Transferring Google Authenticator to new phone

Recently, my old smartphone is showing sign of age and it is time to upgrade to a new phone. Transferring Google Authenticator app to my new phone is pretty straight forward. Just use the web version of Google Account page or head straight to https://accounts.google.com/b/0/SmsAuthSettings#devices and click "Move to a different phone" to start transferring Google Authenticator app to the new phone.

NOTE :

If you encounter error such as your Google account does not have 2-step verification and your account is managed under Google Apps, you need to login to the Google Apps control panel, head to Security tab, click on Basic Settings and tick Allow users to turn on 2-step verification. If you trouble doing that, refer to https://support.google.com/a/answer/175197?hl=en

Alright, I also use Google Authenticator for couple of non-Google applications such as my hosting services login and non-Gmail email account. Using "Move to a different phone" method aforementioned WILL NOT transfer those accounts!

To move these accounts to my new phone, I will have to disable the old 2FA (two factor authentication) at my servers or hosting providers and generate new QR codes again to be scanned with Google Authenticator app.

Contrary to popular and mis-guided belief out there, you can have multiple Google Authenticator applications running on different devices to generate verification codes for your logins instead of a single device such as your smartphone.

Each time I setup a two-factor authentication for login purpose, I make sure that I've at least 2 devices to scan the QR codes. One to keep with me(such as a smart phone) and one for backup/safe storage in case of something goes wrong.

If you need know which devices that have been used to generate verification codes and which devices had been deactivated. You can easily do that if you use Google Authenticator app.

Go to https://myaccount.google.com/security?pli=1 , scroll down and click review devices. (or you can go straight to https://security.google.com/settings/security/activity ).

Wrapping up

Two factor authentication is a must now, especially for those accounts dealing with servers rendering services to web and mobile applications. Without two-factor authentication, crackers can gain your access credential easily by spear phishing method such as one happened recently to Page Fair.

References :

https://www.socketloop.com/tutorials/golang-how-to-implement-two-factor-authentication