Google Authenticator secure in Qubes?

General Discussion
1

I am closer to deciding to use a Yubikey with Qubes, GrapheneOS, etc, but the idea of using Google for an authenticator is puzzling, as I am not an encryption expert. I fully expect the Qubes Guide’s suggestion of using Google Authenticator with Qubes for Yubikey usage is justified. But for a novice in these matters, can someone please explain how having Google doing the default authenticating is secure by default? I usually treat anything Google like a security/privacy plague. Confused.

1 Like
2

It’s a program produced by Google - The key is stored locally, and
there is no network connection. If you sync with Google then I assume
they would be able to see what apps you linked to GA, but that would be
your choice in the first place. They would not have access to your
secrets.
It’s not open-source. If that bothers you then use Aegis Authenticator,
which is, and provides the same capability.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

2 Likes
3

Try oathtool.

1 Like
4

One small clarification that may help: “Google Authenticator” in this case is just a TOTP app. After you scan the QR code, the shared secret is stored locally and the app computes the 6-digit code from that secret plus the current time. The service you log in to does not ask Google to approve anything.

For a Qubes-style setup I would still prefer an open-source authenticator such as Aegis (or a hardware token where supported), mainly so you can control backups and avoid optional cloud sync. Also save the recovery codes somewhere separate from the VM/device that holds the authenticator.

1 Like
5

Thank you friends. The info is much appreciated. I do prefer open source. I think I would use Aegis Authenticator.

6

oathtool is FOSS and a standard package in Fedora and Debian.

7

Thanks qubist. I ordered a Yubikey 5C NFC this morning. I installed Aegis Authenticator on my GrapheneOS phone yesterday and I am looking forward to trying out the Yubikey on my desktop and laptop soon. I wish my bank allowed the use of a 2Fa key for login. Not yet, but hopefully soon.

8

Personally, I see no reason to use Google Authenticator in Qubes when KeePassXC already includes the same funcitonality.