Import from Google Authenticator possible?

[cn-ml]

Will you add support for the google authenticator export/import? Is it even feasible?

Manually recreating every OTP secret is really much work. Is there a way to transfer existing keys instead of creating new ones?

[Bubka]

On iOS, the last GA version do not provides a true export feature, its much a transfer feature to another GA instance on another device (using a qr code), limited to 10 accounts at a time.

Is the Android app similar?

[qdm12]

Thanks! Do you mean on the client? It's on my phone, I don't think I can do that 🤔 Or do you mean on the server?

[Bubka]

Server side.

The security context detection is made by the browser based on the domain requested. If you open https://localhost/ it won't work, https://2fauth.app/ will (assuming 2fauth.app is the custom host added to your hosts file and declared as serverRoot in your virtualhost setup at apache/nginx level)

[Bubka]

Good, it's just a base64 encoded string : https://github.com/korki43/gauth-export/blob/main/src/domain/decodeUrl.ts

So it can be used to feed an import feature on 2FAuth. But how to pass a generated qr code in GA to 2FAuth in a simple way for the user? the operation might be tricky thinking

hum, it's not only base64 encoded, there is also a Protobuf serialization encoded. I had never heard about protobuf, it is not quite as easy as it sounds.

For the record:
Google Authenticator export format
protobufjs/protobuf.js
protobuf-php/protobuf

[qdm12]

it is not quite as easy as it sounds

The major difference is that xml, json etc. are machine readable and human-ish readable, but protobuf is only machine readable.
It's also coming from Google, I guess that's why they used here. Although to be honest, I find it a bit silly. It's usually useful for intensive backend applications since its encoding is better than e.g. JSON and the payloads are also smaller, but to export QR codes, what a weird design decision.

Anyway! You could generate JS code once to decode it using the proto file and https://developers.google.com/protocol-buffers/docs/reference/javascript-generated. You probably don't need to keep the proto file, or set up the js proto generator as a dependency or have it in your CI either, since the format is quite unlikely to change. Would you need it in PHP as well? I would tend to think this would only be on the client side right?

[cn-ml]

Although to be honest, I find it a bit silly. It's usually useful for intensive backend applications since its encoding is better than e.g. JSON and the payloads are also smaller, but to export QR codes, what a weird design decision.

The reason that Protobuf is used here instead of JSON or other human readable ML is simply due to its byte critical application. QR Codes can be configured with ECC while taking up more physical space, which in turn requires a better camera or picture quality. Protobuf, being a very compact binary serializer, reduces the space needed to transmit the data. The more compact the data on the QR code is, the easier it can be scanned.

It seems that there is also a PHP generator for protobuf available here.