PSA: Google Authenticator's Cloud-Synced 2FA Codes Aren't End-to-End Encrypted

Earlier this week, Google updated its Authenticator app to enable the backup and syncing of 2FA codes across devices using a Google Account. Now an examination by Mysk security researchers has found that the sensitive one-time passcodes being synced to the cloud aren't end-to-end encrypted, leaving them potentially exposed to bad actors.

google authenticator
Prior to the integration of Google Account support, all codes in the Google Authenticator app were stored on device, which meant that if the device was lost, so too were the one-time passcodes, potentially causing loss of account access as well. But it seems that by enabling cloud-based syncing, Google has opened up users to a security risk of a different sort.

"We analyzed the network traffic when the app syncs the secrets, and it turns out the traffic is not end-to-end encrypted," said Mysk via Twitter. "This means that Google can see the secrets, likely even while they're stored on their servers. There is no option to add a passphrase to protect the secrets, to make them accessible only by the user."

"Secrets" is a term used to refer to private pieces of information that act as keys to unlock protected resources or sensitive information; in this case, one-time passcodes.

Mysk said that its tests found the unencrypted traffic contains a "seed" that's used to generate the 2FA codes. According to the researchers, anyone with access to that seed can generate their own codes for the same accounts and break in to them.

"If Google servers were compromised, secrets would leak," Mysk told Gizmodo. Since the QR codes involved with setting up two-factor authentication contain the name of the account or service, the attacker can also identify the accounts. "This is particularly risky if you're an activist and run other Twitter accounts anonymously," added the researchers.

Mysk subsequently advised users not to enable the Google account feature that syncs 2FA codes across devices and the cloud.


Responding to the warning, a Google spokesperson told CNET it had added the sync feature early for convenience's sake, but that end-to-end encryption is still on its way:

End-to-End Encryption (E2EE) is a powerful feature that provides extra protections, but at the cost of enabling users to get locked out of their own data without recovery. To ensure that we're offering a full set of options for users, we have also begun rolling out optional E2EE in some of our products, and we plan to offer E2EE for Google Authenticator in the future."

Until that happens, there are alternative services for syncing authentication codes across devices, such as Apple's own 2FA code generator and third-party apps like Authy.

Popular Stories

apple wallet drivers license feature iPhone 15 pro

iPhone Driver's Licenses: These 17 U.S. States Offer Them or Will Later

Thursday June 19, 2025 11:28 am PDT by
In select U.S. states, residents can add their driver's license or state ID to the Wallet app on the iPhone and Apple Watch, providing a convenient and contactless way to display proof of identity or age at select airports and businesses, and in select apps. Unfortunately, this feature continues to roll out very slowly since it was announced in 2021, with only nine U.S. states and Puerto...
apple watch ultra 2 new black

Apple Watch Ultra 3 Finally Coming After Two-Year Hiatus

Monday June 16, 2025 8:45 am PDT by
Apple will finally deliver the Apple Watch Ultra 3 sometime this year, according to analyst Jeff Pu of GF Securities Hong Kong (via @jukanlosreve). The analyst expects both the Apple Watch Series 11 and Apple Watch Ultra 3 to arrive this year (likely alongside the new iPhone 17 lineup, if previous launches are anything to go by), according to his latest product roadmap shared with...
iPhone 17 Pro Blue Feature Tighter Crop

iPhone 17 Pro Launching in Three Months With These 12 New Features

Saturday June 14, 2025 5:45 pm PDT by
The iPhone 17 Pro and iPhone 17 Pro Max are three months away, and there are plenty of rumors about the devices. Below, we recap key changes rumored for the iPhone 17 Pro models as of June 2025:Aluminum frame: iPhone 17 Pro models are rumored to have an aluminum frame, whereas the iPhone 15 Pro and iPhone 16 Pro models have a titanium frame, and the iPhone X through iPhone 14 Pro have a...
ios 26 call holding

iOS 26 Beta is Hiding a New Ringtone — Here's What It Sounds Like

Thursday June 19, 2025 7:25 pm PDT by
Apple is hiding a new ringtone within iOS 26. The new ringtone is an alternative version of the existing Reflection ringtone, which has been the default ringtone since the iPhone X was released in 2017. It was discovered within the code for the first developer beta of iOS 26, but it remains hidden, so you will not find it in the list of ringtones available in the Settings app for now. It...
iOS 18

Apple Releases iOS 18.6 Public Beta

Wednesday June 18, 2025 10:24 am PDT by
Apple today seeded the first betas of upcoming iOS 18.6 and iPadOS 18.6 updates to public beta testers, with the betas coming just a few days after Apple provided the betas to developers. Testers who have signed up for beta updates through Apple's beta site can download iOS 18.6 and iPadOS 18.6 from the Settings app on a compatible device by going to General > Software Update. When the...
new iphone lockscreen ios 26

iOS 26: Five Changes Coming to Your iPhone Lock Screen

Tuesday June 17, 2025 8:46 am PDT by
With iOS 26, Apple has made some additions to the iPhone Lock Screen that aim to make it more customizable than ever. Of course, things can always change before the software makes its way to the general iPhone-owning public, but here are five new things iOS 26 can do on the Lock Screen as of the current developer beta. Widgets Top or Bottom In iOS 18, the row of widgets on your Lock...
General Spotify Feature

Spotify Preparing to Launch Long-Awaited Lossless Audio Tier on iPhone

Thursday June 19, 2025 1:46 pm PDT by
Spotify appears to be gearing up to launch its long-awaited lossless music tier. Chris Messina (via TechCrunch) and Spicetify (via The Verge) spotted new lossless references within the code for Spotify's desktop app and web player. With assistance from Aaron Perris, MacRumors has confirmed that the latest beta of the Spotify app for the iPhone also contains new lossless-related code....
iOS 26 on Three iPhones

Apple Says iOS 26 Won't Be Available on These iPhone Models

Tuesday June 10, 2025 6:58 am PDT by
Apple this week revealed that iOS 26 is compatible with the iPhone 11 series and newer. That means that iOS 18 is the end of the road for the iPhone XS, iPhone XS Max, and iPhone XR, which were all released in 2018. However, those devices will continue to receive security updates for at least a few more years. iOS 26 is compatible with the following iPhone models: iPhone 16e iPhone...
Craig Federighi No

John Gruber Reacts to Apple Declining His Interview After His Criticism

Wednesday June 18, 2025 8:10 pm PDT by
Every year between 2015 and 2024, at least one Apple executive agreed to be interviewed by Daring Fireball's John Gruber for a special WWDC episode of his podcast, The Talk Show. Last year, for example, Apple's software engineering chief Craig Federighi, marketing chief Greg Joswiak, and top AI researcher John Giannandrea joined Gruber on stage at the California Theatre in San Jose to discuss...

Top Rated Comments

icanhazmac Avatar
28 months ago
Shocking! /s

This, along with the privacy scorecard, makes this a hard pass.




Keep in mind, this is an authenticator app, what could it possibly need all that identifiable data for besides wholesale collection? This is basically spyware!

Attachment Image
Score: 16 Votes (Like | Disagree)
szw-mapple fan Avatar
28 months ago
Way top destroy the reputation of this service by launching early. End-to-end encryption for 2FA Codes is a must and should be ready on day one. This not only demonstrates that the service itself might be vulnerable but also that Google is not serious about security and encryption and only implementing it as kind of an afterthought.
Score: 11 Votes (Like | Disagree)
andrewxgx Avatar
28 months ago
so you can encrypt passwords with separate password, but cant encrypt 2FA seeds?
comedy gold
Score: 10 Votes (Like | Disagree)
mystery hill Avatar
28 months ago
iCloud Keychain is really good if you’re only using Apple devices - it auto fills and is end-to-end encrypted.
Score: 8 Votes (Like | Disagree)
sw1tcher Avatar
28 months ago

Shocking! /s

This, along with the privacy scorecard, makes this a hard pass.




Keep in mind, this is an authenticator app, what could it possibly need all that identifiable data for besides wholesale collection? This is basically spyware!
Wait until you see how much data is linked to you from this "wholesale collection" app :p

https://apps.apple.com/us/app/apple-music/id1108187390



Attachment Image
Score: 7 Votes (Like | Disagree)
szw-mapple fan Avatar
28 months ago

Wait until you see how much data is linked to you from this "wholesale collection" app :p

https://apps.apple.com/us/app/apple-music/id1108187390


To be fair, Apple Music is also a music store with social media features and provides personalized music recommendations. It needs to collect/store most of these kinds of info since it literally needs them to function. An authenticator app should require none of these things. If you look at Apple apps that don't need these data and compare them with similar apps in the same category, Apple's data collection is typically minimal.

For example,

Apple Mail:



Versus Gmail:



Attachment Image

Attachment Image
Score: 7 Votes (Like | Disagree)