Google Authenticator's Cloud-Synced 2FA Codes Pose Security Risks

Google Authenticator's new feature that enables the backup and syncing of 2FA codes across devices using a Google Account is not end-to-end encrypted, leaving the sensitive one-time passcodes potentially exposed to bad actors. Mysk security researchers found that the unencrypted traffic contains a "seed" that's used to generate the 2FA codes, and anyone with access to that seed can generate their own codes for the same accounts and break in to them. Google has advised users not to enable the Google account feature that syncs 2FA codes across devices and the cloud until end-to-end encryption is added.