After my phone was stolen last month, I switched to https://2fas.com and couldn't be any happier. It's free, open source and has tons of great features.
[deleted]
Google Authenticator cloud sync: Google can see the secrets, even while stored
101–110 of 149 posts
Re: Google Authenticator cloud sync: Google can see the secrets, even while stored
#102It's a tradeoff. They could let (or require) a password be entered to encrypt/decrypt it on each device, but then people would be ticked off when they forget their password and can't recover their 2FA stuff. They should have handled it the same way they do Sync in chrome, and I expect they will eventually. But, as always, unless a service advertises that it's full E2EE and you can verify that, assume it's not. One pa…
So because things are hard, you just reduce 2fa to 2 of the same factors. And make it worthless.
It’s typically not a disaster if you lose the 2fa keys and if it is, you should carefully save the recovery codes. But the keys get lost all the time so just about every service has a recovery procedure. So there is no need to store the secrets in such a way they can be recovered without the password.
Re: Google Authenticator cloud sync: Google can see the secrets, even while stored
#103Re: Google Authenticator cloud sync: Google can see the secrets, even while stored
#104Earlier quoted context omitted.
The problem is now they know your TOTP secrets, they are only one password away from pretending to be you. And actually, they serve you emails, so password is moot for most of the sites today.
They always knew your TOTP secrets. The algorithm requires both parties to know the plaintext secret as it’s an input to the HMAC. It’s not a public key operation and they can’t store it as a hashed representation. It’s possible to have 2FA methods that are verify only (usually using public keys and signing), but TOTP is not one of them.
The website you log into with TOTP has always known the TOTP secret. Now, Google also knows your TOTP secret.
Re: Google Authenticator cloud sync: Google can see the secrets, even while stored
#105Earlier quoted context omitted.
How exactly?
I guess the person meant this: encrypt-than-upload of backups with backup passkey managed by yourself, details e.g. in this blogpost: https://authy.com/blog/how-the-authy-two-factor-backups-work...
I suspect the vast majority of Authy backups use passwords trivially susceptible to brute-force attacks despite only 1000 (!!!) iterations of PBKDF2. If Authy wanted to do things right, it would generate local encryption keys instead of asking normies for file encryption passphrases.
Re: Google Authenticator cloud sync: Google can see the secrets, even while stored
#106Earlier quoted context omitted.
Chrome passwords are encrypted with your Google password by default, it's just not e2ee. This isn't even encrypted in that way it seems. The only real "threat" is your Google account itself being compromised by a third party able to phish their way into your account or bypass your 2fa mechanisms (e.g. by SMS sim swapping). As always, https://landing.google.com/advancedprotection/ The people here saying "privacy" are…
>Chrome passwords are encrypted with your Google password by default, it's just not e2ee. Source?
Chrome settings -> sync -> encryption
Re: Google Authenticator cloud sync: Google can see the secrets, even while stored
#107Someone will, of course, claim Google would never do this, but this presumably would make it trivial for Google itself to log into all of your accounts. In many cases they are already syncing a copy of your passwords.
I hope someone has set up a honeypot by backing up a load of secrets with this service, and then seeing if anyone ever uses any of those secrets.
Re: Google Authenticator cloud sync: Google can see the secrets, even while stored
#108> likely even while they’re stored on their servers.
I'm all for castigating Google for not encrypting the TOTP seed which is (apparently) transmitted in the clear, but there's no actual proof (one way or the other) that the secrets are/are not being stored encrypted. Thus claiming "even while stored" claim is a bit much.
Re: Google Authenticator cloud sync: Google can see the secrets, even while stored
#109Earlier quoted context omitted.
He wants to distinguish between "free: you pay with your privacy and we share your data with whoever wants it!" or "free: but only basic features, want more? pay" and "free: because people like you help it being 100% free and we have no pressure to use your data and everything is open so you can look at the code"
Many open source enthusiasts are really 'dont like paying money for things' enthusiasts.
That’s certainly a big part for me. But it’s not about saving $2, I think that free is sustainable therefore likely to run in 50 or 100 years where any non-zero amount decreases that probability.
So if I don’t pay money for things there’s not a service element, or a phone home to activate element, or other things that require an ongoing cost.
Re: Google Authenticator cloud sync: Google can see the secrets, even while stored
#110Earlier quoted context omitted.
Why would google have access to that material? Is their general secret mechanism not E2EE? I'm fairly cynical on google's approach to privacy but I would be shocked if they're normal syncing isn't actually secure and private.
Chrome passwords are encrypted with your Google password by default, it's just not e2ee. This isn't even encrypted in that way it seems. The only real "threat" is your Google account itself being compromised by a third party able to phish their way into your account or bypass your 2fa mechanisms (e.g. by SMS sim swapping). As always, https://landing.google.com/advancedprotection/ The people here saying "privacy" are…
How does https://passwords.google.com work then?
I think the default behaviour is not E2EE.