PSA: Google Authenticator's Cloud-Synced 2FA Codes Aren't End-to-End Encrypted

Earlier this week, Google updated its Authenticator app to enable the backup and syncing of 2FA codes across devices using a Google Account. Now an examination by Mysk security researchers has found that the sensitive one-time passcodes being synced to the cloud aren't end-to-end encrypted, leaving them potentially exposed to bad actors.

google authenticator
Prior to the integration of Google Account support, all codes in the Google Authenticator app were stored on device, which meant that if the device was lost, so too were the one-time passcodes, potentially causing loss of account access as well. But it seems that by enabling cloud-based syncing, Google has opened up users to a security risk of a different sort.

"We analyzed the network traffic when the app syncs the secrets, and it turns out the traffic is not end-to-end encrypted," said Mysk via Twitter. "This means that Google can see the secrets, likely even while they're stored on their servers. There is no option to add a passphrase to protect the secrets, to make them accessible only by the user."

"Secrets" is a term used to refer to private pieces of information that act as keys to unlock protected resources or sensitive information; in this case, one-time passcodes.

Mysk said that its tests found the unencrypted traffic contains a "seed" that's used to generate the 2FA codes. According to the researchers, anyone with access to that seed can generate their own codes for the same accounts and break in to them.

"If Google servers were compromised, secrets would leak," Mysk told Gizmodo. Since the QR codes involved with setting up two-factor authentication contain the name of the account or service, the attacker can also identify the accounts. "This is particularly risky if you're an activist and run other Twitter accounts anonymously," added the researchers.

Mysk subsequently advised users not to enable the Google account feature that syncs 2FA codes across devices and the cloud.


Responding to the warning, a Google spokesperson told CNET it had added the sync feature early for convenience's sake, but that end-to-end encryption is still on its way:

End-to-End Encryption (E2EE) is a powerful feature that provides extra protections, but at the cost of enabling users to get locked out of their own data without recovery. To ensure that we're offering a full set of options for users, we have also begun rolling out optional E2EE in some of our products, and we plan to offer E2EE for Google Authenticator in the future."

Until that happens, there are alternative services for syncing authentication codes across devices, such as Apple's own 2FA code generator and third-party apps like Authy.

Popular Stories

iOS 18 CarPlay Feature

iOS 18 Adds These 5 New Features to CarPlay

Thursday June 13, 2024 7:44 am PDT by
Apple did not mention CarPlay during its WWDC keynote this week, but iOS 18 includes a handful of new features for the in-car software. Overall, there is not a whole lot new for CarPlay on iOS 18, with changes seemingly limited to the Messages and Settings apps so far. Below, we recap everything new for CarPlay on iOS 18. New for CarPlay on iOS 18 1. Contact Photos in Messages App...
iOS 18 Wallet Feature

Here's What's New in Apple Wallet on iOS 18 for Event Tickets and More

Friday June 14, 2024 7:32 am PDT by
iOS 18 includes a handful of enhancements to the Wallet app on the iPhone, with new features for Apple Pay, Apple Cash, event tickets, and more. Below, we outline everything new for the Wallet app on iOS 18, based on information from Apple's press release and a WWDC 2024 coding session. Redesigned Event Tickets Event tickets have an all-new design in the Wallet app on iOS 18, complete...
maxresdefault

First Look at Messages via Satellite in iOS 18

Thursday June 13, 2024 11:29 am PDT by
Apple has been gradually expanding its suite of satellite connectivity features for iPhone, and iOS 18 brings a significant new one in the form of Messages via satellite. The feature allows users to send and receive iMessages and SMS texts, including emoji and Tapbacks, while out of range of cellular and Wi-Fi networks. CNET met up with Apple's senior director of platform product marketing,...
iOS 18 Siri Integrated Feature

You Can Give Siri a New Name With iOS 18's Vocal Shortcuts

Friday June 14, 2024 4:33 pm PDT by
Apple in iOS 18 added a Vocal Shortcuts accessibility feature, and now that iOS 18 is available in a beta capacity, users have figured out that this option can be used to give Siri a new wake word. With Vocal Shortcuts, you can assign a custom phrase that Siri can understand to launch shortcuts and complete "complex tasks," and one of the shortcuts you can set up is an alternative for "Hey...

Top Rated Comments

icanhazmac Avatar
15 months ago
Shocking! /s

This, along with the privacy scorecard, makes this a hard pass.




Keep in mind, this is an authenticator app, what could it possibly need all that identifiable data for besides wholesale collection? This is basically spyware!

Attachment Image
Score: 16 Votes (Like | Disagree)
szw-mapple fan Avatar
15 months ago
Way top destroy the reputation of this service by launching early. End-to-end encryption for 2FA Codes is a must and should be ready on day one. This not only demonstrates that the service itself might be vulnerable but also that Google is not serious about security and encryption and only implementing it as kind of an afterthought.
Score: 11 Votes (Like | Disagree)
andrewxgx Avatar
15 months ago
so you can encrypt passwords with separate password, but cant encrypt 2FA seeds?
comedy gold
Score: 10 Votes (Like | Disagree)
mystery hill Avatar
15 months ago
iCloud Keychain is really good if you’re only using Apple devices - it auto fills and is end-to-end encrypted.
Score: 8 Votes (Like | Disagree)
sw1tcher Avatar
15 months ago

Shocking! /s

This, along with the privacy scorecard, makes this a hard pass.




Keep in mind, this is an authenticator app, what could it possibly need all that identifiable data for besides wholesale collection? This is basically spyware!
Wait until you see how much data is linked to you from this "wholesale collection" app :p

https://apps.apple.com/us/app/apple-music/id1108187390



Attachment Image
Score: 7 Votes (Like | Disagree)
szw-mapple fan Avatar
15 months ago

Wait until you see how much data is linked to you from this "wholesale collection" app :p

https://apps.apple.com/us/app/apple-music/id1108187390


To be fair, Apple Music is also a music store with social media features and provides personalized music recommendations. It needs to collect/store most of these kinds of info since it literally needs them to function. An authenticator app should require none of these things. If you look at Apple apps that don't need these data and compare them with similar apps in the same category, Apple's data collection is typically minimal.

For example,

Apple Mail:



Versus Gmail:



Attachment Image

Attachment Image
Score: 7 Votes (Like | Disagree)