<story><title>Google Authenticator cloud sync: Google can see the secrets, even while stored</title><url>https://defcon.social/@mysk/110262313275622023</url></story><parent_chain><item><author>patmcc</author><text>It&amp;#x27;s a tradeoff. They could let (or require) a password be entered to encrypt&amp;#x2F;decrypt it on each device, but then people would be ticked off when they forget their password and can&amp;#x27;t recover their 2FA stuff.&lt;p&gt;They should have handled it the same way they do Sync in chrome, and I expect they will eventually. But, as always, unless a service advertises that it&amp;#x27;s full E2EE &lt;i&gt;and&lt;/i&gt; you can verify that, assume it&amp;#x27;s not.&lt;p&gt;One part of this that&amp;#x27;s funny to me:&lt;p&gt;&amp;gt;&amp;gt;&amp;gt;Also, 2FA QR codes typically contain other information such as account name and the name of the service (e.g. Twitter, Amazon, etc). Since Google can see all this data, it knows which online services you use, and could potentially use this information for personalized ads.&lt;p&gt;I guarantee you, Google knows which online services you use in about 800 other ways, it doesn&amp;#x27;t need to scrape it from your 2FA accounts.</text></item></parent_chain><comment><author>trickstra</author><text>I don&amp;#x27;t think Google will use those secrets to look into your other accounts, but they can be politely requested by some governments to divulge the secrets, and not tell you about it. Then those governments would have no problems looking into your other accounts. And I&amp;#x27;m not talking only about the US government, other governments can have dubious standards for requesting user data, such as failure to parrot the &amp;quot;facts&amp;quot; approved by their ministry of truth (China, Russia, and everyone in their sphere).&lt;p&gt;Not to mention Google can be hacked.</text></comment>
<story><title>Google Authenticator cloud sync: Google can see the secrets, even while stored</title><url>https://defcon.social/@mysk/110262313275622023</url></story><parent_chain><item><author>patmcc</author><text>It&amp;#x27;s a tradeoff. They could let (or require) a password be entered to encrypt&amp;#x2F;decrypt it on each device, but then people would be ticked off when they forget their password and can&amp;#x27;t recover their 2FA stuff.&lt;p&gt;They should have handled it the same way they do Sync in chrome, and I expect they will eventually. But, as always, unless a service advertises that it&amp;#x27;s full E2EE &lt;i&gt;and&lt;/i&gt; you can verify that, assume it&amp;#x27;s not.&lt;p&gt;One part of this that&amp;#x27;s funny to me:&lt;p&gt;&amp;gt;&amp;gt;&amp;gt;Also, 2FA QR codes typically contain other information such as account name and the name of the service (e.g. Twitter, Amazon, etc). Since Google can see all this data, it knows which online services you use, and could potentially use this information for personalized ads.&lt;p&gt;I guarantee you, Google knows which online services you use in about 800 other ways, it doesn&amp;#x27;t need to scrape it from your 2FA accounts.</text></item></parent_chain><comment><author>jxy</author><text>The problem is now they know your TOTP secrets, they are only one password away from pretending to be you.&lt;p&gt;And actually, they serve you emails, so password is moot for most of the sites today.</text></comment>