I was just reading around and found it really fascinating that Authy can use Google Authenticator implementations anywhere.
How does Authy does this? Isn't this a security risk?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
The use of apps other than Google Authenticator is not, by itself, a security risk, provided you trust those apps.
The purpose of 2FA is to prove that you have some physical object (in this case, your phone), in addition to knowing something (the password). This makes it more difficult for an attacker to compromise your account, because they are less likely to simultaneously know your password and have your phone.
The TOTP protocol used by Google Authenticator basically works like this (for full details, see RFC #6238):
This is an open standard, and by design, anyone can implement either half of it (client or server). However, a malicious client implementation could hand the secrets over to an attacker, who could then impersonate you for 2FA purposes, so you should only use client apps which you trust.
All that being said, I have some pretty strong reservations about Authy in particular. When I last investigated it, it stored the secret from step (1) in the cloud by default. This is intended to be for convenience, so that if you lose or replace your phone, you won't have to reconfigure TOTP on all of your accounts.
But it also means that you are defeating the core purpose of 2FA: You are no longer proving that you both have something and know something. Instead, you are proving that you know something (your password), and have authenticated with someone else (Authy's cloud storage). This is a weaker security model because it makes Authy a point of failure for all of the other sites.
The Google Authenticator format is a standard format known as TOTP or HOTP (depending on whether it is a time based or HMAC based implementation). The QR code is just an encoded URI that contains everything needed for an application to set up the counter with the starting secret. For example:
otpauth://totp/Example:email@example.com?secret=JBSWY3DPEHPK3PXP&issuer=Example is what the QR code actually contains, which has the username, as well as the secret key used.