The Risks of Google Authenticator's Account Syncing
TL;DR
Google's updated Authenticator app adds Google account synchronization, but the sync process isn't end-to-end encrypted, potentially leaving the seed used to generate 2FA codes visible to Google when stored on its servers. Salesforce Community users are leaking private data due to misconfigured user permissions. A new Meltdown side-channel attack has been discovered that affects multiple generations of Intel CPUs and targets the EFLAGS register using a transient execution flaw to change context execution time.
Topics:technologycybersecurity#authenticator#cybersecurity#e2ee#google#intel-cpu#salesforce-community
- Google adds account sync for Authenticator, without E2EE The Register
- Google’s 2FA app update lacks end-to-end encryption, researchers find TechRepublic
- How to use Google Authenticator offline or without sync 9to5Google
- Be Aware: Google Authenticator Is Not Safe! Gizchina.com
- Are You Safe with Google’s 2FA Syncing? The Disturbing Facts Gizchina.com
Want the full story? Read the original reporting
Read on The Register