Google Authenticator and the False Security of One-Time Passwords

What is Google Authenticator and what is it supposed to protect?

Google Authenticator is a mobile application designed to generate temporary login codes (OTPs – One Time Passwords) used as a second authentication factor (2FA) in systems that support two-factor authentication. Its primary purpose is to add an additional layer of security to a simple password, making it more difficult for unauthorized access to accounts.

In practical terms, even if an attacker manages to steal or guess the user's password, they won't be able to log in without the temporary code generated by the app. This approach has become a security standard across numerous online platforms, including financial services, cloud computing tools, email providers, and social networks.

How it works, step by step

Let's take a concrete example: imagine we want to log in to our account on a service that has enabled one-time password authentication. After entering our username and password, the system will ask us to provide a second code: this is the one-time password generated by the Google Authenticator app.

The app, once configured for that account, generates a 30-digit numeric code every 6 seconds. This code is calculated locally on the device, based on a TOTP (Time-based One-Time Password) algorithm that uses:

• a secret key shared with the service server
• the current time of the device

Since both the service server and the app have the same key and time synchronization, they both generate the same code at the same time. The user enters it into the login form, and if the code is valid and temporarily consistent, access is authorized.

All this happens without requiring an active internet connection, neither on the part of the app nor on the server that generated it. It's precisely this simplicity and independence that has made Google Authenticator so widespread.

A brief history of the application

Google Authenticator was launched in 2010 in response to the growing need for a second authentication factor for Google accounts, and was later made available for use with third-party services. Initially available only for Android, it was later released for iOS as well.

It works based on the TOTP (Time-based One-Time Password) standard defined by RFC 6238, and on the generation of OTP codes synchronized with the device's clock. The codes are regenerated every 30 seconds and do not require an internet connection or cloud access to function.

For many years, Google Authenticator was the go-to solution for two-factor authentication. However, it also faced criticism for its lack of backup and sync features, a shortcoming that was only addressed in 2023 with the introduction of cloud sync, which raised new security concerns.

Piattaforme supported

Google Authenticator is officially available for:

• Android (via Google Play Store)
• iOS (via App Store)

The app can be used to generate OTP codes for any service compatible with the TOTP standard, including:

• Google Account
• Microsoft Account
• Amazon Web Services (AWS)
• GitHub
• Dropbox
• Facebook
• Twitter (now X)
• Slack
• Wordpress
• Hetzner, OVH, DigitalOcean and other cloud providers
• Banking services that support external OTPs

Additionally, it is also compatible with any custom system that supports generating TOTP codes through a shared key.

The problem it's supposed to solve: the weakness of passwords alone

Passwords alone are no longer considered sufficient. With increasingly sophisticated phishing attacks, databases of stolen passwords circulating on the dark web, and users' tendency to reuse the same passwords across multiple services, two-factor authentication (2FA) is now considered a minimum security measure.

Google Authenticator was created specifically to reduce the risk that, even in the event of credential theft, access to accounts will be prevented without physical possession of the smartphone that generates the OTP.

Google's Backup and Sync Feature: A Double-Edged Sword

In 2023, Google introduced a much-discussed feature: the automatic syncing of OTP codes with your Google Account. This means that if you lose or break your smartphone, simply log in to your Google Account on a new device to recover your saved codes.

At first glance, this feature greatly simplifies OTP management and recovery. But it also introduces a dangerous vulnerability: all the security of two-factor authentication is transferred to a single compromiseable element: the Gmail account.

If an attacker manages to obtain a person's Google account credentials, they can easily install Google Authenticator on their device and sync OTPs, completely nullifying the protection provided by 2FA.

Real-world case study: 100 Hetzner cloud instances powered up in minutes

This article was born following a serious accident that occurred to one of our customers.

Within minutes, over 100 cloud instances were activated on Hetzner's account , potentially costing thousands of euros. Initially, we suspected a login with stolen credentials and a bypassed OTP. After a thorough analysis, we discovered that the attackers had gained access to the customer's Gmail account.

From there, they regained access to Hetzner using the “recover password” process via email, and then used Google Authenticator synced to the Google account to obtain the OTPs needed to bypass 2FA.

Result: the entire security mechanism collapsed, despite the adoption of two-factor authentication.

The false sense of security

This case highlights a key point: many users believe they are safe just because they use OTP , ignoring the fact that if OTP codes are synchronized and accessible from a vulnerable cloud service (such as Gmail), the entire security setup is fragile.

In other words, if your email is compromised, it's as if you don't have two-factor authentication.

The solution: Unlink Google Authenticator from your Google Account

Google allows, although it doesn't actively promote it, disabling OTP syncing to your Google Account. Simply go to the Google Authenticator app settings and remove the association with your Google Account.

This way, OTP codes remain locally on your device and aren't synced to the cloud . Even if someone hacks your Gmail, they still won't have access to the Google Authenticator app and its codes.

But this solution has a problem: if you lose or break the smartphone on which the unsynced app is installed, you will no longer be able to access your protected accounts unless you have manual backups or previously saved emergency codes.

Best Practice: Clone your app across multiple devices

The best strategy, therefore, is to adopt a hybrid approach that combines the security of local management with redundancy across multiple devices, avoiding cloud synchronization.

1. Disable cloud sync Google Authenticator from any device: In the app settings, remove the association with your Google Account.
2. Use the Google Authenticator app's built-in export feature: By accessing the app, tap the three-dot icon in the top right, then select "Transfer Account" → "Export Account". A QR code containing all your configured accounts will be generated.
3. On the second device, open Google Authenticator and choose “Transfer Account” → “Import Account,” then scan the QR code generated by the primary device. This will securely copy all OTPs to the new device. without the need to connect to a Google account.
4. Please store the secondary device carefully or migrate to a third device for added redundancy.
5. Alternatively, consider using apps open source like Aegis Authenticator or FreeOTP, which offer advanced features such as encrypted backups and manual exports.

This method allows you to have an exact copy of all your OTPs across multiple devices, ensuring that if your primary phone is lost or damaged, you can still access your 2FA-protected accounts, without exposing your codes to the cloud and without relying on automatic Google sync.

Conclusion: Protecting the OTP means protecting the digital identity

Two-factor authentication is an important measure, but it's not foolproof. Blindly relying on a cloud-synced OTP app can give a false sense of security and become a vulnerability.

The case of our client, who saw his Hetzner account hacked and compromised with potentially enormous damage, teaches us that it is essential to understand how the security tools we use actually work and to configure everything carefully.

In an increasingly connected world, protecting your credentials and OTPs means protecting your digital identity, your data, and often, your wallet.

Don't let the convenience of the cloud compromise the security of your accounts.