0

I wonder about Google Authenticator privacy. I wonder if the app shares any information to the website owner about devices that we use to add a new key. I mean information like IP address and device type.

For example, I add a key from a crypto exchange. Can this exchange see the kind of device and IP of a device where I add their key?

2
  • 2
    AFAIK, Google Authenticator is open source and it only uses the information provided by the QR code to get a "sequence" required for generating timted one time passwords (TOTPs) May 27 at 16:51
  • 1
    There is no connection between the Authenticator and the site. You can even use Authenticator in airplane mode.
    – schroeder
    May 27 at 19:27

1 Answer 1

2

In most cases, the key can be used with any application that supports calculating a Time-Based One-Time Password (TOTP). Google Authenticator just so happens to be a widely adopted candidate fitting that criteria.

To summarize, a TOTP is calculated locally by generating a pseudorandom number using a defined algorithm at a given point in time, using a shared secret known to both your device and the authenticating server to seed a pseudorandom number generator. Every required bit to make this happen is encoded within the QR code scanned during the enrollment process.

The authenticating server will calculate the TOTP in a similar fashion and compare against the user-provided TOTP. The underlying premise for all of this to work is that the system time for both parties is synchronized within an acceptable step window.

Seeing as no direct communication should ever happen, I would conclude it's unlikely the crypto exchange would have visibility to that metadata by means of enrollment.

If you're concerned with Google Authenticator phoning home, I would recommend you use a vetted open-source alternative instead. Part of a properly implemented enrollment process should include a test of the password calculation process, so it should be trivial to validate whether a given authenticator fits your use case. Alternatively, you could take steps to limit or monitor its network activity.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.