Why you shouldn’t use Google Authenticator 2FA code cloud backup feature

Google recently added a new feature to its Authenticator app that lets users backup their 2FA codes to the cloud.

Google Authenticator | Google Authenticator 2FA cloud backup | Google Authenticator 2FA code backup

Google Authenticator has over 100 million installs on the Play Store. (Image Source: Google Play Store)

Listen to this article

00:00

1x 1.5x 1.8x

Google Authenticator is one of the most popular authentication apps with over 100 million installs on the Google Play Store. Earlier this week, Google updated the app with a new feature that allows users to back up their one-time passwords to their Google accounts.

Authenticator apps let users generate one-time passwords for two-factor authentication and offer more protection compared to other methods like SMS-based 2FA, which are susceptible to SIM swap attacks and hackers. To give you a quick recap,two-factor authentication adds an extra layer of security by generating a one-time password in addition to your regular password.

For years, Google Authenticator users have complained about not being able to back up their 2FA codes to the cloud and lack of multi-device support. This meant that if you lost or reset your device, you would lose access to all 2FA configurations which made it hard for many to regain access to their accounts.

Google has just updated its 2FA Authenticator app and added a much-needed feature: the ability to sync secrets across devices.

TL;DR: Don’t turn it on.

The new update allows users to sign in with their Google Account and sync 2FA secrets across their iOS and Android devices.… pic.twitter.com/a8hhelupZR

— Mysk 🇨🇦🇩🇪 (@mysk_co) April 26, 2023

Also Read | Twitter is taking away two-factor authentication from March 20, here’s how to secure your account

Since Google rolled out the ability to backup 2FA codes to the cloud, security researchers at Mysk have found out that when the codes are uploaded to cloud servers, the traffic is not end-to-end encrypted. Moreover, there is no option to add a passphrase to protect these codes, meaning hackers who intercept the network traffic will be able to see all your codes.

According to a report by BleepingComputer, Google will be adding end-to-end encryption to the app support in the future. Until then, we recommend users avoid using the 2FA code cloud backup feature.

Tags:
Google