News for hackers. Stuff that matters.

A comment on Google will add E2E encryption to Authenticator backups. Parent comment

Re:Google will add E2E encryption to Authenticator backups by great_psy on Thursday April 27, 2023 @10:42AM (#35728899)
It would be nice if a company did the right thing by themselves, not only when the angry mob shows up.
[ Parent | on HN ]
Re:Google will add E2E encryption to Authenticator backups by coding123 on Thursday April 27, 2023 @11:38AM (#35729716)
I agree though, it was quick.

It seems like most of the time when there's some kind of outrage (at least on HN) there's just silence for 20 - 40 days, then some kind of announcement that either doubles down or backs off. This whole outrage started what, Yesterday?

[ Parent | on HN ]
Re:Google will add E2E encryption to Authenticator backups by pgeorgi on Thursday April 27, 2023 @12:23PM (#35730473)
That quick response is indicative that E2EE might have been on the roadmap already. It's a bunch of trade-offs:

- Keep things as they are

- Avoid TOTP data getting lost with lost passwords

- Avoid TOTP data getting distributed when the Google-side backup ends up becoming public

Maybe this might have been a suitable situation for a "beta" label, though: "We have this, it offers advantages, it has caveats, if you don't care about them, feel free to sign up, otherwise wait until we sorted it out."

(Disclosure: work at Google, but no insight into what Authenticator is doing)

[ Parent | on HN ]