android-otp-extractor

Not sure if this is still accurate or not, but you used to be able to use the element inspector to export your keys from the Authy chrome extension (I can't find the original script I used, but I did find this one for developer mode [1]). This is how I migrated to WinAuth (dead project, but still works. Theoretically secured by windows itself, so shouldn't matter I think?). I've since migrated my mobile devices to Aegis[2], which I'm trusting sandboxing to secure; new otp are still added to Authy solely as backup. Aegis supports importing from a bunch of apps, as does android-otp-extractor, both need root to do so. Aegis can also import backups from a bunch of different apps. [1] https://gbatemp.net/threads/extract-your-totp-keys-from-auth... [2] https://github.com/beemdevelopment/Aegis [3] https://github.com/puddly/android-otp-extractor

Oh heck, found the answer, apparently so? Cool. https://github.com/puddly/android-otp-extractor

If you have a rooted Android phone, I wrote a tool to pull secrets from most popular OTP apps: https://github.com/puddly/android-otp-extractor

> Not to mention Google Authenticator deliberately prevents these stored tokens to be backed up and transferred to a different device, which makes upgrading devices troublesome. It doesn't offer export in the app UI. It's not doing anything to prevent you from backing up the tokens yourself; they're stored in the clear in the sqlite database for the app. If that's too much for you, there's a good chance https://github.com/puddly/android-otp-extractor can get them automatically.

I have been doing the same on AOSP with the andOTP app. Can't get why large companies/universities have boners for proprietary crap like duo. A company comes along and says, "Here's some textbook standard stuff, and here we add our lock-in on top of it. Would you like the lock-in ?" And everyone says, "Yes please." For those suffering, this helps: https://github.com/puddly/android-otp-extractor Edit: Responding to your edit >with the second one being very long and only known to your hardware. There are standards for this like totp and HOTP, TOTP/HOTP don't provide phishing protection. Neither does Duo (which is largely HOTP), but that's a different issue. >but instead of having basically password managers for these secret keys, we get SMS auth and duo and authy, with no way for a normal person to generate otp codes on their actual compute

Google disabled backups for their Authenticator app so I don't think they will ever let you export the secrets. I wrote an application to automate OTP secret extraction for just about every app out there after trying to migrate a few dozen tokens from Google Authenticator to AndOTP. You might find it useful: https://github.com/puddly/android-otp-extractor