[Android Software/Hacking General [Developers Only]] codesplice:
Google Authenticator [APP]

App Name: Google Authenticator (@AppBrain)

Developer: Google, Inc.

Price: FREE

Google Authenticator is the handy-dandy mobile companion app to use with Google's recently-released 2-step verification. This security feature is in the process of being rolled out as an optional addition to all Google accounts. For those of you who aren't familiar with 2-step verification (or multifactor authentication, as it is more generically known), this process combines the security of something you know (username/password combination) with something you have (a hardware time-based token, in this case). Armed with only your password or only the token, an attacker will still be unable to access your account. As you can imagine, this increases the security of your account significantly - a very important measure when you consider the amount of personal information associated with your Gmail, GoogleCheckout, and other Google accounts.

Google has instructions posted to guide you through the setup process, and it really is quite easy. Once 2-step verification is enabled on your account, it is a simple process of scanning your account QR barcode into the Google Authenticator app, and then verifying that the generated numerical code is accepted by the web interface. From here on out, you will use the app on your phone to instantly generate a time-based numerical key that will be entered after your password anytime you log on to your account from a new computer. If you should lose access to your phone, never fear: 10 single-use codes are generated when you set up 2-step verification. These codes should be printed out and stored in a safe place, and can be used at any point you need access to your account but don't have your phone handy. You will also register an additional phone number with Google that can be used in a pinch; when requested, Google will send a time-based key via an SMS or voice message to an alternate phone number (of a relative or close friend, for instance).

Note that without your password that time-based key is worthless and will expire in a minute or so anyway. Your account is still safe even if an enemy knows what your key was at one point. For instance, the key that's currently generated for me is 155001. This doesn't help you gain access to my account at all - especially since it will have expired by the time this message gets posted.

Enabling 2-step verification will break any additional applications or devices that would otherwise have access to your Google account as they don't support the entry of an additional numerical key. Google's solution to this is pretty clever: Google will generate a single-use password for as many applications or devices as you need. This password is likely more secure than the password you normally protect your account with, and once an app or device is connected to your account with this password nothing else will be able to use that password to access your account. In our case, just enter the generated password into your Google Accounts settings on your Android device, and all the Google connections you use will be restored (Gmail, Gtalk, Gvoice, etc). There is also an easy way to manage authorized devices from your Google Account settings on the webpage. Remove an association, and that device will not have access to your account anymore - useful in the event that your phone is lost or stolen.

I highly recommend that you enable 2-step verification on your Google Account to protect your sensitive data. This simple step will increase your account's security exponentially, and is really not that much of an inconvenience. You can also use this app with your other accounts that require two-factor authentication (replacing an RSA keyfob, for instance), but I have not tried this yet.

Verdict: Easy-to-use added security for your personal information on the Google Cloud.

Screenshots: (courtesy of the application page)

1) Setup screen

2) Time-based keys