Google Authenticator Can Now Sync 2FA Codes To the Cloud (techcrunch.com) 83
Google Authenticator just got an update that should make it more useful for people who frequently use the service to sign in to apps and websites. From a report: As of today, Google Authenticator will now sync any one-time two-factor authentication (2FA) codes that it generates to users' Google Accounts. Previously, one-time Authenticator codes were stored locally, on a single device, meaning losing that device often meant losing the ability to sign in to any service set up with Authenticator's 2FA. To take advantage of the new sync feature, simply update the Authenticator app. If you're signed in to a Google Account within Google Authenticator, your codes will automatically be backed up and restored on any new device you use. You can also manually transfer your codes to another device even if you're not signed in to a Google Account by following the steps on this support page.
Some users might be wary of syncing their sensitive codes with Google's cloud -- even if they did originate from a Google product. But Christiaan Brand, a group product manager at Google, asserts it's in the pursuit of convenience without sacrificing security. "We released Google Authenticator in 2010 as a free and easy way for sites to add 'something you have' 2FA that bolsters user security when signing in," Brand wrote in the blog post announcing today's change. "With this update we're rolling out a solution to this problem, making one time codes more durable by storing them safely in users' Google Account."
Some users might be wary of syncing their sensitive codes with Google's cloud -- even if they did originate from a Google product. But Christiaan Brand, a group product manager at Google, asserts it's in the pursuit of convenience without sacrificing security. "We released Google Authenticator in 2010 as a free and easy way for sites to add 'something you have' 2FA that bolsters user security when signing in," Brand wrote in the blog post announcing today's change. "With this update we're rolling out a solution to this problem, making one time codes more durable by storing them safely in users' Google Account."
Authy has had this feature for years (Score:3)
Twilio's Authy has had this feature for years.
Re: (Score:2)
As has Bitwarden.
Re: (Score:3)
Yes but you can control your own private bitwarden instance.
If I want to hand over access to everything I have to any yahoo with a rubber stamp from a FISA court or who doesn't have one but activists at Google feel inclined to support Twitter style this seems like a good idea. Otherwise if I want access control to remain in my hands rather than Google's this is a terrible idea.
This update brought to you by the same folks who just tried to claim FB was trying to facilitate child pornography by spreading end-
Great (Score:5, Insightful)
So now if someone compromises your Google account, they can access your 2FA codes for other non-Google accounts. Excellent move, Google.
Then there's the chicken-egg problem... if you lose your Google Authenticator device, your 2FA codes are safely stored... precisely where you can't access them unless you've copied your emergency codes somewhere safe. I bet around 2% of people bother to do that.
Re:Great (Score:4, Funny)
Just turn on 2FA for your Google account. It's really easy, there's even an app you can use and....wait a minute!
Re: Great (Score:2)
I think Google fundamentally doesn't understand 2FA. They don't even appear to support CTAP2 on any single one of their products, just old CTAP1, even though CTAP2 has been a thing for three years now. No resident key support, no pin support. Doesn't seem like they will support it any time soon either. People have been asking for it and Google's responses have been either totally silent or totally dumbfounded thus far.
Re: (Score:2)
Just turn on 2FA for your Google account. It's really easy, there's even an app you can use and....wait a minute!
You laugh, but I do precisely that with my 2FA provider. The trick is that I have a printed copy of the QR code stored in my physical safe, along with a whole bunch of other "recovery" information and instructions for my next-of-kin.
Re: (Score:2)
The point is to have multiple devices, the cloud is just an intermediary.
Re: (Score:2)
I do have my TOTP secrets stored on multiple devices, without using the cloud as an intermediary. Unfortunately, Google has no incentive to make that convenient.
Re: (Score:2)
And no, exporting using QR codes is not convenient when the device doing the import barfs on QR codes with more than about 5 TOTP secrets in them.
Re: (Score:2)
No, the cloud is a central storage point within third party control. In security we call this a MITM (man in the middle) and it is considered a form of attack.
Re: (Score:2)
It will probably get integrated into Chrome at some point. Optional of course, but for most people who don't use 2FA at all it's still an improvement.
When doing security on this scale your always have to remember that even the smallest bit of friction will put off most users, and as you note most probably don't have their backup codes to hand.
Naturally you don't use Google Authenticator anyway.
Re: (Score:2)
"for most people who don't use 2FA at all it's still an improvement"
No it isn't. It is a MITM attack that creates the ILLUSION of an improvement, that is worse than not having 2FA because someone who lacks 2FA (is that anyone anymore? It is mandatory for just about everything.) will realize their lack when they do become aware of it at some point. Someone with this turned on will be lulled into a sense of security while having completely compromised themselves.
Re: (Score:2)
Having to create a MITM attack, in an age where Chrome enforces HTTPS connections to websites by default, is far from trivial. Chrome has decent phishing protection too, and if the code generator was built in it could verify the domain and certificate of the site before handing the code over.
Re: (Score:2)
Re: (Score:2)
You expect people at risk from the US government to be storing their secrets in a Google account?
Re: (Score:2)
Re: (Score:2)
So just in case someone who should know better has a Google account, everyone should suffer worse security.
Re: (Score:2)
You have this backwards... this change results in less security not more. Everyone with an Android device has a google account. Apple already uses known and intentionally vulnerable cloud storage for data at rest to provide a government back door. So they are screwed on any major platform under that notion but at least their keys were in secure storage on their client device on android... until now.
Re: (Score:2)
Well the users of google authenticator DIDN'T choose to store their secrets in a Google account. Google is changing the behavior and stealing their keys without consent.
Re: (Score:2)
Or for that matter a foreign court. Google operates in many nations and could be compelled and gagged by a Chinese court.
Re: (Score:2)
Having to create a MITM attack? Google is the MITM here. They are accomplishing it with an app update. Your app automatically updates and uploads your keys to Google without your consent.
Re: (Score:3)
"So now if someone compromises your Google account, they can access your 2FA codes for other non-Google accounts."
Yeah, someone like... I don't know... GOOGLE. The only ones praising this move are the ignorant and agencies who oppose the spread of end-to-end encryption.
Re: (Score:2)
AndOTP [f-droid.org] can make an encrypted copy of the 2FA secrets on the local drive (which then needs to saved off-device).
I bet around 2% of people bother to do that.
Your digital life (passwords, security questions/answers, password-recovery email addresses, 2FA secrets, product keys) must be backed-up but nobody teaches this and despite the 'you need this' warning of online web-sites, people rarely think of the problem of lost authentication data.
Re: (Score:2)
I bet around 2% of people bother to do that.
That's why I don't have any backups. They don't help or do anything since so few people use backups there's clearly no point in the entire concept.
huh? (Score:5, Insightful)
Re: huh? (Score:4, Insightful)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
But if 2FA code is now accessible from the account itself, without needing my secondary device, isn't that just 1 factor?
It's no better/worse than any other cloud service. For someone to get access to the stored 2FA data, they would need to either have already compromised your account or compromised Google. Either way, your account already isn't safe. That isn't an endorsement, just pointing out how it's not relevant in that context.
Re: (Score:2)
Many people store non-Google TOTP secrets in Google Authenticator, and may not want them shared to Google. This should definitely be an opt-in feature, but it sounds like it's not and that there's no way to opt out, either.
Re: (Score:2)
Re: (Score:2)
It's not really a separate concern. It makes breaking into a Google account just a little bit more attractive to an attacker.
Re: (Score:2)
Re: (Score:2)
Even if it were opt-out the client would have likely already transferred the credentials before you opt out rendering them compromised. They just turned Google authenticator into a trojan.
Re: (Score:3)
"or compromised Google"
Or be Google or legally compel Google under a gag order... including doing so in authoritarian regimes like China. Google authenticator facilitates 2FA for third party services, this could even include unrelated government services in some cases.
Thanks but no thanks.
Re: (Score:2)
Re: (Score:2)
It absolutely makes it less secure. This means an attacker need only gain brief access to the account to have ongoing access in a manner that does not raise any alarms to the legitimate user.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
You are failing to understand the nuance. It is not necessarily true that your account is screwed if an attacker has gained access... they might need subsequent or ongoing access for whatever they have planned. The most popular google application which requires an account is gmail.
Using a gmail account as a stage to hijack and maintain accounts on other services is an example of a common attack which requires ongoing access for password resets and other activities. HIjacking a session or compromising a pass
Re: (Score:2)
Re: (Score:2)
What nuance is that? You claimed this didn't make the google/gmail account less secure because someone would still have gotten in momentarily to exploit it. I've just pointed out a tangible difference in account security of the google account itself.
Perhaps you only meant the initial compromise still requires the 2FA... but that isn't true either. An attacker no longer needs to compromise the users 2FA at any point, if they jack a session they can get in and steal the 2FA keys which they couldn't do before.
Re: (Score:2)
Re: (Score:2)
"It, however, does not inherently make the Google account itself less secure. You have provided security risks [for the Google account, caused by this change], but none of them actually prove that wrong."
This is nonsensical position. To secure is to reduce risk and the inverse is to increase it. You can not both have increased risk to the Google account and be equally secure. At least not without some a reduction of some other risk to balance the matter and there is no security gain here.
Re: (Score:2)
[for the Google account, caused by this change]
Those are words you added yourself, and not ones I agree with. I don't appreciate people putting words in my mouth. So, at this point, I have to say shove off.
Re: (Score:2)
Are you trying to get cute? Yes, that is what it means when square brackets are in a quote, a correction or addition of context. Enabling ongoing access to the Google account and continued exploitation thereof is ongoing risk to the same. Fact, this change reduces the security of the account itself while providing no security benefit.
The additional point that this is essentially nothing but a scheme for Google to perform unauthorized systems access and steal your keys is the more important issue but a seper
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The point is to allow you to get a tertiary device which acts as your secondary device for authentication.
The 2FA sync isn't accessible from the account if you haven't authenticated.
Re: (Score:3)
That's what I'm hearing as well.
Which is absolutely par for the cours when it comes to security. Everyone wants security, until it becomes mildly inconvenient, at which point some way to work around the security becomes popular (e.g. passwords on post-it notes next to the "secured" copy machine).
I predict this trend will continue until we all routinely bypass at *least* four levels of security on a regular basis, and someone finally realizes that they can get almost as much security much cheaper by using a
Re: (Score:2)
Re: (Score:2)
Unless I'm misunderstanding something, it seems like they turned their 2FA into 1FA.
You should be aware that Google has recently done that all across the web. They have enabled "log in with Google" on many sites, without your permission or interaction. If someone gains control of your email account, they can log into anything.
Re: (Score:2)
it seems like they turned their 2FA into 1FA.
You're misunderstanding it. It's still 2FA, except that second factor is virtualised on a cloud service instead of being a device in your pocket connected to at same cloud.
Superior alternative to Google Authenticator (Score:5, Interesting)
A little bit of searching led me to Aegis Authenticator [getaegis.app] which IMO is superior to Google Authenticator.
1. You can encrypt your secrets file with a master password.
2. You can back up your secrets file, but doing so is optional and you get to decide where you want it backed up to. That can include Google Drive if you want, but doesn't have to.
3. The code is open-source (GPLv3 license.)
I'm not affiliated with Aegis in any way... I just like the looks of the app.
Re: Superior alternative to Google Authenticator (Score:2)
Re: (Score:2)
I've been using Authenticator Pro for quite some time now on my Android phone. Also a great alternative to Google Authenticator and has the same features detailed above of Aegis Authenticator.
https://github.com/jamie-mh/Au... [github.com]
Not affiliated with the application or the author, just a satisfied user.
Seriously? (Score:1)
You guys still using anything by Google?
I pity the fool
Push notifications is what I would like (Score:2)
With something like Duo, I get an MFA notification on my watch. I confirm in one-step and done. Last time I used Google Authenticator, it could not do push notifications. I had to unlock my phone, open up the app, make a note of the code and manually enter that in on my computer. That is too many steps.
Re: (Score:2)
With something like Duo, I get an MFA notification on my watch... Last time I used Google Authenticator, it could not do push notifications...
Of course not. They're separate types of 2FA.
Duo involves a client application telling Duo's infrastructure to send that push request to your watch. It's fantastic; I've deployed it for more clients than any other 2FA system...but it's still dependent on Duo specifically.
Google Authenticator (and MS Authenticator and Authy and Aegis and FreeOTP and...) use a private key and the current time and some really complicated math to generate those six digit codes.
Each system has some pros and cons. Duo is great be
Re: (Score:2)
MS Authenticator can and does push notifications, unlike Google Authenticator. At this time it appears to be limited to Microsoft apps for push notifications however.
I should uninstall it then (Score:2)
Re: (Score:2)
The short answer is yes.
This does impact the security of your authenticator.
It may be more convenient however it is convenience at the cost of security. Your secret is now shared with google and any other device which can authenticate with google.
Re: (Score:2)
data theft (Score:2)
So Google can steal my security info and share it with Governments that demand it? No.
Re: data theft (Score:1)
Can I export it to a CSV file? If not? pass. (Score:2)
One of my core items on my 2FA app punch list is the ability to export the list of shared secrets to a CSV, JSON, or other plain text file, so I can import them somewhere else, even if I have to manually copy/paste them, write a script to pull out the values and throw them into a format grokkable by a new PW manager, or use another script to convert the 2FA key value into a QR code for import somewhere else. Without the ability to export, I won't use the program.
I also want known good encryption for the 2F
Re: (Score:2)
You can export to QR-Code and scan that to get a string. You can also get the string directly. Works for a number of secrets at once.
/Me Deletes Google Authenticator (Score:2)
Google Authenticator was correctly designed from the outset. You do not create a single target for adversaries to attack. You distribute the secrets and ideally isolate them so that adversaries have to compromise thousands of systems instead of ju
Malicious change (Score:2)
I have to consider this change malicious. It deliberately allows access to the 2FA secrets when the whole point of 2FA is that nobody but the owner has access to them. The correct way to handle transferring secrets is how GA already did it: generate QR codes containing the secret database and scan them in on the new device. No need for the cloud at all. The only thing lacking would be the ability to export an encrypted copy of the database so it could be backed up locally in the event of the device failing
Re: (Score:2)
Indeed. I guess I will very much _not_ update the app and make sure it does not have any network permissions. Might also move to an alternative that does not have this "feature" or where I can depend on it being off unless I gave explicite permission. My trust in Google is non-existent these days.
Asd to backup, I have a backup on an old kindle-fire which is permanently in airplane mode and a 2nd one on an old android phone without SIM-card which also is in airplane mode and usually off. That is quite enough
I tried using a u2f key with a Google account... (Score:1)
Stupid idea (Score:1)
I'm probably confused (Score:1)
Exfiltrate (Score:2)
> your codes will automatically be exfiltrated
TFTFY
Holy crap are opsec teams panicking today!
Use Aegis for standalone anyway.
Don't panic - you CAN turn off BEFORE it syncs (Score:2)
I just updated my iPhone app. Next time I launched it, a splash screen encouraged me to log in to my Google Account, but offered a link to use Authenticator without a Google account. There's a slashed-through cloud icon at the top of my screen. When I tap it the app notes "Your codes are not being saved to your Google Account".