Why does the Google Authenticator app have "obsolete" in its title on Play Store?

Does it work? Can I still use it for two-factor authentication? Is there a preferred method?


Looks like Google has released a new version of Authenticator (as of March 21, 2012) under a new package name: com.google.android.apps.authenticator2.

Old version: https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator

New version: https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2

Different package names means that you can have them both installed simultaneously, but my guess is that Google will eventually remove the old version from the Play Store.

Installing Authenticator 2 without uninstalling Authenticator allows Authenticator 2 to import your currently configured sites.

I've read a few posts from people claiming that Google lost their signing key, and this why they have to release a new app under a new package name. I want to emphasize that there is no evidence to support this claim. While it is true that signing keys cannot be changed with app updates and therefore require a completely new app/package name, a more plausible explanation could be that Google wants to integrate Authenticator more tightly (e.g., shared UIDs, signature permissions) with other apps (see below).

Additional info for those interested:

The signing key used on the old version of Google Authenticator (SHA1 fingerprint: 24:BB:24:C0:5E:47:E0:AE:FA:68:A5:8A:76:61:79:D9:B6:13:A6:00) is also used to sign: Scoreboard, Goggles, Finance, Google Voice, Shopper, Transalte, Chrometophone, Earth, Reader, and a few others.

The signing key used on the new version of Google Authenticator (SHA1 fingerprint: 38:91:8A:45:3D:07:19:93:54:F8:B1:9A:F0:5E:C6:56:2C:ED:57:88) is used to sign: Google Maps, Google Play Store, Gmail, Google+, Google Chrome and Google Music.

Update: Google has put up a blog post talking about the new up as well as the upgrade procedure.

  • 1
    Deleted my answer since yours now encompasses it. – Dylan Yaga Mar 22 '12 at 14:59
  • 2
    After importing the data Authenticator offers a link to uninstall the older version – Jader Dias Mar 22 '12 at 16:02
  • +1 for info on importing currently configured sites, which the app doesn't explain in its own site. – Diego Agulló Mar 24 '12 at 12:00
  • I thought you couldn't import data from other apps unless they used the same key. – o0'. Mar 29 '12 at 12:43
  • The most common way of sharing/importing data between apps is sharing a UID, which requires the same signing key on both apps. What Google did to get around this was they wrote an "export service" in the old authenticator app that can be called by any app on the phone. The service checks that the calling app has the correct signing key and package name, and then sends it the list of accounts. If the key or package name aren't what the old authenticator expects, the export doesn't complete. – davidbb Mar 29 '12 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.