It would be nice if a company did the right thing by themselves, not only when the angry mob shows up.

I agree though, it was quick.

It seems like most of the time when there's some kind of outrage (at least on HN) there's just silence for 20 - 40 days, then some kind of announcement that either doubles down or backs off. This whole outrage started what, Yesterday?

That quick response is indicative that E2EE might have been on the roadmap already. It's a bunch of trade-offs:

- Keep things as they are

- Avoid TOTP data getting lost with lost passwords

- Avoid TOTP data getting distributed when the Google-side backup ends up becoming public

Maybe this might have been a suitable situation for a "beta" label, though: "We have this, it offers advantages, it has caveats, if you don't care about them, feel free to sign up, otherwise wait until we sorted it out."

(Disclosure: work at Google, but no insight into what Authenticator is doing)

How the f** they did not have them to begin with? Since when Google has become totally incompetent. They are quite sure that two-factor authenticator is use on security sensitive properties, including Google’s own services. This is like begging Google Drive hackers to get your two-factor seeds.

How the f** they did not have them encrypted to begin with? Since when Google has become totally incompetent. They are quite sure that two-factor authenticator is use on security sensitive properties, including Google’s own services. This is like begging Google Drive hackers to get your two-factor seeds.

I am on the whole not that impressed with the quality of Google stuff. It's not like it was 20 years ago, when seeing the Google version of something was really exciting, like when Search, Gmail or Maps first came out. Now I look at Google about how I looked at Microsoft back then... a company whose products that I'm generally better off avoiding, and when I do use them, it's usually not because of the product quality itself.

> How the f* they did not have them encrypted to begin with?

They are encrypted while transit and at rest, just not E2EE, which is understandable based on the link, but still should be an option like passoword manager in Chrome has.