Skip to main content

PSA: Google Authenticator's Cloud-Synced 2FA Codes Aren't End-to-End Encrypted

Earlier this week, Google updated its Authenticator app to enable the backup and syncing of 2FA codes across devices using a Google Account. Now an examination by Mysk security researchers has found that the sensitive one-time passcodes being synced to the cloud aren't end-to-end encrypted, leaving them potentially exposed to bad actors.


Prior to the integration of Google Account support, all codes in the Google Authenticator app were stored on device, which meant that if the device was lost, so too were the one-time passcodes, potentially causing loss of account access as well. But it seems that by enabling cloud-based syncing, Google has opened up users to a security risk of a different sort.

"We analyzed the network traffic when the app syncs the secrets, and it turns out the traffic is not end-to-end encrypted," said Mysk via Twitter. "This means that Google can see the secrets, likely even while they're stored on their servers. There is no option to add a passphrase to protect the secrets, to make them accessible only by the user."

"Secrets" is a term used to refer to private pieces of information that act as keys to unlock protected resources or sensitive information; in this case, one-time passcodes.

Mysk said that its tests found the unencrypted traffic contains a "seed" that's used to generate the 2FA codes. According to the researchers, anyone with access to that seed can generate their own codes for the same accounts and break in to them.

"If Google servers were compromised, secrets would leak," Mysk told Gizmodo. Since the QR codes involved with setting up two-factor authentication contain the name of the account or service, the attacker can also identify the accounts. "This is particularly risky if you're an activist and run other Twitter accounts anonymously," added the researchers.

Mysk subsequently advised users not to enable the Google account feature that syncs 2FA codes across devices and the cloud.


Responding to the warning, a Google spokesperson told CNET it had added the sync feature early for convenience's sake, but that end-to-end encryption is still on its way:
End-to-End Encryption (E2EE) is a powerful feature that provides extra protections, but at the cost of enabling users to get locked out of their own data without recovery. To ensure that we're offering a full set of options for users, we have also begun rolling out optional E2EE in some of our products, and we plan to offer E2EE for Google Authenticator in the future."
Until that happens, there alternative services for syncing authentication codes across devices, such as Apple's own 2FA code generator and third-party apps like Authy.
This article, "PSA: Google Authenticator's Cloud-Synced 2FA Codes Aren't End-to-End Encrypted" first appeared on MacRumors.com

Discuss this article in our forums



Source: TechRadar

Popular posts from this blog

The Best Early Black Friday iPhone Deals

We've begun tracking early Black Friday deals for major Apple products like AirPods , and now we're focusing on iPhone. Specifically, in this guide we'll share the best early Black Friday deals on iPhone 15, iPhone 15 Plus, iPhone 15 Pro, iPhone 15 Pro Max, and more. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. Of course, there is a chance that we could see better deals on iPhone arrive as Black Friday gets closer. This is a risk anyone has to take while shopping during the holidays, so with that in mind, many of the deals shared below are currently their best prices ever seen. More information on these sales can be found in our Black Friday Roundup . Best iPhone and Accessory Deals iPhone 15 Pro/Pro Max for up to $1,000 off at AT&T iPhone 15 Pro with free Apple TV 4K and Apple One six month subscription at Verizon AirTag

iPhone 13 Pro vs. iPhone 15 Pro Buyer's Guide: 50+ Differences Compared

The iPhone 15 Pro brings over 50 new features and improvements to Apple's high-end smartphones compared to the iPhone 13 Pro, which was released two years prior. This buyer's guide breaks down every major difference you should be aware of between the two generations and helps you to decide whether it's worth upgrading. The ‌iPhone 13‌ Pro debuted in 2021, introducing a brighter display with ProMotion technology for refresh rates up to 120Hz, the A15 Bionic chip, a telephoto camera with 3x optical zoom, Macro photography and photographic styles, Cinematic mode for recording videos with shallow depth of field, ProRes video recording, a 1TB storage option, and five hours of additional battery life. The ‌iPhone 13‌ Pro was discontinued upon the announcement of the iPhone 14 Pro in 2022, but it is still possible to get hold of it second-hand. Our guide helps to answer the question of how to decide which of these two iPhone models is best for you and serves as a way to c

GiliSoft File Lock 3.4

A new program to encrypt and hide to protect files and folders and disks and make it safer. download : http://www.gilisoft.com/download/FileLockPro42.exe

Best Cyber Monday Apple Accessory Deals Available Today

Yesterday we shared a huge list of deals on Apple products for Cyber Monday , and now we're shifting our focus to accessory sales from popular third-party retailers. This includes discounts from Sonos, Twelve South, Nomad, Satechi, and many more. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. Many Cyber Monday deals are known to sell out fast, so keep that in mind when browsing our posts and shopping online today. If you see something you're interested in, be sure to snag it quickly. You can also check out Cyber Monday deals on Apple products in our individual posts listed below. The Best Cyber Monday Apple Deals The Best Cyber Monday AirPods Deals The Best Cyber Monday iPhone Deals The Best Cyber Monday iPad Deals The Best Cyber Monday HomePod Deals The Best Cyber Monday Apple Watch Deals The Best Cyber Monday MacBook Deals