6 ms·

The key part of the blog post for me is this: "To mitigate the risk, Google recently launched two-factor authentication, a mechanism that requires you to input,

The key part of the blog post for me is this: "To mitigate the risk, Google recently launched two-factor authentication, a mechanism that requires you to input, on top of your password, a code generated by an application installed on your phone (iPhone, Android and maybe some others). I have activated this today." Anyone savvy enough to hang out on HN probably has a fair amount of valuable info in their Gmail account (domain registration info, passwords/access to shopping sites, etc.) and should activate two-factor authentication: http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html http://googleblog.blogspot.com/2011/02/advanced-sign-in-secu... Is it a little more hassle? A bit. But when someone else tries to log in from a new IP address in the Ivory Coast, or China, or wherever--they'll be prompted for a PIN and won't be able to log in. I activated two-factor authentication as soon as I could on my Gmail. I think everyone reading this comment should too.

briguy 15y ago
Perhaps a happy medium (between security and practicality) would be to have the option to only apply two-factor lock-down to "admin" type functions(i.e. to change cell phone, change secondary email, etc). This would allow a hacker to perhaps gain access to your email, however would not be able to completely hi-jack your account.
kelnos 15y ago
I would really like to activate two-factor auth for my GMail account, but I just don't trust my phone that much. The battery life is terrible, and I'd be afraid of losing access to my account if the phone breaks. Or what happens if I lose my phone? Or if someone steals it? Presumably there's a way to handle that case, but it still bothers me. On the plus side, I'm using a Google Apps account with a domain I control, so I could quickly switch to a backup mail provider, but it's of course a huge hassle, and I keep a lot of email in my GMail account. How do you deal with these kinds of issues? I really do want to use two-factor auth, but this stuff scares me about as much as the possibility of getting hacked.
- pipeline_tux 15y ago
  They provide a list of backup codes which you're meant to print and put in your wallet.
- zachanker 15y ago
  I actually had the same concerns, but after going through it they give you two ways to solve that: One is you can set a backup phone to use to get into the account, it can even be the same phone you have the authenticator on, so as long as you have the same number, you can access it. The backup phone option can also work with landlines through voice. They also allow you to print out a set of numbers you can use in case you lose the authenticator to get back into the account. [edit] Added voice backup note.
- sweis 15y ago
  Note that besides sending codes via SMS, Google's two-factor authentication also supports time-based one-time passcodes (TOTP) that can be generated from a mobile device. They also support a list of one-time printable codes. I kept a couple of copies of these in my wallet and at home. TOTP is an open standard and the mobile app is open source: http://tools.ietf.org/html/draft-mraihi-totp-timebased-03 http://tools.ietf.org/html/draft-mraihi-totp-timebased-03 http://code.google.com/p/google-authenticator/ http://code.google.com/p/google-authenticator/ (Disclaimer: I worked on this.)
  - jerrya 15y ago
    Looking at your links and the authenticator, is it the case that any third party web app can use the google authenticator "merely" by providing a key and account name? Is anyone doing that? I really like using the authenticator on my phone and would love to see other web applications support it. But I am curious, why isn't the authenticator itself password protected? Also, fyi, while I understand how to use application specific passwords, I have no good understanding of what they do, how they work, why they are safe or why I only have to enter them once. So they are confusing to me.
    - ElliotH 15y ago
justlearning 15y ago
Matt, What about someone who travels for most part of the year , in my case working out of asia for larger part of the year, but US being my home base. I could put my US cell phone (which is deactivated for most part of the year - like this year my cell will be deactivated for the whole year except for 2 months). I don't carry a permanent cell phone in Asia. How could the 2 step authentication help me - say I register with my US cell phone and I am out of the country for most part of the year?
- evan_ 15y ago
  You don't actually need to have cell service- there's an iPhone app (and presumably apps for other platforms) that lets you just generate new codes at will. You only need internet access to set it up initially, and you can do that with wifi. won't help you if you have no phone at all but you can generate one-time-use passwords at will, so you could just stock up I guess.
  - jackowayed 15y ago
    Actually, it looks like you can only have 10 active one-time passwords at once. On the page that lists the current ones and lets you regenerate them it says, "Be sure to throw away any previous versions. Only the latest set of backup verification codes will work."
- josh33 15y ago
  Google voice. It was a little "Inception"-like to set up but has worked flawlessly for me. As long as you take a mobile device with you that is authenticated and you have wifi access you're golden.
- Matt_Cutts 15y ago
  What evan_ said: you're using the phone as a pocket computer, not as a phone. You don't need phone service at all--the authentication program will run on your phone even if you don't have service or you're in a foreign country. Enough people have asked these (very reasonable) questions that maybe I should do a video about two-factor authentication.
rufibarbatus 15y ago
I'll take the opportunity to address some of the complaints I've seen in many comments through this page. Q: It's too much of a hassle to generate and write a PIN with every login I do! A: Not so. Google can 'remember' an authorized device for 30 days, so assuming you mostly use the same few devices all the time, the added hassle is very little compared to what you're construing it to be. Q: But I use many browsers on many devices! (AKA: "But I'm a webdesigner!") A: Google lets you create limited access, easily revokable, device-specific passwords. You may consider creating one of these for each device that you actually own, but then you're reducing your security so somewhere between 1 and 2-factors. When making that choice, keep in mind that on a worst case scenario, access to your email = access to all of your other online accounts. Q: I don't always have access to my mobile! A: No worries! When you set up 2-factor auth, Google makes you print a little piece of paper with 25 one-time disposable passwords for just such cases.
- shii 15y ago
  This is all true and correct, but I ran into a paradox when I had 2-factor auth turned on about a month ago. To save you all the long story, I was forced to use the backup disposable one-time passwords after I couldn't access my phone (signed out of the Authenticator app) and the backup number was a Google Voice number (stupid, I know) which required signing into the account... For some bizarre reason, none of the one-time use passwords were working at all. This was shocking and I realized in an emergency, this would not do. As soon as I got net access and into the backup email address, I turned off 2-factor auth. I'm sure for others who didn't have this edge case paradox issue brought on by stupid me and actually working backup one-time-use passwords, 2-factor is a great choice. And I wish it were for me as well, but it isn't right now.
  - barmstrong 15y ago
    I ran into this as well (Google Voice handles my texts and I couldn't read them without being logged in) but they provide an option to call as well (even though I didn't choose this as my preference) and Google Voice still rang my phone without me being logged in. So disaster was averted.
DanBlake 15y ago
Does gmail make you enter the 2factor auth code to /remove/ the feature as well? If it doesnt, it should. That way, even if a users computer gets owned with a trojan, the attacker couldnt change the gmail password or remove the 2 way auth tool without first having access to the phone.
- rufibarbatus 15y ago
  Just checked: Google DOESN'T require 2-factor auth to remove the feature, OR to change your password for that matter, if you're accessing the account settings from an authorized "don't ask again for 30 days" device (which is a trojan scenario).
  - puredemo 15y ago
    Which makes the system essentially moot. That seems like a substantial screw-up.
    - fragsworth 15y ago
      Maybe now that it has been pointed out, they will fix it.
    - enneff 15y ago
      Not really. When the guy had regained control of the account he could have signed out all other sessions, requiring all sessions to do 2-factor auth again. But if the person re-authenticating has a trojan on their computer (as may have been the case here) there is _nothing_ that can be done to prevent a third party from accessing their stuff.
      - mattmanser 15y ago
        The point was that the 2-factor would have already been turned off by the hacker at that point.
    - pmjordan 15y ago
      What if you lose your phone, though?
iki23 15y ago
Disagree strongly. Anyone savvy enough ... has probably no password in his/her gmail at all. Btw, domain reg info can be searched anyway. Also, if you got a strong and unique password, and do not login from untrusted devices that may be keylogged, you're quite safe already.
- Matt_Cutts 15y ago
  There's also the case of resetting your password for various other services. If someone can get access to your email account, it might not matter whether your actual webhost or domain registrar password is in your Gmail. The bad guy can force a new password or password-reset link to be sent to your email account, then intercept and use that link. I already use a strong/unique password for Gmail, and I do my best not to login from untrusted devices, but adding two-factor authentication reduces the potential attack surface that much more.
- mkjones 15y ago
  For online accounts (including email), you're much more likely to get phished than have someone brute-force your password. While keylogging malware is an issue, it's generally less prevalent than successful phishing attacks. There's also the threat of compromised password databases from unrelated web sites (see http://twitter.com/lulzsec http://twitter.com/lulzsec) being leaked, and if you share the same credentials, that can affect your email account as well. 2-factor auth gives you a considerable security advantage over "a strong and unique password" and not logging in from untrusted devices - I'd recommend you try it. (I work at facebook, and we offer a similar thing called "login approvals" - go to "security" under https://www.facebook.com/editaccount.php https://www.facebook.com/editaccount.php to turn it on).
1zq 15y ago
I would really, really love to activate two-factor authentication for my Gmail account, but Google requires me to have a phone number as a backup in case I lose my phone, and I don't live in one of the countries supported by Google for the backup phone numbers. I hope they expand the list of allowed countries for backup phone numbers soon, including support for the "less important" countries like mine. Or else allow activation of two-factor auth for people who agree to have only the list of printed one-time codes for entry and no backup phone number. Preferably the former.
- buro9 15y ago
  I used Skype-In for this. I live in the UK, but only own a mobile nowadays. So I used a local Skype number for things like this. Just never let that number expire. And now your Skype account needs a phonemenally complex password too.
- peteretep 15y ago
  I just turned it on on my account now, and I was able to skip the phone number step.
robinduckett 15y ago
All well and good, except 2 factor authentication does not work for google apps gmail accounts yet :(
- tomstuart 15y ago
  It does work, you just need to enable it for the domain: http://www.google.com/support/a/bin/answer.py?hl=en&answer=184711 http://www.google.com/support/a/bin/answer.py?hl=en&answ...
mike-cardwell 15y ago
Re: "Anyone savvy enough to hang out on HN probably has a fair amount of valuable info in their Gmail account" Even if somebody else does get access to my (non gmail) email account, all they're going to see is PGP encrypted emails: https://grepular.com/Automatically_Encrypting_all_Incoming_Email https://grepular.com/Automatically_Encrypting_all_Incoming_E... Of course, you have to be running your own mail server to implement this.
thetable 15y ago
It'd be nice if I could turn on two-factor auth in case i notice something fishy with my account. Basically, an emergency function that would sign out all sessions and raise the bar to get in once a user feels their account might be compromised.
rakkhi 15y ago
Exactly right. I have been saying for ages that services like Google, Twitter, Facebook should offer two factor. Now some finally do, it is a shame not to take advantage of it: http://www.rakkhis.com/2010/08/why-dont-facebook-twitter-and-google.html http://www.rakkhis.com/2010/08/why-dont-facebook-twitter-and... One of the main reasons I had some piece of mind when my account got hacked at MTGOX is that I had two factor on my Gmail: http://www.rakkhis.com/2011/06/i-was-hacked-mtgox-bitcoin-3-reasons-i.html http://www.rakkhis.com/2011/06/i-was-hacked-mtgox-bitcoin-3-... After this and another incident with a colleagues wife, I have made a note to set it up for my wife's account also tonight.
thetable 15y ago
I also noticed that, in Germany, currently, the codes take several minutes to arrive by SMS, which is a bit of a downer when trying to check email.
- mcherm 15y ago
  I'm in the USA. Here they arrive within seconds.
- tytso 15y ago
  Sure but you only need to authenticate a browser once every 30 days (assuming you allow the cookie to stick around). Assuming that you are only accessing your account from a few (preferably only one or two) trusted machines, it's really not that much of an imposition. Now, if you are checking your account from random PC's at internet cafes all over Europe, and making yourself vulnerable to keylogger attacks, you are pretty much screwed anyway. Even if you use two-factor authentication, and remember to clear out the cookie before you leave, an attacker can still steal the cookie and use it to take over your account (or at least steal all sorts of secrets from your gmail account). Two-factor authentication will definitely help, but it doesn't protect you against carelessness.
aristidb 15y ago
Is the last chance form still active when you use two-factor auth?
hippich 15y ago
I am using Thunderbird everywhere. Any one knows how it works with two-factor authorization?
dlikhten 15y ago
Their tool is quite nice on android, all accounts will be shown in one screen, very convenient. I have all my gmail accounts (even spam ones) registered to ensure people don't get spam from my accounts (which were compromised). I also changed the spam accounts' passwords to a generated 32 char password to be on the safe side (I only use them for once in a while access).
alexkon 15y ago
I'd be happy to use two-step verification if I could. I've been regularly attempting to enable it since it was announced. Gmail refuses to accept any of my phone numbers because the country where I live (Kazakhstan) is not supported. Tried three major mobile operators to no avail.
RossM 15y ago
Matt, I'd love to if I could. My issue is not from living in an unsupported country, but that Google Authenticator requires Android 2.01. However everywhere mentioned on the 2-step authentication site "Android 1.5" is blared at me. As a 1.5 user there is nothing that hacks me off more than getting my hopes up at an app my phone can actually use (a rare occasion these days) and then having it snatched away. I don't blame Google for supporting 2.x and up, but lies are unacceptable.
- kaerast 15y ago
  You don't need any specific software to be able to use two-factor authentication, it works nicely for me in any Linux distro I've tried and also Windows Mobile 6.1 (yes I know) The software might make it easier than receiving an sms which needs typing in, but all your mobile applications can still use the system - you just generate a new pasword for each application (as you would for a Google Talk client on your desktop). My laptop has encrypted hard disks so is set to remember Google passwords for 30 days. I can login from other devices using my pasword and an sms validation code which expires as soon as I log out.
phillijw 15y ago
If someone finds my cell phone, I'm screwed. They can login to my Gmail account (that is already set up on my phone) and change my password. Then they can also have access to this second form of authentication. My phone is the magic key to something I know and have. What else can I do to mitigate this if I lose my phone?
rubergly 15y ago
With two-factor authentication, what happens if your phone (with Gmail logged in) is stolen?

briguy 15y ago

Perhaps a happy medium (between security and practicality) would be to have the option to only apply two-factor lock-down to "admin" type functions(i.e. to change cell phone, change secondary email, etc). This would allow a hacker to perhaps gain access to your email, however would not be able to completely hi-jack your account.

kelnos 15y ago

I would really like to activate two-factor auth for my GMail account, but I just don't trust my phone that much. The battery life is terrible, and I'd be afraid of losing access to my account if the phone breaks. Or what happens if I lose my phone? Or if someone steals it? Presumably there's a way to handle that case, but it still bothers me. On the plus side, I'm using a Google Apps account with a domain I control, so I could quickly switch to a backup mail provider, but it's of course a huge hassle, and I keep a lot of email in my GMail account. How do you deal with these kinds of issues? I really do want to use two-factor auth, but this stuff scares me about as much as the possibility of getting hacked.

pipeline_tux 15y ago
They provide a list of backup codes which you're meant to print and put in your wallet.
zachanker 15y ago
I actually had the same concerns, but after going through it they give you two ways to solve that: One is you can set a backup phone to use to get into the account, it can even be the same phone you have the authenticator on, so as long as you have the same number, you can access it. The backup phone option can also work with landlines through voice. They also allow you to print out a set of numbers you can use in case you lose the authenticator to get back into the account. [edit] Added voice backup note.
sweis 15y ago
Note that besides sending codes via SMS, Google's two-factor authentication also supports time-based one-time passcodes (TOTP) that can be generated from a mobile device. They also support a list of one-time printable codes. I kept a couple of copies of these in my wallet and at home. TOTP is an open standard and the mobile app is open source: http://tools.ietf.org/html/draft-mraihi-totp-timebased-03 http://tools.ietf.org/html/draft-mraihi-totp-timebased-03 http://code.google.com/p/google-authenticator/ http://code.google.com/p/google-authenticator/ (Disclaimer: I worked on this.)
- jerrya 15y ago
  Looking at your links and the authenticator, is it the case that any third party web app can use the google authenticator "merely" by providing a key and account name? Is anyone doing that? I really like using the authenticator on my phone and would love to see other web applications support it. But I am curious, why isn't the authenticator itself password protected? Also, fyi, while I understand how to use application specific passwords, I have no good understanding of what they do, how they work, why they are safe or why I only have to enter them once. So they are confusing to me.
  - ElliotH 15y ago

justlearning 15y ago

Matt, What about someone who travels for most part of the year , in my case working out of asia for larger part of the year, but US being my home base. I could put my US cell phone (which is deactivated for most part of the year - like this year my cell will be deactivated for the whole year except for 2 months). I don't carry a permanent cell phone in Asia. How could the 2 step authentication help me - say I register with my US cell phone and I am out of the country for most part of the year?

evan_ 15y ago
You don't actually need to have cell service- there's an iPhone app (and presumably apps for other platforms) that lets you just generate new codes at will. You only need internet access to set it up initially, and you can do that with wifi. won't help you if you have no phone at all but you can generate one-time-use passwords at will, so you could just stock up I guess.
- jackowayed 15y ago
  Actually, it looks like you can only have 10 active one-time passwords at once. On the page that lists the current ones and lets you regenerate them it says, "Be sure to throw away any previous versions. Only the latest set of backup verification codes will work."
josh33 15y ago
Google voice. It was a little "Inception"-like to set up but has worked flawlessly for me. As long as you take a mobile device with you that is authenticated and you have wifi access you're golden.
Matt_Cutts 15y ago
What evan_ said: you're using the phone as a pocket computer, not as a phone. You don't need phone service at all--the authentication program will run on your phone even if you don't have service or you're in a foreign country. Enough people have asked these (very reasonable) questions that maybe I should do a video about two-factor authentication.

rufibarbatus 15y ago

I'll take the opportunity to address some of the complaints I've seen in many comments through this page. Q: It's too much of a hassle to generate and write a PIN with every login I do! A: Not so. Google can 'remember' an authorized device for 30 days, so assuming you mostly use the same few devices all the time, the added hassle is very little compared to what you're construing it to be. Q: But I use many browsers on many devices! (AKA: "But I'm a webdesigner!") A: Google lets you create limited access, easily revokable, device-specific passwords. You may consider creating one of these for each device that you actually own, but then you're reducing your security so somewhere between 1 and 2-factors. When making that choice, keep in mind that on a worst case scenario, access to your email = access to all of your other online accounts. Q: I don't always have access to my mobile! A: No worries! When you set up 2-factor auth, Google makes you print a little piece of paper with 25 one-time disposable passwords for just such cases.

shii 15y ago
This is all true and correct, but I ran into a paradox when I had 2-factor auth turned on about a month ago. To save you all the long story, I was forced to use the backup disposable one-time passwords after I couldn't access my phone (signed out of the Authenticator app) and the backup number was a Google Voice number (stupid, I know) which required signing into the account... For some bizarre reason, none of the one-time use passwords were working at all. This was shocking and I realized in an emergency, this would not do. As soon as I got net access and into the backup email address, I turned off 2-factor auth. I'm sure for others who didn't have this edge case paradox issue brought on by stupid me and actually working backup one-time-use passwords, 2-factor is a great choice. And I wish it were for me as well, but it isn't right now.
- barmstrong 15y ago
  I ran into this as well (Google Voice handles my texts and I couldn't read them without being logged in) but they provide an option to call as well (even though I didn't choose this as my preference) and Google Voice still rang my phone without me being logged in. So disaster was averted.

DanBlake 15y ago

Does gmail make you enter the 2factor auth code to /remove/ the feature as well? If it doesnt, it should. That way, even if a users computer gets owned with a trojan, the attacker couldnt change the gmail password or remove the 2 way auth tool without first having access to the phone.

rufibarbatus 15y ago
Just checked: Google DOESN'T require 2-factor auth to remove the feature, OR to change your password for that matter, if you're accessing the account settings from an authorized "don't ask again for 30 days" device (which is a trojan scenario).
- puredemo 15y ago
  Which makes the system essentially moot. That seems like a substantial screw-up.
  - fragsworth 15y ago
    Maybe now that it has been pointed out, they will fix it.
  - enneff 15y ago
    Not really. When the guy had regained control of the account he could have signed out all other sessions, requiring all sessions to do 2-factor auth again. But if the person re-authenticating has a trojan on their computer (as may have been the case here) there is _nothing_ that can be done to prevent a third party from accessing their stuff.
    - mattmanser 15y ago
      The point was that the 2-factor would have already been turned off by the hacker at that point.
  - pmjordan 15y ago
    What if you lose your phone, though?

iki23 15y ago

Disagree strongly. Anyone savvy enough ... has probably no password in his/her gmail at all. Btw, domain reg info can be searched anyway. Also, if you got a strong and unique password, and do not login from untrusted devices that may be keylogged, you're quite safe already.

Matt_Cutts 15y ago
There's also the case of resetting your password for various other services. If someone can get access to your email account, it might not matter whether your actual webhost or domain registrar password is in your Gmail. The bad guy can force a new password or password-reset link to be sent to your email account, then intercept and use that link. I already use a strong/unique password for Gmail, and I do my best not to login from untrusted devices, but adding two-factor authentication reduces the potential attack surface that much more.
mkjones 15y ago
For online accounts (including email), you're much more likely to get phished than have someone brute-force your password. While keylogging malware is an issue, it's generally less prevalent than successful phishing attacks. There's also the threat of compromised password databases from unrelated web sites (see http://twitter.com/lulzsec http://twitter.com/lulzsec) being leaked, and if you share the same credentials, that can affect your email account as well. 2-factor auth gives you a considerable security advantage over "a strong and unique password" and not logging in from untrusted devices - I'd recommend you try it. (I work at facebook, and we offer a similar thing called "login approvals" - go to "security" under https://www.facebook.com/editaccount.php https://www.facebook.com/editaccount.php to turn it on).

1zq 15y ago

I would really, really love to activate two-factor authentication for my Gmail account, but Google requires me to have a phone number as a backup in case I lose my phone, and I don't live in one of the countries supported by Google for the backup phone numbers. I hope they expand the list of allowed countries for backup phone numbers soon, including support for the "less important" countries like mine. Or else allow activation of two-factor auth for people who agree to have only the list of printed one-time codes for entry and no backup phone number. Preferably the former.

buro9 15y ago
I used Skype-In for this. I live in the UK, but only own a mobile nowadays. So I used a local Skype number for things like this. Just never let that number expire. And now your Skype account needs a phonemenally complex password too.
peteretep 15y ago
I just turned it on on my account now, and I was able to skip the phone number step.

robinduckett 15y ago

All well and good, except 2 factor authentication does not work for google apps gmail accounts yet :(

tomstuart 15y ago
It does work, you just need to enable it for the domain: http://www.google.com/support/a/bin/answer.py?hl=en&answer=184711 http://www.google.com/support/a/bin/answer.py?hl=en&answ...

mike-cardwell 15y ago

Re: "Anyone savvy enough to hang out on HN probably has a fair amount of valuable info in their Gmail account" Even if somebody else does get access to my (non gmail) email account, all they're going to see is PGP encrypted emails: https://grepular.com/Automatically_Encrypting_all_Incoming_Email https://grepular.com/Automatically_Encrypting_all_Incoming_E... Of course, you have to be running your own mail server to implement this.

thetable 15y ago

It'd be nice if I could turn on two-factor auth in case i notice something fishy with my account. Basically, an emergency function that would sign out all sessions and raise the bar to get in once a user feels their account might be compromised.

rakkhi 15y ago

Exactly right. I have been saying for ages that services like Google, Twitter, Facebook should offer two factor. Now some finally do, it is a shame not to take advantage of it: http://www.rakkhis.com/2010/08/why-dont-facebook-twitter-and-google.html http://www.rakkhis.com/2010/08/why-dont-facebook-twitter-and... One of the main reasons I had some piece of mind when my account got hacked at MTGOX is that I had two factor on my Gmail: http://www.rakkhis.com/2011/06/i-was-hacked-mtgox-bitcoin-3-reasons-i.html http://www.rakkhis.com/2011/06/i-was-hacked-mtgox-bitcoin-3-... After this and another incident with a colleagues wife, I have made a note to set it up for my wife's account also tonight.

thetable 15y ago

I also noticed that, in Germany, currently, the codes take several minutes to arrive by SMS, which is a bit of a downer when trying to check email.

mcherm 15y ago
I'm in the USA. Here they arrive within seconds.
tytso 15y ago
Sure but you only need to authenticate a browser once every 30 days (assuming you allow the cookie to stick around). Assuming that you are only accessing your account from a few (preferably only one or two) trusted machines, it's really not that much of an imposition. Now, if you are checking your account from random PC's at internet cafes all over Europe, and making yourself vulnerable to keylogger attacks, you are pretty much screwed anyway. Even if you use two-factor authentication, and remember to clear out the cookie before you leave, an attacker can still steal the cookie and use it to take over your account (or at least steal all sorts of secrets from your gmail account). Two-factor authentication will definitely help, but it doesn't protect you against carelessness.

aristidb 15y ago

Is the last chance form still active when you use two-factor auth?

hippich 15y ago

I am using Thunderbird everywhere. Any one knows how it works with two-factor authorization?

dlikhten 15y ago

Their tool is quite nice on android, all accounts will be shown in one screen, very convenient. I have all my gmail accounts (even spam ones) registered to ensure people don't get spam from my accounts (which were compromised). I also changed the spam accounts' passwords to a generated 32 char password to be on the safe side (I only use them for once in a while access).

alexkon 15y ago

I'd be happy to use two-step verification if I could. I've been regularly attempting to enable it since it was announced. Gmail refuses to accept any of my phone numbers because the country where I live (Kazakhstan) is not supported. Tried three major mobile operators to no avail.

RossM 15y ago

Matt, I'd love to if I could. My issue is not from living in an unsupported country, but that Google Authenticator requires Android 2.01. However everywhere mentioned on the 2-step authentication site "Android 1.5" is blared at me. As a 1.5 user there is nothing that hacks me off more than getting my hopes up at an app my phone can actually use (a rare occasion these days) and then having it snatched away. I don't blame Google for supporting 2.x and up, but lies are unacceptable.

kaerast 15y ago
You don't need any specific software to be able to use two-factor authentication, it works nicely for me in any Linux distro I've tried and also Windows Mobile 6.1 (yes I know) The software might make it easier than receiving an sms which needs typing in, but all your mobile applications can still use the system - you just generate a new pasword for each application (as you would for a Google Talk client on your desktop). My laptop has encrypted hard disks so is set to remember Google passwords for 30 days. I can login from other devices using my pasword and an sms validation code which expires as soon as I log out.

phillijw 15y ago

If someone finds my cell phone, I'm screwed. They can login to my Gmail account (that is already set up on my phone) and change my password. Then they can also have access to this second form of authentication. My phone is the magic key to something I know and have. What else can I do to mitigate this if I lose my phone?

rubergly 15y ago

With two-factor authentication, what happens if your phone (with Gmail logged in) is stolen?