Google has just updated its 2FA Authenticator app and added a much-needed feature: the ability to sync secrets across devices.
TL;DR: Don't turn it on.
The new update allows users to sign in with their Google Account and sync 2FA secrets across their iOS and Android devices.
We analyzed the network traffic when the app syncs the secrets, and it turns out the traffic is not end-to-end encrypted. As shown in the screenshots, this means that Google can see the secrets, likely even while they’re stored on their servers. There is no option to add a passphrase to protect the secrets, to make them accessible only by the user.
Why is this bad?
Every 2FA QR code contains a secret, or a seed, that’s used to generate the one-time codes. If someone else knows the secret, they can generate the same one-time codes and defeat 2FA protections. So, if there’s ever a data breach or if someone obtains access to your Google Account, all of your 2FA secrets would be compromised.
Also, 2FA QR codes typically contain other information such as account name and the name of the service (e.g. Twitter, Amazon, etc). Since Google can see all this data, it knows which online services you use, and could potentially use this information for personalized ads.
Surprisingly, Google data exports do not include the 2FA secrets that are stored in the user's Google Account. We downloaded all the data associated with the Google account we used, and we found no traces of the 2FA secrets.
The bottom line: although syncing 2FA secrets across devices is convenient, it comes at the expense of your privacy. Fortunately, Google Authenticator still offers the option to use the app without signing in or syncing secrets. We recommend using the app without the new syncing feature for now.
#Privacy #Cybersecurity #InfoSec #2FA #Google #Security
Can a large language model be used as a "cognitive model" - meaning, a scientific artifact that helps us reason about the emergence of complex behavior and abstract representations in the human mind? My answer is YES.
Why and under what conditions? 🧵
TheBloke/alpaca-lora-65B-GGML
-4bit
-2bit
Already with positive community reception:
"This is the best model I have tried locally this far. Thank you!"
https://t.co/wgXq2HAUoA
A nice survey of prompting techniques that turn GPT-4 into an agent loop.
Keep in mind that this tech still needs *lots* of iterations and novel algorithmic insights to be production-ready.
The end is not near. We are just scratching the surface.
https://t.co/mJyST0VEqT
Here is how I organize big research projects with a single tool.
Obsidian is like Google to my brain.
A step-by-step guide with explanations and examples:
👇
InstructRL for Human-AI Coordination
-Humans specify what strategies they want via natural language
-LLMs generate prior policy conditioned on the instruction
-Prior regularizes RL objective
-RL agent converges to equilibria aligned w/ human preferences
https://t.co/yYAphntDuS
If you're looking to delve into the evolution of NLP, specifically from transformers to LLMs today, this list of papers by @rasbt is a must-read.
https://t.co/gvor2CEZGE
I read the code for BabyAGI by @yoheinakajima so you don’t have to. This thread is an illustrated summary. (https://t.co/Pmlh1iyDNf)
There are four main characters:
- User (you)
- Agent: Execution (prompt)
- Agent: TaskCreation (prompt)
- Agent: Prioritization (prompt)
(1/n)