Thursday, June 1, 2023
LetsAskBinu.com
  • Home
  • Cybersecurity
  • Cyber Threats
  • Hacking
  • Protection
  • Networking
  • Malware
  • Fintech
  • Internet Of Things
No Result
View All Result
LetsAskBinu.com
No Result
View All Result
Home Cybersecurity

Google’s 2FA App Update Lacks End-to-End Encryption, Researchers Find

Researcher by Researcher
April 29, 2023
in Cybersecurity
0
Google Cloud offers Assured Open Source Software for free
189
SHARES
1.5k
VIEWS
Share on FacebookShare on Twitter


Data synced between devices with the new Google Authenticator app update could be viewed by third parties. Google says the app works as planned. 

A shield and lock on a vector of the world.
Image: Google

On April 25, security researchers Tommy Mysk and Talal Haj Bakry, who are known collectively on Twitter as Mysk, warned users of Google’s Authenticator 2FA app to not turn on a new syncing feature. Mysk discovered a flaw in the feature in which “secrets” or credentials shared across devices are not end-to-end encrypted; this could allow attackers or Google to view those credentials.

Google Group Product Manager, Identity and Security Christiaan Brand tweeted that the Authenticator app shipped as intended.

Related articles

Spring Framework Flaw Exploited in Mirai Malware Attacks

Threat Actors Exploit Critical Zyxel Flaw in Botnet Attacks

June 1, 2023
Cisco Acquiring Armorblox for Predictive and Generative AI Technology

Cisco Acquiring Armorblox for Predictive and Generative AI Technology

June 1, 2023

Jump to:

What does the update bring to Google’s Authenticator app?

On Android and iOS devices, users can sync 2FA credentials to log into various services such as social media. The change came about when Google enabled its 2FA Authenticator app to sync credentials across different devices. This is a “much-needed” feature, Mysk said, as it makes it easier to get back into an account even if you can’t access the device on which you originally logged in. However, the new syncing feature came with a major flaw.

What is the security vulnerability in Google’s 2FA?

Must-read security coverage

In short, the network traffic used to sync the secrets in Google Authenticator is not end-to-end encrypted. Each “secret” within 2FA QR codes is used to generate a unique code; when the Authenticator app syncs secrets between devices, they are sent in a format that Google or attackers can see. There is no setting through which a user could passphrase protect or otherwise obscure their 2FA secrets. (Mysk noted that Google Chrome does support passphrases for a similar use.)

If someone acquires your Google Account through either a data breach or another means, they could find the 2FA secrets that unlock the account’s protections.

The lack of end-to-end encryption also means Google has a transparent view into what services each account owner uses; this is information Google could use to target personalized ads. It might also reveal the name of accounts, including those like professional and personal Twitter accounts, which might not be publicly linked.

Interestingly, Mysk found the app does not expose 2FA credentials associated with the user’s Google account.

SEE: Google Workspace added client-side encryption to Gmail and Calendar in March.

How to use the Google Authenticator app safely

Using Google Authenticator offline without linking it to your Google account is one way to get around this security issue, as is not using the syncing feature. However, both options remove a lot of the utility of the new update.

On Twitter, Mysk wrote: “The bottom line: although syncing 2FA secrets across devices is convenient, it comes at the expense of your privacy. Fortunately, Google Authenticator still offers the option to use the app without signing in or syncing secrets. We recommend using the app without the new syncing feature for now.”

How Google has responded to this security news

Brand replied to these concerns on Twitter, saying that the “extra protections” offered by end-to-end encryption were set aside to balance against “the cost of enabling users to get locked out of their own data without recovery.”

He added, “To make sure we’re offering users a full set of options, we’ve started rolling out optional E2E encryption in some of our products, and we have plans to offer E2EE for Google Authenticator down the line.”





Source link

Tags: 2FAappencryptionendtoendFindGooglesLacksResearchersupdate
Share76Tweet47

Related Posts

Spring Framework Flaw Exploited in Mirai Malware Attacks

Threat Actors Exploit Critical Zyxel Flaw in Botnet Attacks

June 1, 2023
0

Threat actors are exploiting a critical-severity Zyxel flaw in order to add vulnerable devices to a Mirai botnet variant. While...

Cisco Acquiring Armorblox for Predictive and Generative AI Technology

Cisco Acquiring Armorblox for Predictive and Generative AI Technology

June 1, 2023
0

Cisco on Wednesday announced that it’s acquiring California-based cybersecurity firm Armorblox for its artificial intelligence (AI) technology. Armorblox specializes in...

8 best practices for securing your Mac from hackers in 2023

8 best practices for securing your Mac from hackers in 2023

June 1, 2023
0

Best practices for securing your Mac against potential hacks and security vulnerabilities include enabling the firewall, using strong passwords and...

ZuoRAT Malware Found Hitting Home Routers

New SeroXen RAT Emerges | Decipher

June 1, 2023
0

Security researchers are tracking a new fileless RAT named SeroXen that has the capability to evade many EDR systems and...

Sentra Raises $30 Million for DSPM Technology

Chrome 114 Released With 18 Security Fixes

May 31, 2023
0

Google this week announced the release of Chrome 114 to the stable channel with a total of 18 security fixes...

Load More
  • Trending
  • Comments
  • Latest
This Week in Fintech: TFT Bi-Weekly News Roundup 08/02

This Week in Fintech: TFT Bi-Weekly News Roundup 15/03

March 15, 2022
QNAP Escalation Vulnerability Let Attackers Gain Administrator Privileges

QNAP Escalation Vulnerability Let Attackers Gain Administrator Privileges

March 15, 2022
Supply chain efficiency starts with securing port operations

Supply chain efficiency starts with securing port operations

March 15, 2022
A first look at threat intelligence and threat hunting tools

A first look at threat intelligence and threat hunting tools

March 15, 2022
Beware! Facebook accounts being hijacked via Messenger prize phishing chats

Beware! Facebook accounts being hijacked via Messenger prize phishing chats

0
Shoulder surfing: Watch out for eagle‑eyed snoopers peeking at your phone

Shoulder surfing: Watch out for eagle‑eyed snoopers peeking at your phone

0
Remote work causing security issues for system and IT administrators

Remote work causing security issues for system and IT administrators

0
Elementor WordPress plugin has a gaping security hole – update now – Naked Security

Elementor WordPress plugin has a gaping security hole – update now – Naked Security

0
Spring Framework Flaw Exploited in Mirai Malware Attacks

Threat Actors Exploit Critical Zyxel Flaw in Botnet Attacks

June 1, 2023
All eyes on APIs: Top 3 API security risks and how to mitigate them

All eyes on APIs: Top 3 API security risks and how to mitigate them

June 1, 2023
Cisco Acquiring Armorblox for Predictive and Generative AI Technology

Cisco Acquiring Armorblox for Predictive and Generative AI Technology

June 1, 2023
This Week in Fintech: TFT Bi-Weekly News Roundup 08/02

This Week in Fintech: TFT Bi-Weekly News Roundup /

June 1, 2023

Recent Posts

Spring Framework Flaw Exploited in Mirai Malware Attacks

Threat Actors Exploit Critical Zyxel Flaw in Botnet Attacks

June 1, 2023
All eyes on APIs: Top 3 API security risks and how to mitigate them

All eyes on APIs: Top 3 API security risks and how to mitigate them

June 1, 2023
Cisco Acquiring Armorblox for Predictive and Generative AI Technology

Cisco Acquiring Armorblox for Predictive and Generative AI Technology

June 1, 2023

Categories

  • Cyber Threats
  • Cybersecurity
  • Fintech
  • Hacking
  • Internet Of Things
  • LetsAskBinuBlogs
  • Malware
  • Networking
  • Protection

Tags

Access attack Attacks banking BiWeekly bug Cisco cloud code critical Cybersecurity Data Digital exploited financial Fintech Flaw flaws Google Group Hackers Krebs Latest launches malware Microsoft million Network News open patches Payments platform Ransomware RoundUp security Software Stories TFT Threat Top vulnerabilities vulnerability warns Week

© 2022 Lets Ask Binu All Rights Reserved

No Result
View All Result
  • Home
  • Cybersecurity
  • Cyber Threats
  • Hacking
  • Protection
  • Networking
  • Malware
  • Fintech
  • Internet Of Things

© 2022 Lets Ask Binu All Rights Reserved