[mcherm]

There are numerous tools, Google Authenticator and Authy for example, that protect against this by securely storing the keys. In fact, I would venture to say that MOST users of authentication apps are using ones that provide a backup in case the phone is lost.

[crazygringo]

No, Google Authenticator does not securely store keys anywhere but your physical phone. If you lose your phone, they're gone.

The only thing it provides is a way to export from one device to another, but that requires having the first device still with you. [1]

On the other hand, yes fortunately Authy does provide cloud backups. But your average end user generally doesn't have the slightest idea of why they should use one authenticator app over another. Expecting them to do the research to figure out that they should use Authy over Google Authenticator in case they lose their phone is asking way too much. Again, completely user unfriendly.

[1] https://support.google.com/accounts/answer/1066447

[tzs]

Note that the export on the source device doesn't seem to have any way to actually know whether or not you are actually setting up a new phone. It just makes QR codes with the keys for groups of accounts that Google Authenticator on a new device can scan to import those accounts.

I can't see any reason you couldn't start the export process without having a new phone and take screenshots of the QR codes, then back those screenshots up to some secure place.

You should be able to later use those screenshots to restore those accounts to a new phone without needing to have the old phone.

I don't use Google Authenticator so have not tried this.

While the above should work, I'd recommend saving the QR code for each site when you sign up for TOTP at that site. That way you can easily transfer to any other TOTP authenticator. The Google Authenticator export seems to make QR codes that combine multiple accounts and I'm not sure any other authenticators would know what to do with those.

[crazygringo]

Yes, in theory that all makes sense.

But in practice it's utterly ridiculous. I already do all this work to store passwords in a password manager.

Now I'm supposed to have an entire separate backup strategy for 2FA that depends on screenshotting QR codes or remembering to save their text equivalents? It's just crazy user-hostile.