PSA: Google Authenticator's Cloud-Synced 2FA Codes Aren't End-to-End Encrypted

Earlier this week, Google updated its Authenticator app to enable the backup and syncing of 2FA codes across devices using a Google Account. Now an examination by Mysk security researchers has found that the sensitive one-time passcodes being synced to the cloud aren't end-to-end encrypted, leaving them potentially exposed to bad actors.

google authenticator
Prior to the integration of Google Account support, all codes in the Google Authenticator app were stored on device, which meant that if the device was lost, so too were the one-time passcodes, potentially causing loss of account access as well. But it seems that by enabling cloud-based syncing, Google has opened up users to a security risk of a different sort.

"We analyzed the network traffic when the app syncs the secrets, and it turns out the traffic is not end-to-end encrypted," said Mysk via Twitter. "This means that Google can see the secrets, likely even while they're stored on their servers. There is no option to add a passphrase to protect the secrets, to make them accessible only by the user."

"Secrets" is a term used to refer to private pieces of information that act as keys to unlock protected resources or sensitive information; in this case, one-time passcodes.

Mysk said that its tests found the unencrypted traffic contains a "seed" that's used to generate the 2FA codes. According to the researchers, anyone with access to that seed can generate their own codes for the same accounts and break in to them.

"If Google servers were compromised, secrets would leak," Mysk told Gizmodo. Since the QR codes involved with setting up two-factor authentication contain the name of the account or service, the attacker can also identify the accounts. "This is particularly risky if you're an activist and run other Twitter accounts anonymously," added the researchers.

Mysk subsequently advised users not to enable the Google account feature that syncs 2FA codes across devices and the cloud.

Responding to the warning, a Google spokesperson told CNET it had added the sync feature early for convenience's sake, but that end-to-end encryption is still on its way:

End-to-End Encryption (E2EE) is a powerful feature that provides extra protections, but at the cost of enabling users to get locked out of their own data without recovery. To ensure that we're offering a full set of options for users, we have also begun rolling out optional E2EE in some of our products, and we plan to offer E2EE for Google Authenticator in the future."

Until that happens, there are alternative services for syncing authentication codes across devices, such as Apple's own 2FA code generator and third-party apps like Authy.

Top Rated Comments

icanhazmac Avatar
11 months ago
Shocking! /s

This, along with the privacy scorecard, makes this a hard pass.

Keep in mind, this is an authenticator app, what could it possibly need all that identifiable data for besides wholesale collection? This is basically spyware!

Attachment Image
Score: 16 Votes (Like | Disagree)
szw-mapple fan Avatar
11 months ago
Way top destroy the reputation of this service by launching early. End-to-end encryption for 2FA Codes is a must and should be ready on day one. This not only demonstrates that the service itself might be vulnerable but also that Google is not serious about security and encryption and only implementing it as kind of an afterthought.
Score: 11 Votes (Like | Disagree)
andrewxgx Avatar
11 months ago
so you can encrypt passwords with separate password, but cant encrypt 2FA seeds?
comedy gold
Score: 10 Votes (Like | Disagree)
mystery hill Avatar
11 months ago
iCloud Keychain is really good if you’re only using Apple devices - it auto fills and is end-to-end encrypted.
Score: 8 Votes (Like | Disagree)
sw1tcher Avatar
11 months ago

Shocking! /s

This, along with the privacy scorecard, makes this a hard pass.

Keep in mind, this is an authenticator app, what could it possibly need all that identifiable data for besides wholesale collection? This is basically spyware!
Wait until you see how much data is linked to you from this "wholesale collection" app :p

Attachment Image
Score: 7 Votes (Like | Disagree)
szw-mapple fan Avatar
11 months ago

Wait until you see how much data is linked to you from this "wholesale collection" app :p

To be fair, Apple Music is also a music store with social media features and provides personalized music recommendations. It needs to collect/store most of these kinds of info since it literally needs them to function. An authenticator app should require none of these things. If you look at Apple apps that don't need these data and compare them with similar apps in the same category, Apple's data collection is typically minimal.

For example,

Apple Mail:

Versus Gmail:

Attachment Image

Attachment Image
Score: 7 Votes (Like | Disagree)

Popular Stories

iOS 17

10 New Things Your iPhone Can Do in Next Week's iOS 17.4 Update

Friday March 1, 2024 1:30 am PST by
Apple will this month release iOS 17.4, its biggest iPhone software update of the year so far, featuring a number of features and changes that users have been anticipating for quite a while. Below, we've listed 10 new things that your iPhone will be able to do after you've installed the update, which is projected to arrive by March 7. When the day arrives, be sure to check Settings ➝...
Apple Maps vs Google Maps Feature

Apple Maps vs. Google Maps: Which Is Better?

Friday March 1, 2024 7:10 am PST by
Apple Maps has been providing navigational guidance to Apple users for almost 13 and a half years now, and much has changed about the app in that time. However, according to data from Canalys, the overwhelming majority of iPhones in the U.S. still have Google Maps downloaded as an alternative to Apple Maps, which comes preinstalled on all iPhones. We want to hear from MacRumors readers. Which do...
apple tv plus banner

Apple TV+ Gains Over 50 Movies for a Limited Time

Friday March 1, 2024 6:29 am PST by
Apple TV+ today gained over 50 movies, adding to its back catalog of content for a limited time. The collection includes a large number of popular and classic titles. Subscribers can access the movies in a "Great Movies on Apple TV+" section in the Apple TV app. Some titles are also available in 3D. Movies in the collection include: 21 Jump Street 300 American Sniper Argo ...
airpods pro 2 pink

Apple Releases New Beta Firmware for AirPods Pro 2

Thursday February 29, 2024 11:41 am PST by
Apple today introduced a new beta firmware update for the AirPods Pro 2, both the USB-C and Lightning versions. The new firmware is version 6E188, up from the prior 6B34 firmware released in December. Apple does not often provide details or notes on what features might be included in the refreshed firmware, so it is unclear what's new. Note that this software is limited to developers at the...
iOS 18 Mock Feature Baubles

Will Your iPhone Support iOS 18? Here's What the Latest Rumor Says

Thursday February 29, 2024 7:29 am PST by
iOS 18 and iPadOS 18 are still over three months away from being unveiled, but we may already know which devices will be compatible with the updates. iOS 18 will be compatible with the same iPhone models as iOS 17, meaning that the iPhone XS, iPhone XS Max, and iPhone XR from 2018 will remain supported for at least another year, according to information shared this week by a source with a...
iPad Pro OLED Feature 2

OLED iPad Pro's Thin Design Highlighted in CAD Drawings

Wednesday February 28, 2024 1:22 pm PST by
Apple is working on a new version of the iPad Pro that is set to launch as soon as March, and the refresh will mark the biggest design update to the Pro lineup since 2018. Apple is transitioning to OLED displays, and the swap will allow for a major change to the overall thickness of the device. CAD drawings of the upcoming ~11-inch and ~13-inch iPad Pro models give us some insight into just...