4 ms·
> you can generate and input the key yourself, so that Google never sees it. Google still needs to know the secret. All authenticators are based on a shared se
by dsl 15y ago
> you can generate and input the key yourself, so that Google never sees it.
Google still needs to know the secret. All authenticators are based on a shared secret model, so the same possible attack vector that bit RSA.
- devicenull 15y agoRight, but a compromise of your token for Google's services would not mean your token for your job was compromised as well. You could even generate a new key for each machine you connect to, if you were paranoid enough.