Wednesday, November 29, 2023
LetsAskBinu.com
  • Home
  • Cybersecurity
  • Cyber Threats
  • Hacking
  • Protection
  • Networking
  • Malware
  • Fintech
  • Internet Of Things
No Result
View All Result
LetsAskBinu.com
No Result
View All Result
Home Cybersecurity

Google’s 2FA App Update Lacks End-to-End Encryption, Researchers Find

Researcher by Researcher
April 29, 2023
in Cybersecurity
0
Google Cloud offers Assured Open Source Software for free
189
SHARES
1.5k
VIEWS
Share on FacebookShare on Twitter


Data synced between devices with the new Google Authenticator app update could be viewed by third parties. Google says the app works as planned. 

A shield and lock on a vector of the world.
Image: Google

On April 25, security researchers Tommy Mysk and Talal Haj Bakry, who are known collectively on Twitter as Mysk, warned users of Google’s Authenticator 2FA app to not turn on a new syncing feature. Mysk discovered a flaw in the feature in which “secrets” or credentials shared across devices are not end-to-end encrypted; this could allow attackers or Google to view those credentials.

Google Group Product Manager, Identity and Security Christiaan Brand tweeted that the Authenticator app shipped as intended.

Related articles

Sentra Raises $30 Million for DSPM Technology

Northern Ireland’s Top Police Officer Apologizes for ‘Industrial Scale’ Data Breach

August 13, 2023
Minimizing Risk Through Proactive Apple Device Management: Addigy

Minimizing Risk Through Proactive Apple Device Management: Addigy

August 12, 2023

Jump to:

What does the update bring to Google’s Authenticator app?

On Android and iOS devices, users can sync 2FA credentials to log into various services such as social media. The change came about when Google enabled its 2FA Authenticator app to sync credentials across different devices. This is a “much-needed” feature, Mysk said, as it makes it easier to get back into an account even if you can’t access the device on which you originally logged in. However, the new syncing feature came with a major flaw.

What is the security vulnerability in Google’s 2FA?

Must-read security coverage

In short, the network traffic used to sync the secrets in Google Authenticator is not end-to-end encrypted. Each “secret” within 2FA QR codes is used to generate a unique code; when the Authenticator app syncs secrets between devices, they are sent in a format that Google or attackers can see. There is no setting through which a user could passphrase protect or otherwise obscure their 2FA secrets. (Mysk noted that Google Chrome does support passphrases for a similar use.)

If someone acquires your Google Account through either a data breach or another means, they could find the 2FA secrets that unlock the account’s protections.

The lack of end-to-end encryption also means Google has a transparent view into what services each account owner uses; this is information Google could use to target personalized ads. It might also reveal the name of accounts, including those like professional and personal Twitter accounts, which might not be publicly linked.

Interestingly, Mysk found the app does not expose 2FA credentials associated with the user’s Google account.

SEE: Google Workspace added client-side encryption to Gmail and Calendar in March.

How to use the Google Authenticator app safely

Using Google Authenticator offline without linking it to your Google account is one way to get around this security issue, as is not using the syncing feature. However, both options remove a lot of the utility of the new update.

On Twitter, Mysk wrote: “The bottom line: although syncing 2FA secrets across devices is convenient, it comes at the expense of your privacy. Fortunately, Google Authenticator still offers the option to use the app without signing in or syncing secrets. We recommend using the app without the new syncing feature for now.”

How Google has responded to this security news

Brand replied to these concerns on Twitter, saying that the “extra protections” offered by end-to-end encryption were set aside to balance against “the cost of enabling users to get locked out of their own data without recovery.”

He added, “To make sure we’re offering users a full set of options, we’ve started rolling out optional E2E encryption in some of our products, and we have plans to offer E2EE for Google Authenticator down the line.”





Source link

Tags: 2FAappencryptionendtoendFindGooglesLacksResearchersupdate
Share76Tweet47

Related Posts

Sentra Raises $30 Million for DSPM Technology

Northern Ireland’s Top Police Officer Apologizes for ‘Industrial Scale’ Data Breach

August 13, 2023
0

Northern Ireland’s top police officer apologized Thursday for what he described as an “industrial scale” data breach in which the...

Minimizing Risk Through Proactive Apple Device Management: Addigy

Minimizing Risk Through Proactive Apple Device Management: Addigy

August 12, 2023
0

Enterprise IT teams are struggling to cope with three major forces of change: the evolving regulatory environment, a globally dispersed...

Decipher Podcast: Katelyn Bowden and TC Johnson

Decipher Podcast: Katelyn Bowden and TC Johnson

August 12, 2023
0

Veilid main site: https://veilid.com/ Cult of the Dead Cow site: https://cultdeadcow.com/ Source link

In Other News: Government Use of Spyware, New Industrial Security Tools, Japan Router Hack 

In Other News: macOS Security Reports, Keyboard Spying, VPN Vulnerabilities

August 12, 2023
0

SecurityWeek is publishing a weekly cybersecurity roundup that provides a concise compilation of noteworthy stories that might have slipped under...

Used Correctly, Generative AI is a Boon for Cybersecurity

Used Correctly, Generative AI is a Boon for Cybersecurity

August 12, 2023
0

Adobe stock, by Busra At the Black Hat kickoff keynote on Wednesday, Jeff Moss (AKA Dark Tangent), the founder of...

Load More
  • Trending
  • Comments
  • Latest
This Week in Fintech: TFT Bi-Weekly News Roundup 08/02

This Week in Fintech: TFT Bi-Weekly News Roundup 15/03

March 15, 2022
Supply chain efficiency starts with securing port operations

Supply chain efficiency starts with securing port operations

March 15, 2022
Microsoft to Block Macros by Default in Office Apps

Qakbot Email Thread Hijacking Attacks Drop Multiple Payloads

March 15, 2022
QNAP Escalation Vulnerability Let Attackers Gain Administrator Privileges

QNAP Escalation Vulnerability Let Attackers Gain Administrator Privileges

March 15, 2022
Beware! Facebook accounts being hijacked via Messenger prize phishing chats

Beware! Facebook accounts being hijacked via Messenger prize phishing chats

0
Shoulder surfing: Watch out for eagle‑eyed snoopers peeking at your phone

Shoulder surfing: Watch out for eagle‑eyed snoopers peeking at your phone

0
Remote work causing security issues for system and IT administrators

Remote work causing security issues for system and IT administrators

0
Elementor WordPress plugin has a gaping security hole – update now – Naked Security

Elementor WordPress plugin has a gaping security hole – update now – Naked Security

0
ID Theft Service Resold Access to USInfoSearch Data – Krebs on Security

ID Theft Service Resold Access to USInfoSearch Data – Krebs on Security

November 28, 2023
Staying safe when shopping online this holiday season

Staying safe when shopping online this holiday season

November 28, 2023
This Week in Fintech: TFT Bi-Weekly News Roundup 08/02

This Week in Fintech: TFT Bi-Weekly News Roundup 28/11

November 28, 2023
North Korean Hackers Exploiting Zero-day Vulnerabilities

North Korean Hackers Exploiting Zero-day Vulnerabilities

November 28, 2023

Recent Posts

ID Theft Service Resold Access to USInfoSearch Data – Krebs on Security

ID Theft Service Resold Access to USInfoSearch Data – Krebs on Security

November 28, 2023
Staying safe when shopping online this holiday season

Staying safe when shopping online this holiday season

November 28, 2023
This Week in Fintech: TFT Bi-Weekly News Roundup 08/02

This Week in Fintech: TFT Bi-Weekly News Roundup 28/11

November 28, 2023

Categories

  • Cyber Threats
  • Cybersecurity
  • Fintech
  • Hacking
  • Internet Of Things
  • LetsAskBinuBlogs
  • Malware
  • Networking
  • Protection

Tags

Access attack Attacks banking BiWeekly bug Cisco cloud code critical Cyber Cybersecurity Data Digital exploited financial Fintech Flaw flaws Google Group Hackers Krebs Latest launches malware Microsoft million Network News open patches platform Ransomware RoundUp security Software Stories TFT Threat Top vulnerabilities vulnerability warns Week

© 2022 Lets Ask Binu All Rights Reserved

No Result
View All Result
  • Home
  • Cybersecurity
  • Cyber Threats
  • Hacking
  • Protection
  • Networking
  • Malware
  • Fintech
  • Internet Of Things

© 2022 Lets Ask Binu All Rights Reserved