“But through this Google update, what was previously multi-factor-authentication had silently (to administrators) become single-factor-authentication, because control of the Okta account led to control of the Google account, which led to control of all OTPs stored in Google Authenticator.”
One employee clicked one SMS link, read one code to a caller with a deepfaked voice, and 27 crypto customers lost their accounts. Google Authenticator syncs codes to the cloud by default, and admins have no switch to turn it off. Google shipped a convenience feature and quietly turned every Authenticator user’s second factor into a copy of the first. Retool also blames the employee’s phone call, but the company let one Okta session unlock the VPN and the admin tools.