Google will always take the correct action to protect websites that are displayed by their search engines and are monitored and managed by their Servers. Google would never carry out any action that would go against their security policies.
1) I like Google, I think they’re trustworthy, but that’s not the point. If you’re serious about security, you don’t rely on trust. You minimize your vulnerabilities as much as possible, because you can never foresee how circumstances will change in the future, or how something could be exploited in ways you never thought of.
2) Even if you trust Google, do you trust the NSA? Because they’ll intercept communication between your host’s network and Google, and between Google’s data centers. Do you assume that they’re not capable of decrypting the data? Even if you do trust the NSA, do you trust that Wikileaks won’t get ahold of some of the data the NSA captured and release it publicly?
The bottom line is that using a remote API unnecessarily exposes the application to additional vulnerabilities that wouldn’t be present if it the QR code were generated locally instead.
Sebastian, I’d encourage you to see if you can write an add-on plugin for Google Authenticator that will disable the default QR generation method and replace it with that library. That approach worked well for me when I wanted to move the token prompt to a separate screen.
Maybe Henrik would be open to adding any necessary hooks to the plugin to facilitate your add-on. I think that would be a good compromise, since it would allow people to have the option avoiding the remote API call, but wouldn’t have to change the core plugin to do it.
