> I've seen proofs of concept that trivially lift the secrets from Google Authenticator.

Android specific?