For example, if I add two accounts from different non-Google services, can Google (or maybe those services) because of that link them both together with my gmail account?
1 Answer
Not at all.
Google Authenticator is just an application to generate TOTP. It's easy to install, easy to use, so most people equals TOTP to Google Authenticator. The tokens you add are not tied to anything, not your email, nor your phone, nor anything.
It does not send any data anywhere. You can test it by putting your phone on Airplane Mode and opening it. All tokens for all your accounts will be updated every 30 seconds as always.
I usually don't recommended using Google Authenticator because it lacked a way to export your tokens, so if you lost your phone, all your 2FA tokens were lost and you had to log into every site using a backup code to recreate the token. And if you replaced the phone you had to log on every site and do the same.
So you can use it without worrying about anything leaking about your accounts.
-
Agreed, and there are suitable (and sometimes open source) alternatives that can be used in its place. Commented May 5, 2021 at 22:39
-
Google Authenticator currently has import/export functionality. Commented May 6, 2021 at 4:18