3 ms·
> They sync 2fa codes to your Microsoft account. This seems like a large amount of trust to be placing in Microsoft, since anyone with access to your account w
by trelane 4y ago
> They sync 2fa codes to your Microsoft account.
This seems like a large amount of trust to be placing in Microsoft, since anyone with access to your account would also have access to your shared secret for every site. I would wager that they also would have access to your communications medium and password stores as well, in most cases, since you'd likey have bought in to the wider ecosystem.
Or do they encrypt it client side?
- WiggleGuy 4y agoRestoration of the 2fa codes onto a new device doesn't seem to require communication with the original device, so I don't think there's client-side encryption going on. The Authenticator also has password vaulting features, but I agree that would be a bad idea for both your 2fa codes and your passwords to be in the same place (even worse if you use Outlook!)