I've found the biggest issue with most of the Google Authenticator implementation is that they store the seeds in plain text.