Google’s New Two-Factor Authentication Isn’t End-to-End Encrypted, Tests Show (Image credit- Yahoo News)
New tests reveal that the Google Authenticator is not end-to-end secured. As a result, this security measure may expose your personal data to outside threats and is not immune to security hazards.
Because Google’s Authenticator app is not end-to-end encrypted, early tests indicate that users may be subjected to security threats.
According to a report, security researchers and developers at software company Mysk tested whether the two-factor authenticator was secure enough for customers.
“As soon as Google introduced the feature, we tried it. We discovered that the software didn’t prompt users to enter a passphrase to safeguard the secrets or provide a choice to do so, the business wrote on Twitter.
Additionally, the experts mentioned that the app’s traffic is not end-to-end encrypted. The screenshots, which were provided by Mysk, demonstrate that Google is very likely aware of your private information if it is kept on its servers.
If you are concerned that the Google Authenticator is not end-to-end encrypted, you can remove the connection between your Google account and the device to resolve the problem.
Mysk added that even while using several devices is thought to be advantageous, using the 2FA approach exposes the user’s privacy. As a result, the business no longer advises customers to sync their accounts with the app.
This week, Google Authenticator tokens might now be saved on the cloud, according to a report from Mashable, giving customers more options for where to keep them as long as the Google Account is connected.
The dominant search engine claimed that this update fixed a long-standing issue with one-time codes that had been annoying users. The feature is optional, of course, and you have every choice to save it locally if you so choose.
While synching 2FA secrets is incredibly useful, Mysk researchers discovered that once the Google Servers are attacked, they would leak.
What’s worse, the threat actor might be aware of the other details linked to your account, such as the account name and the app that’s attached to it.
It’s quite dangerous, especially for an activist or content creator who often manages numerous Twitter accounts with an alias.
According to Tommy Mysk, you shouldn’t be concerned solely about hackers because Google employees may have unauthorized access to your data.
Tommy continues, “Missing the encryption on an authenticator tool is not a good thing.” Additionally, this implies that Google will have more influence over the targeted advertisements it chooses to display to a specific audience.
Google is anticipated to treat 2FA secrets the same as passwords, according to Mysk. In other words, everything involving sensitive data should be handled with the utmost secrecy and care.
