How to migrate accounts to new Google Authenticator app?

Question

I broke my cellphone which had the Google Authenticator app and several other accounts attached to it for two factor authentication like Dropbox, Evernote, AWS, etc. Now I got a new phone and installed the Google Authenticator app on it as per the instructions given here - https://support.google.com/accounts/answer/185834?hl=en#phone

But now in this app I don't see codes for other accounts (Dropbox, Evernote, etc.). Is there a way to get all of them migrated to this new app or I need to recreate them? Also, if I need to recreate them, how do I do it, because Evernote won't even let me sign in from any device w/o two factor authentication code. I can use backup codes for some accounts, but I don't have backup codes for all of them?

Please provide some suggestions. Thank you.

Answer 1

This is actually what you have to use backup codes for. If you can still access your old device and it's rooted you can backup the database and restore it on your new phone.

However, if you can no longer access your old phone and you do not have recovery codes you have to contact their support and sort it out with them.

This is the purpose of two-factor authentication, if the second factor is inaccessible you can no longer access your account. If someone knows your password they can't do anything without your phone aswell.

This is also why services like authy are really sketchy due to the second factor not being offline-only.

Answer 2

If you have a backup application, you may be able to back up the app's data, sync it to the cloud, and restore it on the other device. The one time I tried that it just made Authenticator crash on startup.

If you saved the secret keys you're given, which is a good idea as long as they're secure and separate from your passwords, you can re-enter them on a new phone by finding a secure QR-code generator (a local or JS-based one that doesn't send the data to any server) and formatting each one like this:

otpauth://totp/LABEL:USERNAME?secret=SECRET&issuer=ISSUER&counter=N

Turn that into a QR-code and Authenticator will scan it. Or find a tool that will do both:

http://dan.hersam.com/tools/gen-qr-code.html

If you have any "counter" based codes, you'll need to know how many times you used it, which could be problematic, but those are fairly rare.

If you didn't save the secrets, your only option is to recover the database from the application, either from a backup or directly from the device. It's under:

data\com.google.android.apps.authenticator2\databases\databases

You can open that up with sqlite3.exe or any SQLite UI.

sqlite> .headers on
sqlite> select * from accounts;

You'll get a table with the secrets, counters, etc., that you need to use.

If you can't get the database from authenticator, then you have no choice but to use whatever mechanism is available for each site. It's very rare that a site will ever give you the secret for a second time, generally the best you can do is get in some other way, disable 2FA and re-enable it with a new secret.

Answer 3

Here is what I did when I migrated to a new device:

1. Install the Authenticator App on the new device

2. Go to the 2-step verification site

3. I then clicked on "Switch to SMS/voice"

   • You can try to click on "move to a different phone"

1. I then had authenticator text me the verification code so I could sign in with my google account on the phone.

4. I then opened the authenticator app and set it up like it was the "first time" I used 2-step authentication.

5. Visit the "Help Page" in evernote to see if you can gain access without a backup code. When you first enable 2-step in evernote, they require you to get a text message before you can enable authenticator app. So if I lose my backups, I can still gain access by having them SMS a code to my phone. Or, if that fails, and I don't have codes, I can try and contact support.

After signing up, I logged out, then logged back in. On the page to enter the code, I clicked on "I need help getting a verification code".

Answer 4

As of April 23, 2020, Google Authenticator was updated to version 5.10 with a new feature:

What's new

• Added the ability to transfer accounts to a different device, e.g. when switching phones
• [...]

This feature allows to transfer (and possibly long-term backup?) selected accounts with QR code. Note that this approach only works if the source device is still working.

To export the accounts:

1. Open Google Authenticator app
2. Tap the overflow (3 vertical dots) menu on the top right
3. Select "Transfer accounts"
4. Select "Export accounts"
5. Verify yourself on the lock screen
6. Select accounts to be exported (default: all)
7. Tap the "Next" button
8. The QR code will be generated and shown

To import the accounts:

1. Open Google Authenticator app
2. Tap the overflow (3 vertical dots) on the top right
3. Select "Transfer accounts"
4. Select "Import accounts"
5. Press the "Scan QR code" button
6. Scan the QR code