Google is a piece of shit, there's no doubt about that.

However, they're in a hard place here. They could be super-strict. One device, one password, MFA enabled, you can't share any of it and they can't see it. Or, the ability to sync and share certain items.

First one, you get stupid consumers that forget their password or don't take care of their expensive devices and they lose access to an account. Other is more consumer friendly, but the minute more than one person knows the secret there are going to bad actors tearing the thing apart to see how to exploit it.

In the middle, you have idiots like the person the story who works for a security company and failed OpSec 101.

Google recently released the Google Authenticator synchronization feature that syncs MFA codes to the cloud.

What a lame feature. The point of Authenticator is that you must have the physical device it's on. It's not supposed to be convenient.

Sweet, Google has moved beyond being incompetent enough to handle search results that aren't AI or pajeet SEO blog spam, but they're actually a security liability now.