The vulnerability Silent Sector identified is related to the secret key embedded in QR codes used for 2FA enrollment. When users scan a QR code to link their authentication apps, such as Google ...

Using Setup Keys Once you've enabled 2FA on the account or service in question, you'll be asked to either enter a setup key on your device or scan a QR code using your device's camera.

A (blurred out) QR code generated by the google-authenticator app. Scan the QR code with your 2FA app (such as Authy) or type the secret key if the code is too large for the app to scan and hit enter.

First, turn on two-factor authentication for the account. You'll get a QR code or setup key. Next, open the Google Authenticator app and tap the plus sign. Record the 2FA code/key. Whenever you're ...