https://www.bleepingcomputer.com/news/google/google-will-add-end-to-end-encryption-to-google-authenticator/ BleepingComputer.com logo * * * * [ ] [Login] [Sign up] * * * * [ ] [Login] [Sign up] * News + Featured + Latest + Microsoft removes LSA Protection from Windows settings to fix bug Microsoft removes LSA Protection from Windows settings to fix bug + VMware fixes critical zero-day exploit chain used at Pwn2Own VMware fixes critical zero-day exploit chain used at Pwn2Own + New SLP bug can lead to massive 2,200x DDoS amplification attacks New SLP bug can lead to massive 2,200x DDoS amplification attacks + Google disrupts the CryptBot info-stealing malware operation Google disrupts the CryptBot info-stealing malware operation + Android Minecraft clones with 35M downloads infect users with adware Android Minecraft clones with 35M downloads infect users with adware + Two Days Only: Get Microsoft Office 2021 on sale for just $39 Two Days Only: Get Microsoft Office 2021 on sale for just $39 + Microsoft: Windows 10 22H2 is the final version of Windows 10 Microsoft: Windows 10 22H2 is the final version of Windows 10 + Google banned 173K developer accounts to block malware, fraud rings Google banned 173K developer accounts to block malware, fraud rings * Downloads + Latest + Most Downloaded + Qualys BrowserCheck Qualys BrowserCheck + STOPDecrypter STOPDecrypter + AuroraDecrypter AuroraDecrypter + FilesLockerDecrypter FilesLockerDecrypter + AdwCleaner AdwCleaner + ComboFix ComboFix + RKill RKill + Junkware Removal Tool Junkware Removal Tool * Virus Removal Guides + Latest + Most Viewed + Ransomware + Remove the Theonlinesearch.com Search Redirect Remove the Theonlinesearch.com Search Redirect + Remove the Smartwebfinder.com Search Redirect Remove the Smartwebfinder.com Search Redirect + How to remove the PBlock+ adware browser extension How to remove the PBlock+ adware browser extension + Remove the Toksearches.xyz Search Redirect Remove the Toksearches.xyz Search Redirect + Remove Security Tool and SecurityTool (Uninstall Guide) Remove Security Tool and SecurityTool (Uninstall Guide) + How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo + How to remove Antivirus 2009 (Uninstall Instructions) How to remove Antivirus 2009 (Uninstall Instructions) + How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller + Locky Ransomware Information, Help Guide, and FAQ Locky Ransomware Information, Help Guide, and FAQ + CryptoLocker Ransomware Information Guide and FAQ CryptoLocker Ransomware Information Guide and FAQ + CryptorBit and HowDecrypt Information Guide and FAQ CryptorBit and HowDecrypt Information Guide and FAQ + CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ * Tutorials + Latest + Popular + How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 + How to use the Windows Registry Editor How to use the Windows Registry Editor + How to backup and restore the Windows Registry How to backup and restore the Windows Registry + How to open a Windows 11 Command Prompt as Administrator How to open a Windows 11 Command Prompt as Administrator + How to start Windows in Safe Mode How to start Windows in Safe Mode + How to remove a Trojan, Virus, Worm, or other Malware How to remove a Trojan, Virus, Worm, or other Malware + How to show hidden files in Windows 7 How to show hidden files in Windows 7 + How to see hidden files in Windows How to see hidden files in Windows * Deals + Categories + eLearning eLearning + IT Certification Courses IT Certification Courses + Gear & Gadgets Gear + Gadgets + Security Security * Forums * More + Startup Database + Uninstall Database + Glossary + Chat on Discord + Send us a Tip! + Welcome Guide * Home * News * Google * Google will add End-to-End encryption to Google Authenticator * * Google will add End-to-End encryption to Google Authenticator By Lawrence Abrams * April 26, 2023 * 05:11 PM * 3 The world with a lock in it Google is bringing end-to-end encryption to Google Authenticator cloud backups after researchers warned users against synchronizing 2FA codes with their Google accounts. This week, Google Authenticator had finally received the long-awaited feature of being able to back up 2FA tokens to the cloud. This new feature allows users to synchronize their Google Authenticator 2FA tokens with their Google account, providing a backup if their mobile device is lost or damaged. It also allows users to access their 2FA tokens on multiple devices as long as they are all logged into the same Google account. No end-to-end encryption However, soon after Google Authenticator cloud sync was announced, security researchers at Mysk discovered that the data was not being end-to-end encrypted while being uploaded to Google's servers. "We analyzed the network traffic when the app syncs the secrets, and it turns out the traffic is not end-to-end encrypted," reads a tweet from Mysk. "As shown in the screenshots, this means that Google can see the secrets, likely even while they're stored on their servers. There is no option to add a passphrase to protect the secrets, to make them accessible only by the user." Mysk tweet End-to-End encryption is when data is encrypted on a device using a password only known to the owner before it is transmitted and stored on another device. As this data is encrypted, it can no longer be accessed by anyone else, even those with access to the server the data is stored on. As Google Authenticator does not offer end-to-end encryption, the data is stored on Google's server in a format that unauthorized users could potentially access, whether through a Google breach or an unscrupulous employee. "Every 2FA QR code contains a secret, or a seed, that's used to generate the one-time codes. If someone else knows the secret, they can generate the same one-time codes and defeat 2FA protections," continued Mysk. "So, if there's ever a data breach or if someone obtains access to your Google Account, all of your 2FA secrets would be compromised." Authy, another popular authenticator app, has grown in popularity over the years as it offers cloud backups of 2FA tokens that are end-to-end encrypted. When using this feature on Authy, users must enter a password only they know, causing any uploaded data to be encrypted before it leaves their mobile device. Furthermore, Authy does not allow data to be backed up unless an end-to-end encryption password is set, providing better security. However, this feature poses a risk, since users could be locked out of their data and unable to restore it to another device if they lose the password. E2EE coming to Google Authenticator Google has heard users' concerns about the lack of end-to-end encryption and said they would add it to a future version of Google Authenticator. Google Group Product Manager Christiaan Brand told BleepingComputer that due to the possibility of end-to-end encryption causing users to get locked out of their own data, they are rolling out this feature carefully in their products. "The security and safety of our users is paramount to everything we do at Google, and it's a responsibility we take seriously. The recent update to the Google Authenticator app was done with that mission in mind and we took careful steps to ensure we were able to offer it to users in a way that protects their security and privacy, but is also useful and convenient," Brand told BleepingComputer. "We encrypt data in transit, and at rest, across our products, including in Google Authenticator. End-to-End Encryption (E2EE) is a powerful feature that provides extra protections, but at the cost of enabling users to get locked out of their own data without recovery. To ensure that we're offering a full set of options for users, we have also begun rolling out optional E2EE in some of our products, and we plan to offer E2EE for Google Authenticator in the future." Google also already provides E2E encryption in some of its services, such as Google Chrome, which lets you set a passphrase to encrypt data synchronized with Google accounts. Related Articles: Google Authenticator now backs up your 2FA codes to the cloud GitHub makes 2FA mandatory next week for active developers GitHub to require all users to enable 2FA by the end of 2023 Google: Gmail client-side encryption now publicly available Google banned 173K developer accounts to block malware, fraud rings * 2FA * E2EE * End-to-end encryption * Google * Google Authenticator * MFA * Two-factor Authentication * * * * * Lawrence Abrams Lawrence Abrams is the owner and Editor in Chief of BleepingComputer.com. Lawrence's area of expertise includes Windows, malware removal, and computer forensics. Lawrence Abrams is a co-author of the Winternals Defragmentation, Recovery, and Administration Field Guide and the technical editor for Rootkits for Dummies. * Previous Article * Next Article Comments * XSp Photo XSp - 22 hours ago + + The fact that they released this functionality without end to end encryption is about enough to condemn the whole thing. What the f*ck was Google thinking? Do they still have people working there that think so poorly about the subject, understand so little about security? And then they come out shooting themselves on the foot with this outdated stupid idea of offering optional E2EE once again because of worries of people getting locked out of their accounts... the same crap that condemned RCS for me. This entire thing is the whole reason I've been moving away from Google products... they are unwilling to understand that half measures leaves most of their users vulnerable to attacks, and that you cannot make security stronger if everything you do is half measures most of your users won't adopt. This weak stance on security they put up does more damage than doing nothing at all. It fools people who don't know about the technical aspects of this to think they are secure somehow when they actually have become even more exposed. If you are worried about people getting locked out of accounts if they lose the keys, put more warnings up, educate better, and come up with better ways for people to backup their crap. Leave secondary methods of authentication up to be used only in emergencies. There are several strategies that could be adopted there, and none of them justify handling and storing ToTP keys in plaintext on the cloud. To me, this only signals that someone developing this whole deal doesn't understand fundamental principles of the entire concept. There is either complete incompetence there, or malicious intent, neither of which people should give space for. * Mahhn Photo Mahhn - 10 hours ago + + @XSp, I suspect they are doing what their business model is, data harvesting (for marketing and other purposes). It's not impossible, and actually it's very likely that the entire reason they want to back up this data, is to have access to it. * LIstrong Photo LIstrong - 7 hours ago + + Data scraping of consumer and enterprise data is for resale for all sorts of nefarious purposes, none to do with advertising. Whenever you use free or cheap software, you are the product, not the customer. Google has fantastic security, internally. Post a Comment Community Rules You need to login in order to post a comment [Login] Not a member yet? Register Now You may also like: [INS::INS] [mWise-call-for-speakers2] Popular Stories * Micosoft Exchange New Microsoft 365 outage causes Exchange Online connectivity issues * TP-Link TP-Link Archer WiFi router flaw exploited by Mirai malware Latest Downloads * Malwarebytes Anti-Malware Logo Malwarebytes Anti-Malware Version: 4.5.27 4M+ Downloads * AdwCleaner Logo AdwCleaner Version: 8.4.0.0 56M+ Downloads * Windows Repair (All In One) Logo Windows Repair (All In One) Version: 4.13.1 2M+ Downloads * Everything Desktop Search Logo Everything Desktop Search Version: 1.4.1.1017 22,739 Downloads * Zemana AntiLogger Free Logo Zemana AntiLogger Free Version: 1.8.2.320 53,698 Downloads Follow us: * * * * * Main Sections * News * VPN Buyer Guides * Downloads * Virus Removal Guides * Tutorials * Startup Database * Uninstall Database * Glossary Community * Forums * Forum Rules * Chat Useful Resources * Welcome Guide * Sitemap Company * About BleepingComputer * Contact Us * Send us a Tip! * Advertising * Write for BleepingComputer * Social & Feeds * Changelog Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2023 Bleeping Computer^(r) LLC - All Rights Reserved Login Username [ ] Password [ ] [*] Remember Me [ ] Sign in anonymously [Login] Sign in with Twitter button Sign in with Twitter --------------------------------------------------------------------- Not a member yet? Register Now Reporter Help us understand the problem. What is going on with this comment? * ( )Spam * ( )Abusive or Harmful * ( )Inappropriate content * ( )Strong language * ( )Other [ ] * [ ] Read our posting guidelinese to learn what content is prohibited. Submitting... SUBMIT