<story><title>Google Authenticator now supports Google Account synchronization</title><url>https://security.googleblog.com/2023/04/google-authenticator-now-supports.html</url></story><parent_chain><item><author>tasuki</author><text>Do you and people you know have a safe? Where I&amp;#x27;m from, we generally don&amp;#x27;t use safes.&lt;p&gt;Do you consider your safe to be... safe? I&amp;#x27;d imagine it to be relatively easy to get into, by picking the lock or sawing through the safe.</text></item><item><author>justeleblanc</author><text>&amp;gt; And how are you supposed to handle the 2FA for your Google account? I mean I have U2F tokens which remove that concern, but that is far from the typical case. If you have the 2FA for your Google account in the Google Authenticator, which is probably a very common case, how does this entire thing work then when you need it, which is when you lose your phone?&lt;p&gt;You open your safe and you use one of the recovery codes that you wrote down when you setup 2FA.</text></item><item><author>fabian2k</author><text>Ahem, I think making it much easier to transfer and backup 2FA codes is extremely important to make this area more useable. But I&amp;#x27;m missing some parts here in this announcement how the data is protected? Is the security the same as for the Google Account itself, or are there additional checks or protection for the case where you need to restore 2FA to another phone?&lt;p&gt;And how are you supposed to handle the 2FA for your Google account? I mean I have U2F tokens which remove that concern, but that is far from the typical case. If you have the 2FA for your Google account in the Google Authenticator, which is probably a very common case, how does this entire thing work then when you need it, which is when you lose your phone?</text></item></parent_chain><comment><author>justeleblanc</author><text>&amp;gt; Do you and people you know have a safe?&lt;p&gt;Yes. I&amp;#x27;m not taking about a safe like you can see in the movies. Just a locked box.&lt;p&gt;&amp;gt; Where I&amp;#x27;m from, we generally don&amp;#x27;t use safes.&lt;p&gt;That&amp;#x27;s on you.&lt;p&gt;&amp;gt; Do you consider your safe to be... safe? I&amp;#x27;d imagine it to be relatively easy to get into, by picking the lock or sawing through the safe.&lt;p&gt;That&amp;#x27;s not the point. 2FA is about thwarting password leaks. If someone has physical access to my house &lt;i&gt;and&lt;/i&gt; knows my passwords, I&amp;#x27;m screwed, yes.&lt;p&gt;But since I don&amp;#x27;t live in a Jason Bourne movie, my threat model isn&amp;#x27;t a ninja who steals my passwords then comes into my house to hack my tiktok account. My threat model is breaking my phone and knowing that my backup passwords are in a minimally safe place where I expect them to be and weren&amp;#x27;t carelessly thrown away with old documents; and deter casual &amp;quot;attackers&amp;quot; like a niece who could be inclined to plunder my papers for coloring material.&lt;p&gt;And if I did live in a Jason Bourne movie, I&amp;#x27;d expect the ninja to just beat me up when I get home and unlock my safe for him, assuming I had bought an unbreakable safe.</text></comment>
<story><title>Google Authenticator now supports Google Account synchronization</title><url>https://security.googleblog.com/2023/04/google-authenticator-now-supports.html</url></story><parent_chain><item><author>tasuki</author><text>Do you and people you know have a safe? Where I&amp;#x27;m from, we generally don&amp;#x27;t use safes.&lt;p&gt;Do you consider your safe to be... safe? I&amp;#x27;d imagine it to be relatively easy to get into, by picking the lock or sawing through the safe.</text></item><item><author>justeleblanc</author><text>&amp;gt; And how are you supposed to handle the 2FA for your Google account? I mean I have U2F tokens which remove that concern, but that is far from the typical case. If you have the 2FA for your Google account in the Google Authenticator, which is probably a very common case, how does this entire thing work then when you need it, which is when you lose your phone?&lt;p&gt;You open your safe and you use one of the recovery codes that you wrote down when you setup 2FA.</text></item><item><author>fabian2k</author><text>Ahem, I think making it much easier to transfer and backup 2FA codes is extremely important to make this area more useable. But I&amp;#x27;m missing some parts here in this announcement how the data is protected? Is the security the same as for the Google Account itself, or are there additional checks or protection for the case where you need to restore 2FA to another phone?&lt;p&gt;And how are you supposed to handle the 2FA for your Google account? I mean I have U2F tokens which remove that concern, but that is far from the typical case. If you have the 2FA for your Google account in the Google Authenticator, which is probably a very common case, how does this entire thing work then when you need it, which is when you lose your phone?</text></item></parent_chain><comment><author>maxfurman</author><text>A safe is extremely safe against hackers on the other side of the world. Quite safe against more local threats without special equipment and time on their hands.&lt;p&gt;Security is relative to your threat model!</text></comment>