 5 failed to
bring the passwords and google authen data into iphone 6. I reset wiped
the iphon6 to factory settings, the backed up the Ip5 with encryption and
restored it to the ip6. Google auth is now working on the ip6.

Next question.... Does the icloud backup save encrypted and will it carry
over the passwords and google auth?

[google-aut...@googlecode.com]

Comment #48 on issue 247 by edme...@gmail.com: How to transfer data/backup

when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

The solution in #44 works great with itune ENCRYPTED backup of ip5 restored
to ip6. iphone 5 failed to bring the passwords and google authen data
into iphone 6. I reset/wiped the ip6 to factory settings and started over.

I backed up the Ip5 with encryption to Itunes, and restored to the ip6.

Google auth is now working on the ip6.

Next question.... Has anyone restored from icloud backup and was able to
have a functional google auth? I suspect its encrypted but nothing would
surprise me....

[google-aut...@googlecode.com]

Comment #49 on issue 247 by greg.all...@gmail.com: How to transfer

data/backup when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

after iCloud restore, Google authenticator had *no* entries

[google-aut...@googlecode.com]

Comment #50 on issue 247 by fac...@gmail.com: How to transfer data/backup

when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

I really don't get this...I have replaced my iPhone 5 under warranty and
even bricked it with the iOS 8 upgrade and recovered it from a backup
recently and all my 2FA keys where restored. Today I backed it up and
restored it to an iPhone 6 and all my keys are gone. I wiped my 5 before
I figured this out. So I just restored my iPhone 5 and my keys are
back on the 5.

I do not encrypt my itunes backup to my mac. But I don't understand why
my keys are kept from iphone 5 to iphone 5....but not iphone 5 to iphone 6.

[google-aut...@googlecode.com]

Comment #51 on issue 247 by fac...@gmail.com: How to transfer data/backup

when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

Ok, well restored my iPhone 5 (up till it started syncing apps), then did
an encrypted backup to my mac. Then did a manual restore to my iphone 6
and my google auth keys are back.

I guess the moral of the story is always use encrypted backups to itunes.

[google-aut...@googlecode.com]

Comment #52 on issue 247 by aureli...@gmail.com: How to transfer

data/backup when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

This is crazy to retains users like that.
When dealing with security, backup/restore/export/import are basic features.

[google-aut...@googlecode.com]

Comment #53 on issue 247 by banas...@gmail.com: How to transfer data/backup

when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

I forked the last open source version for Android and implemented
backup/restore functionality. I don't recommend anyone use it though,
because #security.

https://github.com/banasiak/AuthenticatorPlus

[google-aut...@googlecode.com]

Comment #54 on issue 247 by BenTura...@gmail.com: How to transfer

data/backup when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

OK. It worked for me too. During the restore, at first I got different
authentication codes, but when the restore was done I got the same
authentication codes as they were on my "old" iPhone.

[google-aut...@googlecode.com]

Comment #55 on issue 247 by paternos...@gmail.com: How to transfer

data/backup when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

Another user here with 20+ accounts moving to authy

[google-aut...@googlecode.com]

Comment #56 on issue 247 by vanzon...@gmail.com: How to transfer

data/backup when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

My phone broke. Got a new one the same day. But turned out there are no
icloud or any other backups of the vault. If 1Password can do this in a
secure way - I'm sure Google should be able too.

I was now locked out many services that don't have a strategy to deal with
this situation, such as Gandi. Removing 2FA again from all of those
services without being able to log in, is a real pita. You can imagine
having to call with all of these companies and proving you are who you say
you are. Only to find yourself in a spot with no 2FA again. Not a very good
spot to be in.

Since I can imagine it's common for people to switch phones every so often,
I want to warn everybody that this can (will) happen to you too. Please
stay away from Google Authenticator until this issue is addressed.

[google-aut...@googlecode.com]

Comment #57 on issue 247 by gurdas...@gmail.com: How to transfer

data/backup when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

Just switched from Google Authenticator and Microsoft Account apps to Authy
for this reason.

[google-aut...@googlecode.com]

Comment #58 on issue 247 by tikiraw...@gmail.com: How to transfer

data/backup when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

very disappointing that this doesn't work as intended.

[google-aut...@googlecode.com]

Comment #59 on issue 247 by mahrens...@gmail.com: How to transfer

data/backup when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

Moving to Authy as well - I just received a new phone and have 20 account
to move over - this is ridiculous.

[google-aut...@googlecode.com]

Comment #60 on issue 247 by adil.hin...@gmail.com: How to transfer

data/backup when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

I did not confirm this but what I hear is that on iOS, if you use itunes to
backup to your computer and make sure to choose encryption for the backup,
after the restore Google Authenticator still works as before. My experience
was more of hit and miss on that kind of backup/restore, so I finally took
the plunge to move to Authy. No complaints.

[google-aut...@googlecode.com]

Comment #61 on issue 247 by emoge...@gmail.com: How to transfer data/backup

when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

Just got a new phone for x-mas. I have 8 different accounts on
G-authenticator. Not being able to move the credentials to the new device
is a *major* pain. This is a very big design flaw, please fix.

[google-aut...@googlecode.com]

Comment #62 on issue 247 by ita...@gmail.com: How to transfer data/backup

when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

must change device and retain my work related management accounts
what a pain!

[google-aut...@googlecode.com]

Comment #63 on issue 247 by and...@fernandes.org: How to transfer

data/backup when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

By not having authenticator backup, it makes social engineering into your
accounts that much easier.

I just had a broken phone replaced, and had to sweet-talk my way though a
bunch of tech support folk to set up new authenticator tokens.

This is a serious issue for usability and seriously impacts security.

[google-aut...@googlecode.com]

Comment #64 on issue 247 by uzi....@gmail.com: How to transfer data/backup

when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

+1

This is a basic feature that google should either figure out or point out.
I get it that transferring your google auth data to a new phone is easy,
but if the app support 3rd parties, the same should apply to those.

[google-aut...@googlecode.com]

Comment #65 on issue 247 by shayne...@gmail.com: How to transfer

data/backup when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

*** for ios versions

New phone and 15 accounts (We use this through all the department apps).
This is pretty essential functionality, people.

[google-aut...@googlecode.com]

Comment #66 on issue 247 by vassilio...@gmail.com: How to transfer

data/backup when switching handsets?
https://code.google.com/p/google-authenticator/issues/detail?id=247

Site using Google 2FA went offline

In my case, one of the many sites I use google authentication with, is
hacked and down for now. Since I have an investment with them I have to
keep my keys in order to be able to show that I have taken all precautions
on my side. And since my phone needs urgently a reset, I'll have no option
but to root it, get keys out, and disable google authenticator everywhere
until it gets a reasonable solution to this issue. I don't really
understand how people still rely to this system, when there is such a
dangerous disfunctionality, IMHO all sites should keep *away* from
implementing google authenticator 2FA.