8

I'm using Microsoft Authenticator for 9 or 10 sites now, I like the added security it gives.

But what happens if I lose my phone?

I'm not worried about other people using the codes, they are pretty well useless without the 1st factor (username and password), but are those codes backed up somewhere? Can I apply them to a new phone?

3

in case you lose your phone every service has (or should has) a contingent plan.

In Outlook.com (Security Info) you can configure your phone to be called(sms too) after that you can generate a new QrCode to read in a new phone.

1

There is currently no way to back up these codes, unlike Google Authenticator on Android, which has a convoluted (but possible) backup process.

Best practice seems to be to backup the original QR codes yourself (the ones that you used when setting up the auth).

I wouldn't want to rely on each service's contingency plan, that sounds like it would be a nightmare if you needed to restore everything.

  • The point of using two step authentication is to rely on the provider's system. There is no point in "backing up the codes" because the app is paired with Outlook.com. If his phone is lost he goes into the service and disables the app. He can still access his sites in several other ways. The advice you are implying is don't trust two-step authentication. Also, Google and Microsoft use the exact same standards and you can use their apps on the opposite service with no issues. – caschw Jan 6 '14 at 5:04
  • 2
    I genuinely want to understand your comment. I now have 19 sites in my Microsoft Authenticator app, including facebook, google, microsoft, lastpass, dropbox etc. You are saying that whenever I change my WP8 phone, I need to manually go through the 2FA setup AGAIN for each of these 19 sites, rather than just using a backup of the original QR codes (or a backup of the Microsoft Authenticator app itself, if such a thing existed)? – Daniel Alexiuc Jan 7 '14 at 5:29
  • Many smaller web sites that implement 2FA have no contingency plan, or one that involves a long and difficult communications plan. Microsoft Authenticator should backup your keys to your Sky/OneDrive. – Donald Byrd Mar 15 '14 at 18:52
  • "Backup the original QR codes yourself" - how do you propose to do that? Just save all those QR images in some kind of secure store? – Dennis G Feb 3 '15 at 15:30
  • 1
    Exactly, you can save the images somewhere securely. Actually I don't back up the QR images, but I do backup the secret key associated with the qr image. Most providers will have the key available as an alternative to scanning the image. – Daniel Alexiuc Apr 20 '15 at 5:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.