Backup/Restore (onto new devices)

[GoProAndy]

Hi,
sorry for using this tool, but what is happens if I get a new iPhone? Is the content also lost after Restoring the iCloud Backup? Till now i use the the Google Authenticator app and here is all lost.
Thanks
Andreas

[mattrubin]

Authenticator tokens are stored on the iOS keychain, which can be backed up and restored to a new device via iTunes encrypted backup:

If you encrypt the backup, you can transfer the keychain information to the new device. With an unencrypted backup, you can restore the keychain only to the same iOS device.

I don't believe that an iCloud backup will restore the keychain to a new phone.

[bgelfand]

@mattrubin NSUbiquitousKeyValueStore could be used, although instead of NSUserDefaults being local storage, the keychain is used. I have been researching this myself and it appears that it might be an option, it looks to be secure as well without the option to be edited by a user. https://developer.apple.com/library/mac/documentation/General/Conceptual/iCloudDesignGuide/Chapters/iCloudFundametals.html It is just an idea, what are your thoughts?

[mattrubin]

@BrandonGelfand: As far as I can tell (after a quick look at the documentation), NSUbiquitousKeyValueStore is good for syncing small pieces of data via iCloud, but I can't find anything about using it with the keychain. Do you have more info on that?

Using the actual iCloud Keychain might be an option, or possibly writing user-encrypted backup files to iCloud file storage. Either way, this needs to be an optional feature. By default, your secret keys shouldn't leave the device you enter them on.

[bgelfand]

In regard to the iCloud keychain, I still can't find it in the documentation how to store it in the keychain so it syncs. NSUbiquitousKeyValueStore just holds the data on apples servers, when one of the users downloads the app on a different device, it syncs. Normally you store it locally in NSUserDefaults but it is obviously insecure. https://github.com/MugunthKumar/MKiCloudSync Gives an idea of how it syncs to and from, but with NSUserDefaults. I think all we would need to do is switch it with the keychain, but create our own system for sending the data. Apple provides some code that works great for receiving data and is the only one that syncs fine initially, it is just sending the data that we would need to do and adjust apples code to store it inside the keychain. Apple Code: https://developer.apple.com/library/mac/documentation/General/Conceptual/iCloudDesignGuide/Chapters/DesigningForKey-ValueDataIniCloud.html#//apple_ref/doc/uid/TP40012094-CH7-SW1

[bgelfand]

@mattrubin iCloud Keychain is the best option it seems, much less complex to. I implemented it inside of the app I am working on and it works like magic. https://github.com/soffes/sskeychain for the sync to work you need to use query.synchronizationMode = SSKeychainQuerySynchronizationModeYes; It is showing in my iCloud keychain and it doesn't appear that I can edit it. I think I might encrypt it with AES-256 so that way users don't edit it in the future if it is possible. Ok so they can edit it by clicking the Get Info option on double click, I think I will encrypt it using the same key for all users or their password if they choose to use one so they don't break the app.

[vjanelle]

FYI - I tried using a normal backup to move from an iphone 5s to an iphone 6+ and it appears my tokens did not make it through the transition. This has to be an encrypted one I suspect.

[PatTheMav]

After Apple "had" to give me a new iPhone (after they switched my display in the Apple Store but couldn't calibrate it), I lost all my 2FA tokens (because I could only to an iCloud Backup before the repair). So storing the necessary information in the iCloud Keychain would be great (apparently "LockDown" uses it, Authy uses their own infrastructure unfortunately).

So this is definitely a +1 from me, especially now that @mattrubin seems to be porting the whole thing to Swift (massive amounts of commits happened in the past few days).

I still prefer this app over others because of it's simple, straight-forward design and high speed (and being open source).

[jakeswenson]

I also love this app, and would love to see the OTP secrets stored in the iCloud keychain.
@mattrubin Thoughts?

[SurajGupta]

This would be THE feature that would kill Google Authenticator for good. Switching devices or reinstalling the OS and restoring data on the same device are painful experiences right now because of the need to re-establish TFA accounts.

Users have been asking Google for this since 2013:
https://groups.google.com/forum/#!topic/google-authenticator-issues/baROYFInQk4

[SurajGupta]

@mattrubin - thoughts on my last comment?

[putorti]

According to Apple, all iCloud backups are encrypted. However my last two restores have lost all my tokens. I may be mistaken but I do believe it worked at one point, but I've definitely lost all my tokens twice. My backup is 100% complete. Seems like a possible bug to me.

[putorti]

Also, maybe something is wrong on my end but I see the last update of this app on the App Store as September 29, 2014. So no updates in nearly two years.

[jakeswenson]

@putorti There has been a significantly awesome rewrite in progress to swift from objc. So i'd imagine thats why the long period of no updates. I'm not sure where @mattrubin has gone though :)
it'd be awesome to get an update, maybe i'm just looking in the wrong spot.

[beaucollins]

My vote is an encrypted export text file that initiates the share sheet (and the requisite import).

This allows me to get to my secrets while also letting me control exactly where they will end up.

[joshperry]

It looks like setting the kSecAttrSynchronizable key will automatically add a keychain item to the sync list.

However, the first caveat makes me wonder if this is wise as these OTP schemes are meant as proxies for hardware tokens and seem like they should be unique per device so that they can be managed (revoked) at device granularity. Does it make sense to have the same token on multiple devices?

Updating or deleting items using the kSecAttrSynchronizable key will affect all copies of the item, not just the one on your local device. Be sure that it makes sense to use the same password on all devices before making a password synchronizable.

[PatTheMav]

So here's what I saw another app doing: It allowed me to export my tokens as QR codes via the print function. That way I was able to "port" them into Authenticator by re-scanning those QR codes.

Secured behind Touch/Face ID this might be worth looking into.

Having used the iOS 11 betas, this saved me a lot (!) of headaches..

[Wuffeh]

What about the people who need to, or even would like to, "reset" their iOS device for some reason? This app makes it impossible without losing all 2FA information. I have not seen another app with this restriction.

How about adding an option to, securely via iTunes, export an archive of the tokens? (iOS 11 requires a passcode to trust a computer now, so this option would prove more secure than in the past.) :)

Edit: That backup could then be securely imported via AirDrop/iTunes etc. to the new iOS install.

@mattrubin thoughts?

[jakeswenson]

I agree with @PatTheMav. Even just give me the ability to see the token value, some how.

I understand the "uniqueness" argument, but give me some way of making my own decisions about how a value my HOTP tokens. (A button that says are you really sure you want to see the token?)

As of right now I get around this issue by not using QR codes anymore, I just tell the website to give me the token string and then I store it in my password manager and manually setup my authenticator tokens.

[metbril]

Since iOS 11 Apple allows backup of Health data in iCloud backups.

https://www.imore.com/how-sync-your-health-data-ios-11-and-how-it-works

Would now be the time to backup the tokens, too?

[cosmoburn]

Having recently lost my phone and having gone through a nightmare to get all my keys back what @metbril suggested is the same thing my friend who is an iOS dev said. This feature would keep me using this app.

[csaftoiu]

Why can't you display a QR code on old phone, and scan it from new phone to transfer everything?

[csaftoiu]

itunes doesn't exist anymore :((( how can i transfer to new phone?

[beaucollins]

itunes doesn't exist anymore :((( how can i transfer to new phone?

The iTunes feature now exists in macOS Finder.

1. Plug phone into computer with a usb/lighning cable
2. Phone will be listed in Finder under "Locations"

[beaucollins]

If you use iCloud Keychain with two-factor enabled for your Apple account I find that they are now synced.

See #330 (comment)

I have since moved to using macOS's built in two-factor system integrated into the system passwords.