Quick Win 4 of The Privacy Diet turns on two-factor authentication. Chapter 5 of De-Google Your Life moves your codes out of Google Authenticator. This page covers the three things that are left: accounts still using text-message codes, apps that won’t let your codes go, and a backup of your codes that you’ve proved works. That last one decides whether a lost phone is a bad afternoon or a lost email account.
1. Make a list
In your password manager, make a secure note called Two-factor. For each account that has it, write down how you sign in — a text message, an app, or a security key — and where that account’s backup codes are. Start with the ones that matter most:
- Your email. It can reset the password of almost everything else.
- Your password manager.
- Your bank, and anything else with your money in it.
- Your Apple or Google account, which holds your phone’s backups.
It takes twenty minutes, and it’s the list you’ll work down for the rest of this page. Keep it up to date as you go.
2. Pick your app
Chapter 5 recommends Aegis on Android, which keeps codes in an encrypted vault on the phone, and Ente Auth, on Android, iPhone and computers, which syncs them with end-to-end encryption. Both are in the replacement table.
It also suggests keeping your most important accounts’ codes out of your password manager, so one breach doesn’t hand over both. That’s the approach here.
3. Off text-message codes
A code by text message is better than nothing, but it’s the weakest kind. It depends on your phone number, and phone numbers can be moved to someone else’s SIM by talking a mobile network’s staff into it. An app’s codes never leave your phone.
For each account on your list that sends texts, go to its security settings and:
- Add an authenticator app as a two-factor method. Scan the QR code with your app, and type in the code it shows to confirm.
- Save the backup codes the site offers, and note where in your list.
- Remove the phone number as a two-factor method, if the site lets you. If it’s still there, someone with your number can choose it instead.
- Check the account’s recovery options. Some sites keep your number for account recovery separately from two-factor. A number left there can reopen the door you just closed.
Some banks only offer text messages. Then keep them — just make sure your mobile account has a PIN or password of its own, if your network offers one — many do, for exactly this.
4. Apps that won’t export
Chapter 5 covers moving from Google Authenticator. Two other common apps don’t let you take your codes with you:
- Microsoft Authenticator has no export to other apps. Ente’s advice is to set up two-factor again on each site, with the new app — and where a site lets you have two authenticators, add the new one before removing the old.
- Authy has no export in the app, and its desktop apps, which some older workarounds relied on, are gone. Ente lists community tools that extract the codes, but they handle your secrets unencrypted and, in Ente’s words, come with no guarantee. Setting up each site again is slower, and doesn’t depend on anyone’s tool.
When you set up two-factor again, most sites cancel the old code straight away — the old app’s codes stop working at that moment. Confirm the new app’s code is accepted before you leave the page, and only remove the account from the old app when your whole list is done.
5. Back up your codes — and prove it
Codes that live only on your phone are lost with it. Each app has its own backup:
Aegis. Set a vault password when it asks — automatic backups only work for an encrypted vault. Then Settings → Backups → Automatically back up the vault saves a backup to a folder you choose, every time something changes. Pick a folder that leaves the phone — for example, your Nextcloud folder through the Nextcloud app, if you have Nextcloud — or copy the backup file to your computer now and then. The backup is encrypted with your vault password.
Ente Auth. With an Ente account, your codes are synced, encrypted. Make an offline copy too: Settings → Data → Export → Encrypted. Choose a strong export password — it’s separate from your Ente password, and Ente can’t recover it — and keep the file somewhere other than the phone.
Put the vault or export password in your password manager.
Then prove it. Until you’ve restored a backup, you don’t know it works — the idea behind Be Your Own Cloud’s restore drills in Chapter 19. Install the same app on a second device: an old phone or tablet for Aegis, or Ente Auth’s desktop app. Import the backup there, and check that one code matches the one on your phone. Then delete the test copy.
6. Practise losing your phone
With your list in front of you, ask: if my phone fell in a river now, how would I get into each of these? For each account, the answer should be one of:
- Restore the authenticator backup to a new phone, from step 5.
- A backup code, from your list.
- A security key, if you have one.
Anything with no answer goes back to step 3.
7. Next: security keys for the few that matter most
For your email and password manager, a hardware security key — a small USB or NFC key that you tap to sign in — is stronger than any code, because it can’t be phished: it only answers the real site. Buy two, register both, and keep one at home. Chapter 5 suggests one for your Google account while you’re still using it. Passkeys, which Chapter 5 also covers, work the same way, using your phone or password manager instead of a separate key.
Official documentation
- Aegis and its source and documentation
- Ente Auth: migration and export, including Authy and Microsoft Authenticator
- Bitwarden: recovery codes
Stuck on a step? Get in touch.