port codes from other authenticators?

[eried]

hi, is there is a way to port, lets say google auth codes, to be generated by the flipper? (even if is a security risk)

[akopachov]

It depends on whether that another app allows you to get plain token secret somehow or not. If it allows then you may take that secret and just add it to Flipper Authenticator as usual.
If another app does not allow you to get plain token secret then unfortunately there is nothing what Flipper Authenticator can do on this. Details may depend on concrete app but in any case - plain token secret is a thing which you need to get somehow to be able to use Flipper Authenticator.

[irfn]

in case of Google Authenticator I used https://github.com/krissrex/google-authenticator-exporter to decode the QR from export.
I am able to use the totpsecret in otp-cli or others and get the correct codes. however on flipper zero authenticator I am getting a different incorrect code. any clues on what could be wrong?

Edit
found the issue. was entering Timezone: 5.30 instead of Timezone: 5.500000

[akopachov]

Glad you found and fixed the issue.

[eried]

in case of Google Authenticator I used https://github.com/krissrex/google-authenticator-exporter to decode the QR from export.

I moved out of google auth just because that stupid export way... to MS auth but now I wonder if they offer export too :/

[eried]

OK, so I am gonna add more info about this. If you have an android rooted device, then is easy to port your keys to the Flipper, 1) install Aegis auth, in import you can see there is support for many apps. IF this import does not work, then go to import file and see where is the source of the file coming from, try to get that file in another way and open it in SQLlite browser.

For example POWER+VOLUP in my tablet launches in recovery twrp, advanced options -> file browser, I can get the stored file Aegis told me the path.-

That's all :)

[akopachov]

Thank you for your input. I'll definitely add this method into a wiki

[eried]

yeah, it was very annoying that MS Auth saveguards the tokens in their cloud ecosystem making it almost impossible to get out

[akopachov]

well that is interesting, because, this also make them kinda vulnerable, as I pretty confident that such things as TOTP secrets should always stay offline regardless of how secure you think the cloud is (let read about LastPass breaches to anybody who will try to convince you otherwise)

[eried]

true! even better offline in the flipper in the pocket, I wish the "device" pin was more reliable tho, but it is fine :)