Backup in the cloud of Google Authenticator means loosing control
Two-factor authentication (2FA) is widely recommended for security, but the devil is in the details. Google recently faced issues with their Google Authenticator app, causing concern in the security community.
Authenticator apps like Google Authenticator, Microsoft Authenticator, and Authy generate time-dependent six-digit numbers based on a secret key. This system, known as time-based one-time passwords (TOTP), is secure because it regenerates a new password every 30 seconds. The TOTP secret key is stored on your phone and the server you’re authenticating with, posing risks if your phone is lost.
Most authenticator apps offer backup methods, but Google Authenticator had a flaw in its cloud backup system. Cloud backup should be end-to-end encrypted to protect the secret key during transmission. Authenticator apps have vulnerabilities, as the secret key needs to be used in an unhashed form, making them more susceptible to server breaches and malware. Trust is required in both the authentication server and the authenticator app, as they have access to your TOTP keys.
MFA with SSO and Password Management: https://idcontrol.pw