Google’s 2FA app update lacks end-to-end encryption, researchers find

Data synced between devices with the new Google Authenticator app update could be viewed by third parties. Google says the app works as planned. 

On April 25, security researchers Tommy Mysk and Talal Haj Bakry, who are known collectively on Twitter as Mysk, warned users of Google’s Authenticator 2FA app to not turn on a new syncing feature. Mysk discovered a flaw in the feature in which “secrets” or credentials shared across devices are not end-to-end encrypted; this could allow attackers or Google to view those credentials.

Google Group Product Manager, Identity and Security Christiaan Brand tweeted that the Authenticator app shipped as intended.

Jump to:

What does the update bring to Google’s Authenticator app?

On Android and iOS devices, users can sync 2FA credentials to log into various services such as social media. The change came about when Google enabled its 2FA Authenticator app to sync credentials across different devices. This is a “much-needed” feature, Mysk said, as it makes it easier to get back into an account even if you can’t access the device on which you originally logged in. However, the new syncing feature came with a major flaw.

What is the security vulnerability in Google’s 2FA?

In short, the network traffic used to sync the secrets in Google Authenticator is not end-to-end encrypted. Each “secret” within 2FA QR codes is used to generate a unique code; when the Authenticator app syncs secrets between devices, they are sent in a format that Google or attackers can see. There is no setting through which a user could passphrase protect or otherwise obscure their 2FA secrets. (Mysk noted that Google Chrome does support passphrases for a similar use.)

If someone acquires your Google Account through either a data breach or another means, they could find the 2FA secrets that unlock the account’s protections.

The lack of end-to-end encryption also means Google has a transparent view into what services each account owner uses; this is information Google could use to target personalized ads. It might also reveal the name of accounts, including those like professional and personal Twitter accounts, which might not be publicly linked.

Interestingly, Mysk found the app does not expose 2FA credentials associated with the user’s Google account.

SEE: Google Workspace added client-side encryption to Gmail and Calendar in March.

How to use the Google Authenticator app safely

Using Google Authenticator offline without linking it to your Google account is one way to get around this security issue, as is not using the syncing feature. However, both options remove a lot of the utility of the new update.

On Twitter, Mysk wrote: “The bottom line: although syncing 2FA secrets across devices is convenient, it comes at the expense of your privacy. Fortunately, Google Authenticator still offers the option to use the app without signing in or syncing secrets. We recommend using the app without the new syncing feature for now.”

How Google has responded to this security news

Brand replied to these concerns on Twitter, saying that the “extra protections” offered by end-to-end encryption were set aside to balance against “the cost of enabling users to get locked out of their own data without recovery.”

He added, “To make sure we’re offering users a full set of options, we’ve started rolling out optional E2E encryption in some of our products, and we have plans to offer E2EE for Google Authenticator down the line.”