What is 2FA? What types are there? Diving into Cloud Sync risks that render your 2FA effectively useless.

In an era where personal data and digital assets hold immense value, relying solely on a "password" is akin to locking the front door with a simple padlock while leaving the windows wide open. No matter how long or complex a password is, it's always vulnerable to data breaches, infostealer malware, or phishing scams.

This is why 2FA (Two-Factor Authentication) has become a standard defense that everyone should enable, especially crypto enthusiasts and those who manage critical assets.

But do you know that each type of 2FA offers vastly different levels of security? And the updated Cloud Sync feature, while convenient, might actually become a "vulnerability" that hackers love. Today, we'll delve deep into 2FA.

What is 2FA (Two-Factor Authentication) and how does it work?

2FA (Two-Factor Authentication) is an identity verification process that requires users to present at least two pieces of evidence from three categories before being granted system access. The three main categories of cyber authentication are:

Typical logins using only a username + password are considered Single-Factor Authentication (1FA) because they rely solely on "something you know." If the password is compromised, an attacker can immediately access the account. However, with 2FA enabled, hackers would need to steal both the password and gain access to your physical device simultaneously to log in.

Understanding Each Type of 2FA: Principles, Pros, and Cons

There are several forms of 2FA today, each with distinct underlying mechanisms, security levels, advantages, and disadvantages. Let's explore them:

2FA Security Levels: From least to most secure

SMS / Email OTP ──► Software TOTP App ──► Hardware Key / Hardware Wallet (SIM Swap Risk) (Offline Operation) (100% Phishing-Proof)

1. SMS OTP and Email OTP (Sending codes via network/server)

2. Software Authenticator (TOTP) e.g., Google Authenticator, Authy, Aegis

3. Hardware Security Key & Hardware Wallet (FIDO2 / U2F)

You can watch a demonstration of its use at How to Use U2F on Hardware Wallets

4. Passkeys (New Generation FIDO Standard)

Comparison Table: Security, Convenience, and Risks

Why Security and Crypto Enthusiasts Should Disable Cloud Sync in Google Authenticator?

Following the news of a user whose BTC was transferred to an Exchange and then hacked due to the attacker accessing 2FA codes backed up to the Cloud, it became clear that users need to be more aware of the usage, risks, and understanding of the Cloud Sync feature. You can read the full article at 26 Million Baht Gone in 12 Hours After Transferring BTC to Exchange Due to One Mistake in Google Authenticator

In 2023, Google Authenticator added a Cloud Sync feature that automatically backs up codes to your Google Account. While convenient, this is a "double-edged sword" for the following reasons:

How to Check the Cloud Sync Status (Cloud Symbol)

Look at the top right corner of the app screen.

How to turn off Cloud Sync in Google Authenticator (Step-by-Step)

To make the app function 100% offline again, follow these steps:

Important Precautions and Measures to Prevent Code Loss

⚠️ Important Warning: The Google Authenticator app itself does not have a system for generating Backup Codes or a Master Key for recovery. Therefore, when you turn off Cloud Sync, all code data will be stored on that device only (Local Storage). If your phone is lost, dropped in water, or the app is accidentally deleted, the codes will be permanently lost immediately.

To prevent login issues, I recommend the following prevention methods, divided into 2 main parts:

Part 1: Backing up data via "destination websites" such as Exchange, social media, or Google (during initial setup)

• Jot down the "Setup Key" displayed on the webpage when 2FA is first enabled.

Source: When we enable 2FA on various websites, the webpage always shows a QR Code along with 16–32 alphanumeric characters (Setup Key / Secret Key) below it.

How to use: This code set is not for Google Authenticator but is the source code from the website. Write it down and keep it offline. If your phone is lost, you can enter this code into the app on a new device to generate the same 6-digit number set immediately.

• Download and keep the "Backup Codes / Recovery Codes" for each website.

Source: Websites like Binance, Google accounts, and Facebook often provide a set of Backup Codes (8–10 emergency codes) when we enable 2FA.

How to use: This set of codes is for direct entry on the webpage to log in in an emergency if your phone is lost, without relying on the Authenticator app.

Part 2: Backing up data via the Google Authenticator app's function (if not noted during initial setup)

• Transfer codes to a "backup phone" (Transfer Accounts).

This is the only way to back up data via the Google Authenticator app offline.

How to do it: Go to the Transfer accounts menu ➔ Select Export accounts ➔ Use a backup phone (e.g., an old phone at home) to scan the QR Code to immediately clone all 2FA codes to another device (you can also save the QR code image for backup).

Recommendation: "If you save it as an image, do not save it on a phone connected to the internet, as malware or cloud photo syncing systems could expose the QR Code image. It is recommended to store the image file on an unconnected phone, an offline flash drive, or print it out and store it in a safe place instead."

Alternative Option: Switch to apps that support built-in Encrypted Backup

Consider using open-source apps like 2FAS or Aegis⚬ if you want offline security but prefer a more convenient file backup system. Apps like 2FAS or Aegis have a function to create an Encrypted Backup File (a password-locked backup file) which allows you to safely store the file on a flash drive or computer.

🚨If you are going to use alternative apps, please study them carefully before use (I haven't tried them yet).

Summary

In the world of cybersecurity and cryptocurrency, one iron rule always holds true:

While Google's addition of Cloud Sync introduces potential risks, it doesn't mean Cloud Sync is inherently bad. It's designed to meet the needs of general users who often forget to back up data and lose codes. However, for those holding Bitcoin or high-value assets, this convenience might unknowingly bring back "centralized risk."

The safest approach remains Self-Custody & Self-Sovereignty, meaning controlling all your keys and security information yourself. If you already have a Hardware Wallet like Trezor or OneKey, I highly recommend enabling the FIDO2 / U2F feature to use your hardware wallet as a 2FA key for your most important accounts.

Frequently Asked Questions (FAQ)

Q1: If Cloud Sync is turned off, will the existing codes disappear?

No, they won't disappear. The existing codes will still be in the app and function normally; they will simply stop syncing to the cloud.

Q2: How is using a Hardware Wallet as 2FA better than a mobile app?

Because mobile apps are still vulnerable to users being tricked into entering 6-digit codes into fake websites. A Hardware Wallet, however, verifies the website's genuine domain. If it's a fake website, the device will strictly refuse to approve the transaction.

Q3: If Cloud Sync is off and I lose my phone, how can I access my account?

If you lose your phone, try to recover it by following these steps in order: