Import/export/user-managed backup/sync of secrets

[bobobo1618]

https://github.com/freeotp/freeotp-ios/issues/20 was a great start but limiting the mechanism to Apple's backup and restore feature severely reduces the usefulness and effectiveness of the feature.

Apple's mechanism only offers two ways to backup and restore a device:

• iCloud - this requires a paid account with enough storage for a full device backup (either 200GB for $2.99/mo or 2TB for $10/mo)
• iTunes - this requires regularly and physically connecting your device to a computer with iTunes installed

My guess would be that these mechanisms do not cover the majority of users or use-cases. They work when switching from an old iPhone to a new iPhone but if a phone is lost, stolen or damaged, the user is out of luck unless they frequently back up their iPhone. Same goes if the user switches from iOS to Android or vice-versa.

In order to better address these users and their use-cases, I have a few suggestions:

• Add iCloud sync, possibly with an extra password. The iCloud backup means that iCloud is already an attack vector so there's little extra risk when enabling iCloud sync. iCloud sync would ensure that the data is frequently backed up even if the user doesn't sync with iTunes or backup their entire device to iCloud.
• Add an encrypted import/export feature. This wouldn't help with frequency but would allow the user to back up their OTPs at will and transfer them to and from an Android device.

[throny]

Thanks for describing it in detail! Exactly what I would expect from a backup functionality in FreeOTP :)

Especially the second suggestion is what I am missing.

[OE2WNL]

As users probably don't trust iCloud with their data (especially when they don't backup iphone to icloud) I would suggest to add a sync feature to some online-storage - i.e. nextcloud (via WebDAV), FTP, ... This would work as a frequent backup and more important also enable using FreeOTP on several devices (iPhone,Android,Windows,Linux). Every time the user adds a new token the whole accounts-file get's encrypted and synced and is shortly after available on all devices.

The password manager Enpass is a good example for this (having the passwords on several devices through password encrypted file shared on i.e. nextcloud)

What do you think? Greetings Wolfgang

[phil-hudson]

Just wanted to bump this thread, an export feature is the last bit missing imo.

Will this be prioritised?

Thanks!

[phil-hudson]

How open would the team be to an import/export feature like that of Google Authenticator, where you can display a series of qr codes on one device and scan them with another.

The main issue for me with FreeOTP at present is that it will be very difficult to transfer OTPs across devices, e.g. when upgrading.

[daweedm]

A good start would be to add the ability to export the OTP as QR-codes as said above.

I think that feature was available in the past - when the design of the app icon was blue and not the current grey one - then we could at least show some data about the OTP like the secret. I don’t understand why this feature was removed.

[OddHouseGames]

Currently what is the process for backing up tokens?

• Not requiring Touch ID and then backing up to cloud? Is this secure?
• Or can you backup locked tokens to iCloud? Or do you remove and re-add as unlocked and then backup?

Just trying to make sure we are covered in the case of a device issue.

Also, if you delete the app and reinstall, will the tokens be deleted if haven't backed up to iCloud? Do locked tokens get backed up?

I was previously using the beta flight test version but recently it warned me that there could be data loss, so does switching back and forth possibly lose your data?

I think I had to switch to the public version because the test flight expired.

Edit---------- Actually the Standard Notes open source and encrypted app has a token vault function, so I'll probably just use that to create a duplicate of the token.

[phil-hudson]

Any chance we can get some kind of solution prioritised please? This is a pretty important feature for an authentication app.

Thanks

[tripolskypetr]

At this moment I'm using https://2fa-pwa.github.io due to the lack of a token export feature. The source code is in public domain. Might be useful

[nook24]

Could we please get an export feature? For me it would be also ok to just display the key so I can put them into a second location to have a backup in case I lost my phone.