11 ms·
Google Rolls Out Two-Factor Authentication For Everyone.
- acconrad 16y agoSome people are going to find this to be awesome (mostly the paranoid), while others will just be frustrated they now have to remember two passwords.
- stanleydrew 16y agoThose who would be frustrated just wont enable it. But it's not as inconvenient as you make it out to be; you still only have to remember one password, since the second is dynamically generated.
- bryanlarsen 16y agoAnd the second is only entered once per method of accessing your google account.
- bryanlarsen 16y agoIt's optional -- you don't have to enable it if you don't want it. This is a good answer to those who were recently moaning that "anybody who hacks my google account can now push apps to my phone with out a confirmation!" Quite frankly, I worry quite a bit less about hackers pushing malware to my phone than I do to people hacking into my e-mail. I'm going to let this shake out for a while and then enable it.
- haberman 16y agoThere is no "remembering" involved -- you get the second password from an app on your phone. And you only have to enter this second password once per month (per computer that you access your account from).
- stanleydrew 16y agoI assume you enter the second password once per browser session, not once "per computer." For people who use incognito mode heavily or clear their cookies on shutdown this will mean using the second password every time, but something tells me those people are of the type who want to be using two-factor auth all the time anyway.
- bdonlan 16y agoWhere exactly is the option to enable this? I can't seem to find it in my google accounts page - is it being rolled out gradually?
- daeken 16y agoAccording to the official blog post ( http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html http://googleblog.blogspot.com/2011/02/advanced-sign-in-secu... ), this will be rolled out over the next two days.
- beoba 16y agoLooks like it's currently broken. The article says "You can activate it by hitting the ‘two-step verification’ link on this page[1].", but it's definitely not there. However, if you go into "Authorizing applications & sites" it has a warning box which says "An application-specific password can only be created when you are signed up for 2-step verification.", with no mention of where or how that can be done. It'd be nice if this feature allowed me to have secondary passwords for eg google talk. I don't much care for having to hand out my full credentials just to use things like bitlbee/meebo. [1] https://www.google.com/accounts/ManageAccount https://www.google.com/accounts/ManageAccount
- DrewHintz 16y agoIt's being rolled out over the next few days. Hopefully it will be enabled for you soon. http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html http://googleblog.blogspot.com/2011/02/advanced-sign-in-secu...
- Groxx 16y agoLooks like this was addressed by an update: >Update: Google is actually rolling this out over the next few days, so you may not see it quite yet.
- drivebyacct2 16y agoWhy does the Android app "Google Authenticator" require ZX Barcode Scanner when Google Goggles has a faster barcode scanner built in? Sometimes I just don't understand Google's inability to be consistent. For example, why do Goggles and the Gallery hide the notification bar. Attention to details Google...
- DrewHintz 16y agoThanks for the feedback. I'll see if we can enable it to use Google Googles as well.
- yellowbkpk 16y agoWhat do you mean "built-in"? I had to download a barcode scanner app from the Market since Android didn't ship with one. Do you mean it's built into something like the Camera app?
- jokermatt999 16y agoThe "Barcode Scanner" app is so ubiquitous it seems built in, but I don't think it actually ships. I seem to recall an actual Google Video demoing it as well, but I'm not quite sure.
- drivebyacct2 16y ago"Google Goggles has a faster barcode scanner built in" Not sure how to make that sentence more straight forward.
- yellowbkpk 16y agoGoogle Goggles is not "built-in", so it's plenty unclear.
- denizkaman 16y agoh ldu lif ilb jgt l7g
- drivebyacct2 16y agoAlso, apparently HN is having a reading problem today. >Over the next few days, you'll see a new link on your Account Settings page that looks like this: Yes, it's not available yet. And the second password page is very clear about what it's used for. Reading people, it helps a lot.
- buro9 16y agoAs usual they will roll out incrementally. They always do, but yet others always will jump up and down because it's not instant available for them.
- brown9-2 16y agoI'm not sure what you are addressing, no one is debating the merit of this. drivebyacct is referring to other posts in this thread questioning "Where is this option? I don't see it in my account!"
- Groxx 16y agoNot necessarily, they may have been reading an older version. Note: >But today, Google is making things much, much better for those who want it. Update: Google is actually rolling this out over the next few days, so you may not see it quite yet. And I don't know where to find this "second password page" you speak of. There's no link in my Google account, if that's what you are referring to. How am I to read it?
- imajes 16y agoIt'd be nice if i could use my own 2 factor, e.g. if i had a securid or something similar to do. I'm not all that excited to have to open my phone to get to an app to get my passcode out.
- DrewHintz 16y agoThe algorithm is RFC4226+TOTP: http://code.google.com/p/google-authenticator/ http://code.google.com/p/google-authenticator/ If you have a TOTP device that lets you set the key, then you can use that instead of your phone.
- VMG 16y agodo they still have the dreadful "security question"?
- kprobst 16y agoI've been doing this with PayPal and their free security token fob for three years and I couldn't be happier. This kind of thing should be the standard for any 'critical' accounts like banking and email. If you don't have a token you probably have a cell phone anyway.
- jodrellblank 16y agoIs that the PayPal fob shown here for $5: https://cms.paypal.com/cgi-bin/marketingweb?cmd=_render-content&content_ID=security/hardware_software_protection https://cms.paypal.com/cgi-bin/marketingweb?cmd=_render-cont... Or is there a free one available by other means?
- alanfalcon 16y agoMy largest worry is that coupled with Google's infamous lack of customer support, it might be very difficult to get into your account should something happen to your phone. I know it's something of a pain to have an authenticator removed in World of Warcraft if you lose it or it breaks, but at least there you have a phone number you can call that will let you eventually talk to a human being. Does anyone know what Google's plan is for lost/broken authenticators?
- cwb71 16y agoRead the documentation. The plan is: 1) When you activate the service, you get a list of ten OTP codes that you should print and store in a safe place. 2) You can set up a backup phone in case your primary is lost/stolen/fails. There is a voice option, so this number does not have to accept SMS.
- alanfalcon 16y agoThanks. I also found this: If you don't have the OTP codes and didn't set up a backup, and can't access any computer/device where you have access from logging in during the past 30 days: 3) You'll need to fill out an account recovery form to verify ownership of the account. Take time to answer each question to the best of your ability. The form was designed to ensure that no one can gain access to your account except you. Since Google doesn't collect a lot of information about you when you sign up for an account, we will ask you questions like when you created your account, what Google services you use, and who you email frequently (if you use Gmail) to make certain you are authorized to access your account.
- drivebyacct2 16y agoI have no idea when I made my Gmail account. It was years ago when "gmailswap" was the place to be. I know there's other options, but still.
- khafra 16y agoSame here; that's why I forwarded the oldest email in my account to another address, took note of the date on it, and saved it to my hard drive; headers intact.
- tomjen3 16y agoDoes this mean that I can't use the build in email on my (Google) Android to use my account? Because if not, this is pretty awesome.
- DrewHintz 16y agoYou can still use applications, such as email clients built-in to Android, to access your account. Typically you'll need to use an application-specific password as described here: http://www.google.com/support/accounts/bin/static.py?page=guide.cs&guide=1056283&topic=1056286 http://www.google.com/support/accounts/bin/static.py?page=gu... (Disclaimer: I worked on the Android app.)
- travisp 16y agoIt's not clear from that page, is there any limitation on the powers of the application-specific password? While it's less likely, if one of those passwords gets stolen can your entire account still be accessed including your account settings?
- antrix 16y agoOn Android, the device specific password is used for your phone's Google Account. Which means once you set it up, all Google apps like Gmail, GReader, Talk, Market, etc. will work as usual. If you suspect your device password is compromised, you can revoke it from your Google account settings in a regular browser.
- stcredzero 16y agoGoogle should publish a good API for this, and allow everyone to use it. I'd love to have opt-in TFA for all of my sites.
- EGreg 16y agoGreat going, google! Banks have been using those RSA dongle thingies for a long time. Now with mobile phones that isolate one app from another, who needs em! And you get OTP codes just in case. Nice. Now I wish my bank would do this.
- roc 16y agoHow does two-factor cut down on phishing again? Instead of a fake login page with 2 boxes, a phisher could just create a fake login page with 3 boxes and pass the keycode along with everything else. The only increased difficulty in phishing, is if the user notes they're seeing a keycode prompt, decides that they probably shouldn't have to enter that again and doesn't just key it in anyway. When we're talking about people who fall for phishing scams, does that sound all that likely? I mean, these people have a history of ignoring red flags and being blissfully ignorant to what should even raise a red flag. Now, what two-factor will help mitigate, is casual sniffing, keylogging, shoulder-surfing and saved password cracking.
- albertsun 16y agoThe keycode is unique to each log-in attempt.
- joshhepworth 16y agoWhile I have used this kind of authentication before, I'm not intimately familiar with it. From the way Kincaid described it in the article, it seems the key is unique only to a general moment in time, not each log-in attempt (though it wouldn't be hard to imagine it being invalidated as soon as it was used). If it is only a moment in time, I assume the phishing script could simply log in at the same time and hope the user has the "once per computer" setting enabled. Though this seems like too big of something to miss. Can anyone offer some clarification?
- roc 16y agoIs this a stand-alone fob-style system, where the keycode is unique to a point in time with no knowledge of the connection? Or is this some sort of second-channel verification, where the requesting connection is hashed into the one-time-pad?
- groby_b 16y agoBoth Paypal and WoW use standalone FOB, keycode unique to a point in time. Of course, paypal's "I lost my authenticator, log me in anyways" button is kind of defeating the purpose...
- hammock 16y agoIs anyone else concerned that Google is now basically forcing this on us, so it can build a database of not only our online history, contact info, etc... but now linking it to a real-life phone number? Think of what the NSA could do with data like that. Not to mention the whole MAC address collection they did with the Streetview cams as well (allowing them to tie a MAC address and/or IP with a GPS coordinate) I'm prepared for the down-votes on this one, but it's something to think about.
- Matt_Cutts 16y agoIf you don't want this feature, don't opt in--it's not required. I love that I don't need to worry as much about people trying to hack my Gmail account.
- hammock 16y agoSure but they're going to ask me about it every time I log in until kingdom come. And there are a lot of users who will do it blindly unaware of the consequences that come with linking your online persona to a phone number.
- travisp 16y agoI use Google Voice, so I imagine Google already knows all my numbers.
- drdaeman 16y agoAuthentication code is computed. A phone number is for those who cannot compute it themselves (so Google will perform the computation and give you the result over the phone).
- marshray 16y ago[I think it's really sad that a well-thought-out and well-intentioned non-trolling comment such as yours is downvoted. Especially that you could predict it so easily in advance.] I went to set up a gmail account the other day for testing out an online game for one of my kids. It wanted to "verify" me with a real-life phone call. So I just went over to hotmail and set up an account there instead. Sort of a blast from the past, but it was relatively painless.
- dnsworks 16y agoUgh, this is why I don't use facebook. I'm tired of big websites adding these extra "security features" to make it that much easier to track me while adding friction to your site experience. I'll be impressed if this actually works. Google can't even figure out how to authenticate half of their services off of your google apps domain account.
- motters 16y agoThis wouldn't work for me. I own a mobile phone, but I only use it for specific purposes and don't carry it around with me routinely. Mobile phones are not something that I care about to any significant extent.
- marshray 16y agoMe either, and I work on (a different) mobile phone authentication product! I did finally give in the other day and got a Nexus S. I've even talked on it a few times.
- ekanes 16y agoTried it, and now regretting it. I log in with 6 devices, and the idea that I'll have to go through re-authenticating them each month isn't fun. Each re-auth requires a fresh code from the app. I access google apps via Safari because Apple's mail app has no real search function. Since the codes expire in 60 seconds, I'm on a timer for writing it down, launching safari, refreshing to get the "login failed" screen, entering in my username and password without errors and then entering in my code. Totally doable, but irritating. Imagine you're in a hurry, and checking your email as you walk down the street. You open your client and instead of your email you get an error. The error doesn't tell you what's wrong, it just says there's a problem with your login. Hopefully you remember that 30 days ago you reset your token, and that's the problem. Now you can pause everything else, and setup your email. Don't have a pen to write down your code while you switch apps? How's your memory? I totally get that good security involves expiration dates, but I want things that "just work", not that "usually work". In principle it's a great idea, and if I could choose how often it expires I'd be a happy camper. </rant>
- DrewHintz 16y ago> Don't have a pen to write down your code In the Android app you can long-press the generated code to open a context menu to copy the code into the clipboard. I'm not sure if the iPhone can support something similar, but I'll ask the developer.
- antrix 16y agoOn the other hand, the Android GMail app is so good that there's no reason to use the web version. So just setup your phone with a device specific password and you are good to go!
- TimMontague 16y agoI'm able to start the login process in Safari on my iPhone and when I get to the prompt for the one-time code, switch to the Authenticator app, double click on the number to get the copy icon, then switch back to Safari and paste it.
- dublinclontarf 16y agoI can see why everyone is so happy, but something to note is the erosion of privacy. You you wont be able to use a gmail account without a phone. In countries(China) where you need your id to get even a prepay phone there will no longer be any anominity. Top this off with the fact that google doesn't say how often or if at all whether they give information to the chinese government because its against the law in China for them to say so. State secrecy and all. I personally think this should be optional and not mandatory. Otherwise I will stop using all of googles account services.
- ZoFreX 16y agoIt is optional! Personally I'd rather the second factor was a little more dependable, the 2nd factor for my LastPass account is a lookup grid. That piece of paper in my wallet is unlikely to run out of battery power or otherwise malfunction, and doesn't have the potential privacy issues you highlighted.
- kalvin 16y agoI've been using this on my Gmail account for a couple months in beta. (It was also available for Google Apps Premier/Education/Gov). Surprisingly it hasn't been a hassle at all-- anyone who uses their Gmail for "everything" should start using it. It takes 15 minutes to set up (you have to / should generate tokens for each of your mobile and desktop apps, e.g. Apple Mail, iCal, Adium, Meebo, Voice, Latitude) but after that, it's super easy as long as you always have your smartphone+authenticator with you. Spending 30 seconds extra/month/device to enter a 6-digit keycode isn't a huge price to pay for better security (at least for me-- I have one phone and one computer.)
- Kilimanjaro 16y agoI haven't tried it, but I don't like being bothered with extra stuff, I can't even imagine my mother dealing with this stuff. If we can't simplify our users lives, we have failed. Is security hard? Hell it is. But we can do better and we MUST do better, for the love of science.
- timwiseman 16y agoFirst, this is optional, so no one who doesn't want it has to worry about it. If you aren't worried about your google account being hacked, then don't enable it. Second, can you really think of a better option? Two factor authentication like this has been used by high security institutions for years and it works quite well. Personally, it has bothered me for years that my bank does not use 2-factor identification to log in... I am certain there is plenty of room for improvement, but it is certainly non-trivial.
- synnik 16y agoI have no phone. Not at all, not a cell, not a work phone, not a home phone. I suppose this is what I get for being both a hacker and a luddite. But this definitely will NOT work for me.
- JshWright 16y agoSo... don't use it?
- jasonkester 16y agoThis would seem to be a good thing to offer if you were a company that had any form of customer service. If I were to lose the little thingy that lets me into my bank account, I can walk into a bank, verify myself, and get another one sent out. Simple and effective. Can you imagine the process that you'll have to go through to get back into your GMail account after losing your phone? Considering that you can be an AdWords customer giving them ten thousand dollars a year and still receive nothing but computer-generated form letters in response to questions about your account, I think I'll pass on this one.
- chalimacos 16y agoThis is very good for activists.