Quote from: NeuroticFish on November 10, 2020, 09:45:31 AM

Quote from: 8m_zk on November 09, 2020, 12:20:24 PM

Please help me with my question concerning 2FA. Do you think it's essential security measure, does it work very well? Then Google will have my security code, right?
I'm just afraid to do smth wrong like lose password or QR-code or smth and lose my crypto.

No, Google should not have your security code.

This is not correct. Authenticator codes are a function of the secret key and the current time, so the only way for Google to make the same code as the one you typed in Authenticator for verification purposes is if they also have the secret key. And they do, for precisely this reason. It's the only way to verify if the code you typed is correct.

That being said, other people should not be able to know the secret key, unless those people saw your screen when the secret key was first shown (because you're supposed to have only one chance to see the secret key to put it in Authenticator - when the login is first created, but then again, a site could violate this important assumption, which would allow any hacker already logged in to the account to get the secret key)

If the site in question is not Google, then of course they don't know your key - the TOTP process doesn't send anything to Google's servers.