Recently, Google Authenticator launched the "Cloud Sync" feature, which allows verification codes to be synchronized across logged-in devices. However, this feature does not use end-to-end encryption and poses a security risk.
Bitunix recommends that all users check and disable this feature immediately. The following are general instructions for iOS/Android.
（For iOS/Android users):
Not logged in: When not logged in, the Google Authenticator cloud sync feature is turned off by default, and no further action is required.
Logged-in account:
Step 1: Open the Google Authenticator app and click the profile icon in the upper-right corner.
Step 2: From the menu, select “Use without an account” and proceed with Authenticator.
Step 3: Click “Continue” to disable the cloud sync feature of Google Authenticator.
Step 4: The [Cloud Sync] feature has been successfully turned off.
Impact and precautions after closure
- Change in data storage location: After cloud sync is turned off, your 2FA tokens are only stored on the current device. If the device is lost, damaged, or the app is uninstalled and no other backup has been made, you will not be able to recover the verification codes by logging in to your Google account on a new device. Therefore, it is recommended to properly store your device and consider using other backup methods (such as recording the key of important accounts).
- Follow-up operation precautions: If you later want to use Google Authenticator on another device, you will need to re-add the account and either scan the corresponding QR code or enter the key to generate a new verification code. During this process, be sure to ensure the security of your operating environment to avoid key or QR code leakage.