An important technique in maintaining online privacy is to keep separate accounts unlinked. A person may have one email address for everyday use and a second one for something more sensitive.

If this person uses the same 2FA app (such as Auth, Google Authenticator, or FreeOTP), are these accounts now linked?

Does the answer depend on the app provider? For example, Authy provides backups, so they must be sending something important to their servers.

  • Definitely depends on the app provider. – Moshe Katz Mar 7 '17 at 15:40
  • Authy does store the labels in plain text on their servers. Unless you change the labels as ThoriumBR mentioned, then any accounts entered into Authy are linked. They might be linked anyway because when you scan the QR code to add the app, it often includes identifying info such as a username or email address. – phylae Mar 9 '17 at 21:41

On TOTP-based 2FA (Time Based One Time Password), you have the seed, and the timestamp. At every interval (generally 30 seconds), the 2FA program concatenates the key and the timestamp, hashes it, cuts to a predefined size, and gives you the result.

To log in using TOTP, you will send this result to the server, and the server will do the same: concatenate the seed from your user (he has it stored) with the timestamp, hash, cut, and compare the result with the value you send. If it matches, good, access allowed.

You don't link 2FA accounts in any way. If you use Google Auth for a couple accounts, all you have done is to store the seed and the provider name (that you can edit freely) on a convenient application. You could even save the key to a text file and do the calculations by hand.

The problem is not linking the accounts, but leaking the database. Authy asks (requires?) a password for creating a backup database, so the copy you sent to their servers is an encrypted binary blob, and I don't think Authy stores the database password.

In case someone gets your phone (law enforcement, spouse, colleague) and opens the 2FA application, it can see all account labels and infer what kind of services you use. Using non descriptive labels (like calling GMail or Funny Cats the 2FA token for a sensitive service) can help keeping this list more private.

  • My understanding of your response is that there is nothing inherent in TOTP-based 2FA that links the seeds store in a single app to each other. However, it is technically possible for the implementation (the app) to track things like the number of seeds and the labels used for those seeds. – phylae Mar 7 '17 at 17:19
  • If law enforcement has access to my 2FA device (and therefore the seeds), is it possible for them to ask Google to give them a list of Gmail accounts that use this seed? I suspect that would be a very short list. – phylae Mar 7 '17 at 17:21
  • @phylae A TOTP token is the analog of a physical key for a common deadbolt lock. Unless you write on it what lock it opens, it cannot be easily traced, and someone peeking at you keyring only can know the number of keys you have, not where they belong and which ones are fakes. And if law enforcement wants to know what Gmail account you do have, they can just look at the phone itself, it's way easier. – ThoriumBR Mar 7 '17 at 17:46
  • With regards to law enforcement (or a hacker), I'm referring to an account that the phone is not used to log into. With only the seed, is it technically possible for the account provider to determine which account the seed belongs to? Given your analogy of the deadbolt lock, the answer seems to be, "Yes." The account provider can simply try using the seed to authenticate with every account. Even with Google or Facebook, there are only a few billion accounts, so a brute force attack is practical. – phylae Mar 8 '17 at 16:05
  • If the account provider is Google for Gmail, or Facebook, it does not have to bruteforce anything, they have the seed stored on the database along with your username and password. If the account provider is Authy and the others, they would have a herculean job of bruteforcing billions of usernames and passwords on Google, and if one attempt succeeds, bruteforce lots of 2FA tokens. This is not likely to happen at all, as the account would be disabled way earlier, and rate-limiting would prevent such attack. – ThoriumBR Mar 8 '17 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.