↓ Skip to main content

“Since one time codes in Authenticator were only stored on a single device, a loss of that device meant that users lost their ability to sign in to any service on which they’d set up 2FA using Authenticator.”

Christiaan Brandsecurity.googleblog.com ↗

It took Google 13 years to let Authenticator users back up their codes. The fix stores every 2FA secret in your Google Account, which makes one Google login the key to everything else. The post spends a paragraph on passkeys and Password Manager and none on who can read the synced secrets. “Something you have” is now something Google has.