<story><title>Google Authenticator cloud sync: Google can see the secrets, even while stored</title><url>https://defcon.social/@mysk/110262313275622023</url></story><parent_chain></parent_chain><comment><author>patmcc</author><text>It&amp;#x27;s a tradeoff. They could let (or require) a password be entered to encrypt&amp;#x2F;decrypt it on each device, but then people would be ticked off when they forget their password and can&amp;#x27;t recover their 2FA stuff.&lt;p&gt;They should have handled it the same way they do Sync in chrome, and I expect they will eventually. But, as always, unless a service advertises that it&amp;#x27;s full E2EE &lt;i&gt;and&lt;/i&gt; you can verify that, assume it&amp;#x27;s not.&lt;p&gt;One part of this that&amp;#x27;s funny to me:&lt;p&gt;&amp;gt;&amp;gt;&amp;gt;Also, 2FA QR codes typically contain other information such as account name and the name of the service (e.g. Twitter, Amazon, etc). Since Google can see all this data, it knows which online services you use, and could potentially use this information for personalized ads.&lt;p&gt;I guarantee you, Google knows which online services you use in about 800 other ways, it doesn&amp;#x27;t need to scrape it from your 2FA accounts.</text></comment>
<story><title>Google Authenticator cloud sync: Google can see the secrets, even while stored</title><url>https://defcon.social/@mysk/110262313275622023</url></story><parent_chain></parent_chain><comment><author>nomilk</author><text>&amp;gt;  if someone obtains access to your Google Account, all of your 2FA secrets would be compromised.&lt;p&gt;This overlooks that fact Google itself also has access to your 2FA secrets, which could be even worse considering Google could be requested to peer not just into the user&amp;#x27;s &lt;i&gt;google&lt;/i&gt; account, but into accounts they have with other companies&amp;#x2F;organisations too.</text></comment>