3 ms·
Under what conditions do you suggest "Google itself also has access to all your 2FA secrets"? (Without cloud backup, & without the installation of a malicious
by gojomo 4y ago
Under what conditions do you suggest "Google itself also has access to all your 2FA secrets"?
(Without cloud backup, & without the installation of a malicious version of 'Google Authenticator', how would they – especially, say, on iOS?)
- cogitoergofutuo 4y agoI think they are referring to the scenario where cloud backup is enabled.
- gojomo 4y agoAha, thanks. But, if the 2FA secrets were end-encrypted as the top link suggests, Google then wouldn't in fact have them - so the ggp-comment accusation that the link "overlooks" this factor is nonsensical. (And if Google were denied access to the cleartext 2FA secrete this, way, then briefly compromising someone's Google account – say by hacking or abuse of legal process – wouldn't automatically compromise all other 2FA-key-protected accounts.)