[gdamjan]

Google Authenticator doesn't communicate with google at all - I don't understand where he pulled "but we were nervous about handing another key to identity over to a company whose primary business is search and advertising" out from?

Also, both the client and server software is open-source, so that can be confirmed too.

Also, a mobile phones time is synchronized by the GSM network, it doesn't drift much (if at all).