Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to turn on Google's two authentication factor on but first I'd like to understand how it works.

Specifically I'd like to use the Google app for smartphones (btw I checked the FAQ and this is not a question about smartphone but a question where smartphone are on-topic because they interface with a computer).

So I do not want to use the "receive a SMS for authentication".

My question is about the Google app: how does it work? Is everybody downloading a different app or is the app somehow "seeded" for your specific Google account?

Also what happens if you somehow lose your smartphone? How can you then re-install that Google app and how do you re-seed it (if it needs to be seeded)?

Basically I'd like to understand how Google manages to do the equivalent of a RSA device (?) using a Google app.

share|improve this question
The Google Authenticator app is open source if you want to check it out :) – slhck Aug 9 '12 at 13:56
up vote 4 down vote accepted

Everyone is downloading the exact same Authenticator app at the same time. When launched for the first time, the app will ask for your Google login information and at the same time generate a unique ID for your phone (kind of like the serial number on RSA devices.) That unique ID will then be linked to your Google account which will be used for two-factored authentication.

If you were to lose your smartphone, that unique ID associate your smartphone to your Google account will be blacklisted on Google'server to prevent anyone who knows your password AND have your smartphone in their possession from logging into your Google account.

share|improve this answer

Yes, it's "seeded" to your specific account. If you lose your phone you redownload the software. This destroys the capability of the old software to provide the needed key to get in (it uses the old salt, your newly d/l'd and logged in software uses the new one it just created). You redownload it using the process you used to get it in the first place.

An excellent article is available here.

share|improve this answer
it's not seeded to account, more like device-specific. If you have a backup of the device keys(using something like Titanium Backup on Android), restoring the backup on any device, new or old will result in Google auth working with the new device – Sathya Aug 9 '12 at 14:20
I was using the term "seeded" in the way the original question was asked. That's why I put quotes around it. I felt if more explanation was needed (that it's keyed, not seeded), it would be provided by the linked article. "restoring the backup on any device, new or old will result in Google auth working with the new device," Only if there isn't a new paring for the two factor authentication system, and you have a backup code "You can also create a batch of ten backup codes, which you can use to authorize a computer. " That was taken from the article, and there is a link to it. – Everett Aug 9 '12 at 14:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .