(Mysk noted that Google Chrome does support passphrases for a similar use.) There is no setting through which a user could passphrase protect or otherwise obscure their 2FA secrets. Each “secret” within 2FA QR codes is used to generate a unique code when the Authenticator app syncs secrets between devices, they are sent in a format that Google or attackers can see. In short, the network traffic used to sync the secrets in Google Authenticator is not end-to-end encrypted. Infoblox discovers rare Decoy Dog C2 exploitĪt RSA, Akamai put focus on fake sites, API vulnerabilitiesĮlectronic data retention policy (TechRepublic Premium) What is the security vulnerability in Google’s 2FA? Must-read security coverageġ0 best antivirus software for businesses in 2023 However, the new syncing feature came with a major flaw. This is a “much-needed” feature, Mysk said, as it makes it easier to get back into an account even if you can’t access the device on which you originally logged in. The change came about when Google enabled its 2FA Authenticator app to sync credentials across different devices. On Android and iOS devices, users can sync 2FA credentials to log into various services such as social media. What does the update bring to Google’s Authenticator app?

How Google has responded to this security news.

How to use the Google Authenticator app safely.

What does the update bring to Google’s Authenticator app?.Google Group Product Manager, Identity and Security Christiaan Brand tweeted that the Authenticator app shipped as intended. Mysk discovered a flaw in the feature in which “secrets” or credentials shared across devices are not end-to-end encrypted this could allow attackers or Google to view those credentials.

On April 25, security researchers Tommy Mysk and Talal Haj Bakry, who are known collectively on Twitter as Mysk, warned users of Google’s Authenticator 2FA app to not turn on a new syncing feature. Google’s 2FA app update lacks end-to-end encryption, researchers findĭata synced between devices with the new Google Authenticator app update could be viewed by third parties.

Google authenticator windows