Setup an additional authenticator app for 2FA on a second device

[Filipe]

Support intro

Sorry to hear you’re facing problems.

The community help forum (help.nextcloud.com) is for home and non-enterprise users. Support is provided by other community members on a best effort / “as available” basis. All of those responding are volunteering their time to help you.

If you’re using Nextcloud in a business/critical setting, paid and SLA-based support services can be accessed via portal.nextcloud.com where Nextcloud engineers can help ensure your business keeps running smoothly.

Getting help

In order to help you as efficiently (and quickly!) as possible, please fill in as much of the below requested information as you can.

Before clicking submit: Please check if your query is already addressed via the following resources:

• Official documentation (searchable and regularly updated)
• How to topics and FAQs
• Forum search

(Utilizing these existing resources is typically faster. It also helps reduce the load on our generous volunteers while elevating the signal to noise ratio of the forums otherwise arising from the same queries being posted repeatedly).

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can.

The Basics

• Nextcloud Server version (e.g., 29.x.x):
  • Nextcloud Hub 26 Winter (33.0.5)
• Operating system and version (e.g., Ubuntu 24.04):
  • Fedora Linux
• Web server and version (e.g, Apache 2.4.25):
  • AIO
• Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
  • AIO

Summary of the issue you are facing:

Hi, is more of a question.

I’ve succefully configured my nextcloud instance to work with 2FA (TOTP)

However, I don’t see if and how I can configure a further device for 2FA, as I’m about to replace my main smartphone (display is waiving goodbye) and I don’t want to deactivate 2FA at anytime during the transition.

Basically, I don’t see a QR-code in the security section of the settings.

Thank you in advance

Filipe

[scubamuc]

@Filipe welcome to the Nextcloud community

check out the official documentation;
Verwendung der Zwei-Faktor-Authentifizierung — Nextcloud 35 User Manual

use your appstore to find other providers/connectors:

see all two-factor apps:
Alle Apps - App Store - Nextcloud

example 2fa by mail;
Two-Factor email provider - Apps - App Store - Nextcloud

[scubamuc]

@Filipe

Basically, I don’t see a QR-code in the security section of the settings.

this is once only, but you can “manually copy” the key from one app to another to enable a different app on your mobile.

some apps like FreeOTP+ from f-droid let you share a QR code with other devices:

[bb77]

@Filipe

I don’t want to deactivate 2FA at anytime during the transition.

How long does it take you to set up the new device? Thirty seconds? You’d have to be extremely unlucky—and I mean extremely, almost impossibly unlucky—and your password would have to be very weak for an attacker to guess it in that amount of time and log in.

But yes, otherwise, export it from the existing authenticator app, as @scubamuc suggested. If that doesn’t work, simply display the secret in the app and enter it manually on the new phone.

Again, though, the risk is minimal. I’d say you’re more likely to win the lottery jackpot three times in the same year than for someone to successfully guess your password and log into your Nextcloud account during the brief moment that 2FA is disabled.

[Filipe]

Thank you @scubamuc and @bb77 for your answers.

Microsoft Authenticator app doesn’t seem to provide the option to copy the key so that will not work for me.

And what the probability concerns, that might be true but misses the point of my question. The motivation might be a migration to a new device or a permanent setup on a second device to prevent a SPOF.

But at least I know now, that I was not missing something obvious.

Thanks again for your time.

Filipe

[adelaar]

@Filipe

Microsoft Authenticator app doesn’t seem to provide the option to copy the key so that will not work for me.

Very well. It would probably have been advisable to research the various options available on the market before choosing a 2FA (TOTP) app.

I did just that before choosing the app and opted for one of the apps that stores the TOTP keys in a database file in *.kdbx format. This *.kdbx file can easily be copied or moved from one device to another, or synchronised between different devices (smartphone, laptop) via Nextcloud.

Compatible apps are:

• Android: KeePassDX, Keepass2Android
• iOS: KeePassium
• Windows, macOS & Linux: KeePassXC

Addendum:

Why did I opt for apps that use the *.kdbx format? It’s quite simple:
I imagined what would happen if I were to lose my smartphone, leave it on a train or misplace it in some other way. In that case, I’d naturally still want to be able to access all my TOTP-secured accounts easily and without too much hassle. That’s why I need up-to-date copies of the TOTP keys on several devices at all times. The best way to do this is by synchronising a single file, such as the *.kdbx file, via Nextcloud.

[bb77]

@Filipe

The motivation might be a migration to a new device or a permanent setup on a second device to prevent a SPOF.

Why “might” it be? Why not just tell us what’s what from the beginning? Although, to be fair, that would have been a bit of a shame, because then I wouldn’t have been able to make my not-entirely-serious comment.

But yeah, of course: having a backup of your TOTP secrets has its advantages, and even more so having them in a second authenticator app that can generate the one-time codes directly if your primary device isn’t available. However, since @scubamuc had already covered that aspect, I didn’t really have much to add.

Just for the record, though: synchronizing and copying TOTP secrets around can also introduce additional risk if those secrets are ever leaked, which is precisely why the TOTP specification doesn’t really intend for them to be retrievable after the initial setup. Features that synchronize or export TOTP secrets are therefore best viewed as convenience features rather than part of the core design.

By design, TOTP is intended to show you the secret only once during the initial setup. If you lose access to your authenticator, the intended recovery mechanism is the set of backup codes you can generate in advance. So, in that sense, Nextcloud’s implementation follows the TOTP specification, and so does Microsoft Authenticator.

The concern is that if an application lets you retrieve the secret later, then any vulnerability exposing that functionality could potentially allow someone else to retrieve the secret as well.

Also, from a strict security perspective, if you lose the device containing your authenticator app, you should treat the TOTP secret stored on it as compromised. This means that you should set up TOTP again to generate a new secret, rather than restoring and continuing to use the old one from a backup.

Just some things to keep in mind

And no, you’re not going to get hacked during the 30 seconds that TOTP is disabled, becuase you have to set it up again. That part of my previous comment was actually meant quite seriously.

[vawaver]

For my personal setup, the simplest solution is to avoid tying TOTP only to one physical phone.

I use a self-hosted Vaultwarden instance for this. This gives me access to my TOTP codes from any trusted device where I can access my vault, so replacing a phone or losing access to one device does not become a single point of failure.

Of course, this also means that the security of the vault itself becomes very important. So this is not necessarily the right solution for everyone, and it should be protected properly. But for my use case, having my passwords and TOTP entries in a self-hosted Vaultwarden setup is more practical than depending on one authenticator app on one phone only.

I still keep recovery codes separately as a fallback.

[adelaar]

@bb77

Also, from a strict security perspective, if you lose the device containing your authenticator app, you should treat the TOTP secret stored on it as compromised.

I dislike to contradict you, but on this point I must.

The TOTP codes aren’t stored unprotected on the smartphone. It’s no different from a password manager app. You need either biometric credentials or a password to open the *.kdbx file in apps such as KeePassDX or KeePass2Android. Furthermore, the device itself should also be protected by a PIN, biometric features, etc.

However, if you want to rule out even the small residual risk you described, you should not store the *.kdbx file on mobile devices but exclusively on the Nextcloud server and access the file online only. If the mobile device is then lost, you can simply block it from accessing Nextcloud.

[bb77]

That’s why I said ‘from a very strict security perspective’. But, yeah, sure. If you’re not a high-value target for state intelligence, it’s not very likely that someone will break into the device and steal the secret. Even state actors can’t always do it if there are no exploits available for that specific device or OS version.

Nevertheless, backup codes are designed for exactly that situation. So why not just use them and generate a new TOTP secret if the device is lost?

Of course, I understand that people want to use TOTP on multiple devices and therefore want syncing for convenience. But actual backups of the secrets aren’t really necessary, in my humble opinion. Besides, with self-hosted services like Nextcloud, you don’t even necessarily need the backup codes because you can always regain access anyway.

With any third party SaaS services, or if you use Nextcloud via a provider, things are of course different, and in those cases you should definitely store the backup codes and keep them somewhere safe.

[Filipe]

Hi adelaar,

Thank you for your helpful insights.

Very well. It would probably have been advisable to research the various options available on the market before choosing a 2FA (TOTP) app.

Here you are assuming that I chose the app based on a particular use case (like for instance nextcloud). But in fact, I’ve been using Microsoft Authenticator for many years now, so I decided to stick with it at first.

Gaining knowledge that it might not be the best choice is part of the process. Like moving away from Microsoft to nextcloud

I’ll check the apps - I had KeePassium already in the past as a password vault, so I will revisit it.

Thanks again

Filipe