Earlier this week, Google updated its Authenticator app to enable the backup and syncing of 2FA codes across devices using a Google Account. Now an examination by Mysk security researchers has found that the sensitive one-time passcodes being synced to the cloud aren't end-to-end encrypted, leaving them potentially exposed to bad actors.
Prior to the integration of Google Account support, all codes in the Google Authenticator app were stored on device, which meant that if the device was lost, so too were the one-time passcodes, potentially causing loss of account access as well. But it seems that by enabling cloud-based syncing, Google has opened up users to a security risk of a different sort.
"We analyzed the network traffic when the app syncs the secrets, and it turns out the traffic is not end-to-end encrypted," said Mysk via Twitter. "This means that Google can see the secrets, likely even while they're stored on their servers. There is no option to add a passphrase to protect the secrets, to make them accessible only by the user."
"Secrets" is a term used to refer to private pieces of information that act as keys to unlock protected resources or sensitive information; in this case, one-time passcodes.
Mysk said that its tests found the unencrypted traffic contains a "seed" that's used to generate the 2FA codes. According to the researchers, anyone with access to that seed can generate their own codes for the same accounts and break in to them.
"If Google servers were compromised, secrets would leak," Mysk told Gizmodo. Since the QR codes involved with setting up two-factor authentication contain the name of the account or service, the attacker can also identify the accounts. "This is particularly risky if you're an activist and run other Twitter accounts anonymously," added the researchers.
Mysk subsequently advised users not to enable the Google account feature that syncs 2FA codes across devices and the cloud.
Google has just updated its 2FA Authenticator app and added a much-needed feature: the ability to sync secrets across devices. TL;DR: Don't turn it on. The new update allows users to sign in with their Google Account and sync 2FA secrets across their iOS and Android devices.… pic.twitter.com/a8hhelupZR — Mysk 🇨🇦🇩🇪 (@mysk_co) April 26, 2023
Responding to the warning, a Google spokesperson told CNET it had added the sync feature early for convenience's sake, but that end-to-end encryption is still on its way:
End-to-End Encryption (E2EE) is a powerful feature that provides extra protections, but at the cost of enabling users to get locked out of their own data without recovery. To ensure that we're offering a full set of options for users, we have also begun rolling out optional E2EE in some of our products, and we plan to offer E2EE for Google Authenticator in the future."
Until that happens, there are alternative services for syncing authentication codes across devices, such as Apple's own 2FA code generator and third-party apps like Authy.
