> I don't think Google will use those secrets to look into your other accounts, but they can be politely requested by some governments to divulge the secrets, a

> I don't think Google will use those secrets to look into your other accounts, but they can be politely requested by some governments to divulge the secrets, and not tell you about it A lot of companies and institutions use GA for 2FA for their secure systems too. Google doesn't even need to willingly share, as soon as the possibility of extracting the data is there they paint a target on it. External attacks are now extremely low hanging fruit with that unencrypted traffic. And internal attacks like getting an employee with access to that unencrypted data to provide it (knowingly or unknowingly) are relatively low effort and don't require the overhead of any legal proceedings or complex exploits. And if this goes through official/legal channels, Google doesn't have one single shred of protection between that data and what authorities can (shockingly legally) ask for. Having the data is a liability for Google. Transferring it insecurely is also a liability for the user.