3 ms·
If your threat model includes a compromise of Google (or your Google account), sure. You should also probably use a hardware TOTP device in that case. For most
by mgrund 3y ago
If your threat model includes a compromise of Google (or your Google account), sure. You should also probably use a hardware TOTP device in that case. For most people, this is a sufficient level of security. It’s always a trade off between convenience and safety.
- tremere 3y agoOr, maybe, that Google looks the other way while another entity uses your token.
- ece 3y agoWith NSLs they can't tell anyone.
- tyingq 3y agoCould also include other risks, like: - Google is compelled by a warrant to share all your plaintext seeds - Plaintext seeds are accidentally exposed to apis available to chrome extension developers