@whitequark@mastodon.social @filippo@abyssdomain.expert @wolf480pl@mstdn.io It wouldn't be any problem at all if Google had all your TOTP secrets. Surely they tested on this common configuration, not the niche configuration that people who do not trust Google use :neocat_flop: