I have a concern about software TOTP. As tptacek knows (but I'll mention as background for other readers), the various authenticator apps use the standardized TOTP algorithm [1]. This algorithm uses a private key that the server and the client (your phone) have in common.
The question is, where is the private key stored on your phone? According to some posts from 2012 or so [2], on Android, Google Authenticator stores the key unencrypted in an sqlite database, which you can look at if you have rooted your phone.
This seems insecure. Is this still an issue with Android? Are Apple products any better?
The question is, where is the private key stored on your phone? According to some posts from 2012 or so [2], on Android, Google Authenticator stores the key unencrypted in an sqlite database, which you can look at if you have rooted your phone.
This seems insecure. Is this still an issue with Android? Are Apple products any better?
[1] https://en.wikipedia.org/wiki/Time-based_One-time_Password_A...
[2] https://www.howtogeek.com/130755/how-to-move-your-google-aut...