Comment by mannkind | Hacker News Reader

Comment by mannkind | Hacker News Reader

Looks like the someone from Authy is reading this thread so here goes...

Feedback:

* Registration is a bit complex; all texts to my phone (with the exception of the registration code) are completely useless as the real info is sent to my email address

* Why is my backup encryption key in plain text? A dual-password field with sameness-checks would be better.

* Restoring from backup is... painful.

- I cannot just reregister my phone, I have to go through a reset process online. Ok, fine. I got texts to my phone instantly but the reset email took almost 15 minutes to reach me.

- The app crashes tapping any "GA" item other than the first one.

- I have to type in my encryption key for each "GA" item and the app crashes each and every time.

- The first time I tried to restore authy, after typing in my encryption key to recover the first "GA" item, the app crashed and wouldn't let me recover any of the other items... I had to do the whole process all over again.

* Aside from the above, the app looks and works so much better than Google Authenticator on my iPhone (5). Especially considering I'll be able to recover my tokens when switching phones -- Google Authenticator completely screws this up (broken phone? Get a replacement phone from Apple? Upgrade? All your tokens in Google Authenticator are lost, even if you recover from backup).

#1. Agree. Although non-technical people do find them useful. You yourself are just a bit more technical and have a better grasp. Problem is some of our users didn't even know how to install an App etc. We are thinking of ways of making registration easier.

#2. Because you only have to enter it once and it's a complex field, you should see what you are typing.

#3. App shouldn't crash. The reason you have to go through the online process is mostly for security, you wouldn't want it to be just super easy. The other problems seem like bugs.? We'll fix those, can you e-mail me at support@authy.com, i'd like to get repro steps.

#4 Thanks!. Let's get the above fixed.

I factory reset my iPhone when I got it unlocked, and synced it with iTunes. I had it make a backup before doing so off course, after this iTunes told me it was unlocked, and restored the backup. My tokens continued to exist within the Google Authenticator app, and I was able to log-in/out of gmail without issues.

    All your tokens in Google Authenticator are lost, even
    if you recover from backup

So restoring from an iCloud back-up won't save my bacon in this case?

Nope :/

I've had to do it twice now (once for an upgrade and once for a defective-phone replacement) and both times, after restoring from iCloud, Google Authenticator was empty.

It's not a dealbreaker, but it's still a big inconvenience. I had to use recovery passwords in two locations and convince another to disable two-factor auth so that I could reset it.

If you use Google Authenticator App this is true. If you use Authy App without backups, this is also true. But if you enable Authy Backups then you will always be able to get your accounts back, no matter what.

This isn't true on Android - if you've done a full backup, you can restore Google Authenticator without disabling and re-enabling the service.

This doesn't work the way you think it does. The app itself it's backed up by Android OS, who know were, with every single account without any encryption.

I don't know what you're talking about - the kind of backup I'm talking about isn't a built-in Android feature, as far as I'm aware. There's no "who knows where" - if you back it up, you know where you're putting that backup.

Furthermore, Titanium Backup (and the like) provide you with the option to encrypt your backups.

Finally, Android ICS and later also provides full-disk encryption of the application storage area (which iOS does not).

I'm not sure what you mean on the last point -- iOS user storage is all encrypted with a key inside the device since the 3GS, and meaningfully since the 4S, which is unlocked in hardware whenever you enter your passcode. Everything is actually encrypted (except parts of the kernel, I think, but the bootloader is signed and does signature checks), but there are 4 classes of files, ranging from always encrypted to encrypted just with a key also stored on disk.

No Android devices (as far as I know) have hardware data protection; there is software full-disk encryption, but with that, you can extract the encrypted image and then brute force it at your leisure offline (or in EC2, FPGA cloud, etc.) (the S3 might or might not, but it's not officially supported in the APIs last time I checked)

It's a meaningful distinction because you have to enter passcodes to unlock ~frequently on a small screen, so they tend to be shorter than even screen saver passwords on desktops.

As far as I know, blackberry is still the only mobile OS which does full device encryption with a user key natively with platform security, but the parts of iOS which are not encrypted (some OS parts and the application binaries) aren't particularly security sensitive. It would be better if they had encryption as well -- I'm not sure if there is any protection applied to them for integrity.

I could be wrong; I haven't checked on the details recently, especially on Android, although I need to do so in the next few weeks for a talk at RSA 2013.

I'm still basically amazed at how good a job Apple did on iOS security on the 3GS and later. I wish Google would step their game up and implement NSA SE Android features and some hardware data protection (just buy RIM if you have to!).

I wish it worked that way on iOS; I'm not sure what Google is doing with the app that prevents it ... other apps+accounts work just fine after restoring from backup.

It works without issues for me when doing it locally using iTunes, not sure what would be different about iCloud based backups ...

iCloud backups don't include all keychain items, while iTunes encrypted backups do: https://ssl.apple.com/ipad/business/docs/iOS_Security_May12.... page 12.

Restoring locally from an iTunes account will (at least, the two times that I have done so it worked flawlessly)

Reply on news.ycombinator.com