I just opened the Google Authenticator app and it says: "Sign in to back up your codes to your Google Account".

How is that secure?

I mean, wouldn't doing that essentially defeat the purpose of two-factor authentication (2FA), since it'd let anyone who figures out the password to your Google Account log in to any account for which you've stored the password in Google Password Manager and the 2FA code in Google Authenticator?

Google's announcement Google Authenticator now supports Google Account synchronization doesn't seem to answer my question.


  • It's the same problem with any TOTP backup process. People had the same question when LastPass allowed it as an option a few years ago. Remember that you don't have to do it. It's just a convenience.
    – schroeder
    May 21 at 16:04


Browse other questions tagged .