Lost my iPhone and all the codes

[rvilde]

I lost my iPhone and al the codes. How can I move them to my new iPhone? Any help would be appreciated! Thank you!

[beaucollins]

The only way to recover the tokens is if you have made an encrypted backup of your phone through iTunes. Backing up a phone in this way includes the encrypted data in the phone's keychain.

If you have an encrypted backup, restoring your new phone using this backup will give you the codes.

If you do not have an encrypted backup, there is unfortunately no way to get the secrets. They are never transmitted by the Authenticator app in any way.

To restore access to the accounts protected by Authenticator you will have to go through the password/login recovery process that each of the websites provide. Usually you can get started by going to the login form for the website and clicking the "forgot password" link.

It's up to the website's staff to verify that you are the account owner and they all have different ways of doing this.

Best of luck!

[cosmoburn]

@beaucollins Could you clarify to me if Authenticator is using the kSecAttrAccessibleThisDeviceOnly mode to store entries in the system keychain, or if it is using a format that persists across devices?

[beaucollins]

kSecAttrAccessibleThisDeviceOnly is not specified for the keychain entries that Authenticator creates.

@ArthurSilveira the keychain modification for this app happens through the OneTimePassword library.

Keychain items for Authenticator will be included in an encrypted backup through iTunes. A phone that is restored using one of these backups will have the one-time password secrets restored as well because encrypted backups include all of the device's keychain entries. Since the keychain items do not include the kSecAttrSynchronizable attribute they will not be synced to an iCould keychain.

[cosmoburn]

Thank you for the reply @beaucollins

So from what I gather, since I only backed up my phone through the automatic iCloud backup then I'm shit out of luck as far as getting these codes back haha.

[beaucollins]

@ArthurSilveira right. You'll have to recover access to your accounts through the respective websites that host your accounts if you no longer have access to the one time password generators.

[cosmoburn]

@beaucollins thank you very much, lesson learned heh.