22 ms·

Google introduces mandatory 2-Step Verification for Google Accounts

160 points by vezycash 5y ago

smcameron 5y ago
Great now if I lose my phone, or if it breaks, I'm in grave danger of losing my google account.
- Jxl180 5y ago
  That’s the beauty of 2 factor. If you lose your phone and a bad actor picks it up, they now have one of your factors (what you have) but not “what you know.” Your example is a great reason for 2FA to exist.
  - ergot_vacation 5y ago
    Consider 3 situations: 1. Google does not require 2FA. 2. Google DOES require 2FA on an account, but only requires the second auth if "suspicious activity" crops up. 3. Google requires 2 auths on each and every login. On 1, if a bad actor picks up your phone and tries to log in, they will fail if you haven't saved your login, or succeed if you've been lazy and saved it. In the latter case, that's really on you (and you might still be able to get your account back even then, if they didn't fully and quickly reset password and other details!) On 2 however, they will try to log in, fail, and trigger a lock-down that can only be lifted with both auths. One of which you don't have anymore. Congrads, you've just lost your account! 3 is the same as 2, just for different reasons. As soon as that phone disappears, you don't have the second auth, and you're screwed. And don't even bother with anything that isn't a phone. We both know nobody in the general public is using anything other than text for this. And some older folks don't even have that! Add on to this that SMS can be easily hacked, and it's pretty clear this whole system is a joke.
    - Jxl180 5y ago
      You just put in your back up codes to restore access. That’s why the backup codes/words exist. If I lose my crypto wallet or it gets stolen, I go to my bank, get the words from my safe deposit box, and use those words to seed my new wallet. Doesn’t have to be a bank — a home safe or filing cabinet will work, but when my phone broke I had zero problem restoring my 2FA on my new phone using the backup words.
- darkwizard42 5y ago
  You can use your backup codes. In fact your point is a good reason to HAVE MFA given that in the past, if you lost your phone all your data would be compromised.
  - xboxnolifes 5y ago
    > In fact your point is a good reason to HAVE MFA given that in the past, if you lost your phone all your data would be compromised. In the past, wouldn't all your data still be behind a password? Am I missing something?
officeplant 5y ago
Been using google prompt 2-step since they first started offering it a while back. Gotta say its the most painless 2-factor authentication of any account I actively use. Although its a bit clunky to have to open gmail on an iphone to get the prompt when I'm not dailying an android phone for testing reasons.
0des 5y ago
I'd like to make a humble appeal to you, dear Reader, that you consider if you are able to exist without Google services and the tradeoffs they entail.
- shadowgovt 5y ago
  I'm having the opposite reaction. 2FA is a strict improvement and everyone should be using it. I applaud Google for mandating a best practice. It's far preferable to the alternative of having your account compromised because your password is guessed or stolen.
  - 0des 5y ago
    This is not my opinion against 2FA, it is me using this moment of friction to ask a question most people are often too happy to ignore when things are going fine. Are you able to live without your captors or not?
    - shadowgovt 5y ago
      I also don't see them as my "captors." I'm able to live without electricity but I'm not about to call the power company and have them cut my feed. There are folks who consider it some kind of incarceration to be beholden to the electricity provided by a power company; I respect them but I don't share their philosophy.
      - xdennis 5y ago
        Depending on the situation it can be easy to cut yourself from the power company, but no one can create his own phone carrier regardless of the situation.
        shadowgovt 5y ago
        > Depending on the situation it can be easy to cut yourself from the power company Unless the situation is "There is another power company right next door," I'll have to disagree. If the claim is one can self-generate power, the analogy holds but not in the way, I think, the author means. Self-generation off-grid is a pain... Buy or build and maintain your own generators, your own storage, deal with impedance, deal with the risks of operating on high voltage, equipment breakdowns are yours and yours alone to repair, etc. Similarly, I can self-host my own email, video, web servers, and possibly even build my own voice-activated assistants tuned perfectly to my specifications, sharing my data with nobody... But that's a lot of work when Google has provided all of that for me.
lemoncookiechip 5y ago
They really want our phone numbers. I have a few throwaway accounts for subbing to sites that require log-in that I don't want connected to a phone. IF they brick my accounts, I'm just going to stop using Gmail and turn to Proton or something else.
- cornstalks 5y ago
  Aren't there non-phone-number 2FA options?
  - danlugo92 5y ago
    Yes, OTP.
    - Freak_NL 5y ago
      Possible, and a real burden to set up: https://webapps.stackexchange.com/questions/127464/enabling-2fa-on-a-google-account-how-to-get-totp-secret https://webapps.stackexchange.com/questions/127464/enabling-... Perhaps this changed now, but I had to set up a different 2FA method first (I used a U2F security key), then add OTP, and then it was possible to remove the U2F method. After logging in with OTP once (I just keep the private key on my laptop in pass) you never seem to get asked to provide it again, but 2FA is nominally enabled.
  - tyingq 5y ago
    "Then, a code will be sent to your phone via text, voice call, or our mobile app. Or, if you have a Security Key, you can insert it into your computer’s USB port." https://www.google.com/intl/en/landing/2step/#tab=how-it-works https://www.google.com/intl/en/landing/2step/#tab=how-it-wor... I'm not sure why TOTP isn't an option. Google Authenticator still seems to be a supported app.
    - sumeno 5y ago
      It is. Look under Features > The Google Authenticator app for Android, iPhone, or BlackBerry can generate verification codes. It even works when your device has no phone or data connectivity. You can also use third party apps, I use Authy
avodonosov 5y ago
How annoying, in particular that service providers expect me to have a mobile phone and that the phone represents me (can not be lost, etc)
- derekp7 5y ago
  You don't need a mobile phone for TOTP -- you can do it from a shell script and openssl. Many security keys support storing TOTP built in, and Google also supports the various security key protocols (FIDO2 I think is the current version?)
  - deleted 5y ago
    [deleted]
  - dane-pgp 5y ago
    I should point out that FIDO2 allows sites to require that visitors use a device from a specific whitelist of devices.[0] Google has already tightened the requirements by mandating 2FA, so don't be surprised when they start blocking "insecure" factors like shell scripts. It probably wouldn't go down well if Google required an Android device to provide the second factor, but I could definitely see them requiring a device which does biometric verification of the user. That's a pretty good way of connecting online activity to a specific human (assuming the attacker can gain physical access to your authentication device, and has a model of your fingerprint/face, which governments increasingly do have). [0] https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Attestation.html https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Gu...
- scrollaway 5y ago
  Google doesn't, they still allow you to use TOTP 2FA.
- Someone1234 5y ago
  You don't have to use a mobile phone/SMS for Google 2FA. You can use: - Hardware key (fido u2f). - TOTP or HOTP generator (on any platform, PC, Mac, iOS, Android, whatever). - Trusted Device.
grawprog 5y ago
This hit me the other day. I dropped my phone and smashed both the screen and display making it essentially unusable. I needed to get into my email. I had no WiFi but I had access to an older phone with data. Tried to sign in on the other phone. It said I needed to confirm the login on my device, I obviously could not, it gave me an option saying 'can't access phone' so I clicked it, it took me to a page saying too bad sorry no signing in for you and that was it, I was locked out of email until I bought a new phone and set it up.
- danlugo92 5y ago
  1. Add OTP to your account ("Google Authenticator", Lastpass, etc). 2. Remove phone number from account. 3. Enjoy not needing a phone ever again to login. 4. Might take a couple of days for (3) to stick, train the algorith by logging in a couple of times using OTP.
  - programmertote 5y ago
    How does one add OTP to her/his Google account? Is there a guide/instruction that you could share? Thanks in advance!
  - maxk42 5y ago
    Your solution for not needing a phone to log in is to use Google Authenticator which is a phone app that would've been on the smashed phone? I recently went through this exact scenario: Old phone broke. Bought a new one, restored backup. Guess which app doesn't restore its data from the old phone? Google Authenticator. Lost access to all my TOTP logins.
- shadowgovt 5y ago
  I've been bit by this before also. It's important to take the one time passcodes that Google provides seriously and keep a couple of them in your wallet.
marcodiego 5y ago
This means I cannot login just using my password?
- anter 5y ago
  That's already the case. If their algorithms decide that your activity is "unusual", they can disable your ability to login with literally no option to bypass it. https://i.imgur.com/4YrElkJ.png https://i.imgur.com/4YrElkJ.png Keep that in mind when you e.g. go traveling.
  - danlugo92 5y ago
    If you have OTP 2FA set up they let you login from anywhere.
    - deleted 5y ago
      [deleted]
  - mindslight 5y ago
    I've been getting this for years. This announcement doesn't seem like a major change to their overall policy, just a ramping up of the roadblocks for CGNAT and the like. Rather than giving users options, Big Tech has decided to paternalistically kill passwords in favor of less convenient and less secure methods (my email is much less secure than my password store). Even from residential IPs, it's become the norm for banking websites to harass you with snake oil "2FA" every time you login. The only solution is to split up your online activities so you can conform to their demands with one VM/browser config, account for the extra annoyances as the price of using their services, and move as much activity as possible to freedom-respecting technologies.
    - pullitoutur 5y ago
      Which of course is why those tech companies spent effort writing and advancing FIDO specs, and why I am able to login to my Goog/Facebook/MS accounts just perfectly damn fine using offline tools (pass, pass-otp). Can we please stop spreading FUD because people here really getting their jimmies rustled at any extra steps (even though this forum is often rife with people falling for phishing attempts, repeatedly using GoDaddy, on and on, proving that they can't protect themeselves.)* But maybe you could name a few tech companies besides Twitter who have implement 2FA you way you imply.
trasz 5y ago
Pathetic. GMail authentication was already quite broken as it is - eg for me it just won't let me in over cellular connection.
- m-s 5y ago
  Having 2FA set up usually gets around those pesky risk-scoring algorithms.
  - trasz 5y ago
    At the cost of introducing other, even worse problems.
    - aoeusnth1 5y ago
      What are some of these worse problems that MFA introduces?
      - trasz 5y ago
        Not being able to get to your account when you lose the phone; having to run extra software. But also, frankly, I just don't trust Google to implement this correctly, given their track record. Google sure employs a lot of smart people, but the quality of their products and services is generally crap.
        jfrunyon 5y ago
        > Not being able to get to your account when you lose the phone Really? There are scratch codes for that. Or you can use an app that backs up your TOTP key for you, like Authy. Or you can store your TOTP key manually. Or you can have multiple devices. Or... > having to run extra software Oh, come on. Are you really complaining about having to compute an HMAC? > I just don't trust Google to implement this correctly, given their track record. Huh? You do know "The day Google forgot to check passwords" was fictional?
dmw_ng 5y ago
Seems like a great opportunity for folk to reevaluate whether they need a Google account at all. I finally escaped in September, after first trying all the way back in 2011. Dragged my feet for so long until eventually just saying "fuck it" after a few glasses of wine, and even recorded a screen cap of the final GAFYD deletion. For anyone attempting escape, rclone seems to be the only tool that supports exporting all Google Docs ever shared to the account. Google Takeout (or the equivalent GAFYD tool) worked for everything else
- tablespoon 5y ago
  > Seems like a great opportunity for folk to reevaluate whether they need a Google account at all. Yeah, but still pretty inconvenient. I migrated all my main stuff way from Google years ago, but I have a bunch of accounts I use as throwaways that will be a much bigger PITA to use.
  - dmw_ng 5y ago
    Probably a little easier for me, I stopped adopting anything new from Google for personal use after the Reader episode. I still have access to some business accounts mostly for GCloud.
- ferdowsi 5y ago
  Why would 2FA of all things be the critical issue? Tech savvy people should understand and use hardware security keys at this point to be securing their cloud accounts in general.
  - dmw_ng 5y ago
    Tech savvy people often discard browser cookies at every opportunity. Adding a 2FA step to every interaction with Google is a change in routine, and forced routine changes are a great time to break any harmful habit
    - dannyw 5y ago
Apreche 5y ago
This article is from May.
- Someone1234 5y ago
  It is still generating useful discussion though. Sometimes news gets lost, I certainly haven't seen this discussed on HN before today.
PaulHoule 5y ago
This guarantees 100% that you will get locked out of your account permanently at some point in your life.
- remus 5y ago
  How so? If you have a variety of second factors enabled (security key, TOTP, recovery codes) it seems like you can be confident enough in not getting locked out.
  - PaulHoule 5y ago
    People who are in the top 1% of technical skill will do that. Not "the rest of us". Most of those tools suck. For instance I got a yubikey which has numerous flaws (not quite a regulation USB device), but the one that "EOLed" it was that the hole to attach it to a keychain wore away. A 0.25-cent nylon washer would have fixed it. Fortunately I was able to recover the yubikey rather than lose it, but it isn't on my keychain anymore. Banks and other high-margin organizations can afford heavy reset and recovery processes. Companies like Google where customer service is "talk to the hand" can't and won't.
    - arbitrage 5y ago
      > People who are in the top 1% of technical skill will do that. Not "the rest of us". Nobody is obligated to help you learn.
      - ergot_vacation 5y ago
        Is this the standard answer now every time someone complains of beating treated like shit? "I was walking down the street in broad daylight and someone beat me and threw me in the gutter!" "Nobody is obligated to teach you self-defense." "I tried to stop while driving but my breaks failed and I crashed into a house!" "Nobody is obligated to teach you proper car maintenance." "My wife's surgeon lied about his qualifications and now she's dead!" "Nobody is obligated to teach you how to spot a quack." IT'S NOT OUR OBLIGATION EITHER. It's Google's, to make products that don't abuse and exploit their users. Stop this bizarre gaslighting tactic. 2FA is a shitty scam system that increases complexity and failure rates, radically decreases privacy, and DOESN'T increase security because the vast majority of users will just use SMS, which is easily hacked.
aimor 5y ago
I feel I'm the only one who absolutely hates the zoo of MFA I'm subjected to as part of the latest and greatest in security for the masses. I hope something comes along to replace all of it soon.
- TeaDude 5y ago
  Don't worry. Many companies are already replacing it with a simple webcam image of your mug (Hopefully directly stored on a server somewhere so it can be used for identity theft purposes).
  - treesknees 5y ago
    Assuming you mean face and not a coffee mug, can you give an example? Most companies using facial recognition are using 3D maps of facial features using IR or other sensors, not a camera image. Windows Hello and Face ID come to mind, hence why they work in the dark.
    - TeaDude 5y ago
      I am fully aware that these algorithms use reference points on your face. I'm still not pleased with that data getting passed around. As for the part of my comment in parentheses; I'm graciously awaiting the facial equivalent of "passwords in plaintext on the server". It's rather uncommon these days but I can almost guarantee it'll happen at least once.
      - treesknees 5y ago
        My point is that generalizing it as a "webcam image on a server" is not only disingenuous, it's incorrect. It's not from the webcam, it's not an image, and it's not on any server except your own local device. Unless you have an example of a company doing this, which I did ask for. As far as I know companies are not storing that data in the cloud, at least the major ones I'm aware of.
- ZetaZero 5y ago
Brendinooo 5y ago
> Supports Google Authenticator and other authentication apps that can generate one-time security codes. How do you do this? I'm looking at my personal account settings and the 2-step options are "app on my iOS devices", "security key", or "text message/voice call".
- Flipflip79 5y ago
  Was the same for me until I enrolled one of the above. I used a security key to get past that stage, then I was allowed add an Authenticator app. Very frustrating UX.
  - gostsamo 5y ago
    Most people don't have a hardware key so Google gets your verified phone number for free.
  - Brendinooo 5y ago
    This worked. Thanks!
- miohtama 5y ago
  App on your iOS device is an open TOTP standard (RFC 6238) for which you can find a client on every possible device, including the command line. https://en.wikipedia.org/wiki/Time-based_One-Time_Password https://en.wikipedia.org/wiki/Time-based_One-Time_Password
  - Brendinooo 5y ago
    Not quite - that option runs through Google apps. The TOTP client option only pops up once you've done another method.
- browningstreet 5y ago
  Am I understanding this correctly: you can't sign up with Authy for Google Accounts if you don't have a mobile device to authenticate with first..?
legrande 5y ago
Got a 2FA prompt for my Google account which said something like: 'Tap the confirm button on your phone to verify it's you'. Just dawned on me I switched to a dumbphone about 5 years ago for privacy reasons and binned my smartphone. So no more Google account for me. It makes me wonder how many people are going to be locked out of their accounts because of these changes. So many people looking for a human. Sadly Google support is famously terrible, and 99% of queries are just Google replying back saying: 'RTFM' or 'Please refer to the FAQ for support'.
- cromwellian 5y ago
  Then you click "Try another way..." and send a code to SMS, or you use U2F.
0x0000000 5y ago
Google locking me out of my account, despite me providing valid credentials, was the catalyst in de-googlifying my life. The inherent tradeoff with information security is convenience. For a personal account, the user should decide where they want to exist on that curve. Google's assumptions that I have perpetual access to a cellular device, or a consistent ISP, are user hostile.
- m-s 5y ago
  I think most users lack understanding to make an informed decision about where they want to be on that curve.
  - 29095432 5y ago
    Absolutely. Additionally, when The Verge runs an article about how “Google doesn’t do anything to protect your account even though it’s the center of your digital existence”, with the story of a user who failed to enable 2FA and had their entire life upended, the retort that “users should be able to decide for themselves where they want to be on the convenience / security curve doesn’t play.
    - KennyBlanken 5y ago
      This isn't about articles by a site 95% of the population has never heard of and it sure isn't about security if SMS is considered acceptable for the second factor. Cellular providers have laughable security when it comes to account access and changes. The easiest way to get to someone's money and digital life is to figure out their cell phone company, and then convince them to send you a new SIM card for their account. Presto, instant to their bank account and now their google account. This is about google wanting to tie more identifying information to a google account, and (by way of making all but "install our app" incredibly annoying) force iOS users to have a Google app on their phone so they know what IP address to associate with you at all times. I was in the process of stripping Google out of my life and this looks like excellent motivation to speed that along.
  - Proven 5y ago
g42gregory 5y ago
This spells the end of privacy on the Internet. Your phone 100% identifies you. Plus, if you lose it, you may lose your account as well. I just got an email from Twitter support, saying that I could “restore” my lost access by creating new account. I thought this email was some kind of a joke, but no.
- derekp7 5y ago
  That is why I use a TOTP app that lets me export an encrypted copy of the TOTP secrets. I also have a printed-out copy of the secrets stored in a secure location, which I update monthly for new accounts I add in. Prior to that when I was just using Google Authenticator I would record the TOTP secret prior to importing it into the app.
  - nerdponx 5y ago
    What TOTP app do you use, and what format do you print the secrets in? I currently use "OTP Auth" for iOS, which supports backup and encrypted cloud sync, but I'm not sure if that supports something like "export to a text file".
    - nh2 5y ago
      On Android, andOTP is good. It is open source, maintained, easy to use, can do backups and re-present the QR code so you can easily scan it with another device. https://github.com/andOTP/andOTP https://github.com/andOTP/andOTP
    - derekp7 5y ago
      I stumbled across Aegis for Android (they don't have an iOS version though). The export format is json, you can export in cleartext or aes encrypted.
  - tgb 5y ago
    What app is it?
- lrem 5y ago
spsful 5y ago
Google's 2FA is very frustrating to say the least. The forced use of a mobile device with a Google app installed as my primary 2FA device is nothing if not annoying-- I already have 1Password set up in the browser to autofill 2FA codes. Google doesn't seem to like this because after sign in I always have to wait for the prompt saying "open the google app on your phone", then scroll down and click "try a different way" and THEN click a selection to enter a 2FA code. Very very frustrating.
- dannyw 5y ago
  That sounds like design decisions for optimising the 2FA experience for the vast majority of users, who don't want to mess with Google Authenticator or their password manager _is_ Google (Chrome).
- cletus 5y ago
  I use a password manager myself (as IMHO everyone should). It's not ideal because if your master password gets compromised it's potentially catastrophic in away that any individual getting compromised isn't. The problem with 1Password 2FA is, I believe, that the 2FA itself is still gated behind your master password, in that if that gets compromised so does your supposed 2FA. The central idea of 2FA is it's something you know and something you have. If that 1Password master password is the only thing needed to gain access then you don't really have 2FA. Again, I don't use this feature of 1Paswword so this might not be exactly how it works. But if so, I'm sympathetic to Google not treating it as 2FA because, well, it isn't.
  - joshstrange 5y ago
    I know 2FA is often described in this way but it's not the way I really use it or how your average person wants to use it IMHO. It's just a second piece of data that is needed to login, which does add significant security. Maybe I just don't oversee anything important enough but I don't actually want my digital security to be dependent on a single piece of hardware ever. Yes, I know about backup codes but where are you going to store those if not 1Password/alternative-manager? So for me I'm perfectly happy to keep my 2FA alongside my password in 1Password. As for "If that 1Password master password is the only thing needed to gain access then you don't really have 2FA." it's not, unless they get access to a device you have logged into 1Password on in the past (and thus entered your secret key [0]). For me this stays true enough to "something I have". If someone has my phone/computer AND can guess my 1Password master password then things are already pretty bleak and they already have access to whatever other 2FA app I was using (Authy/GA). Lastly 2FA falls apart if you share an account with a significant other (or a team). In 1Password I can just move that login to a shared vault or share that login individually and everyone can log in and use 2FA. I'm not sure what the alternative would be. Sure, if a product supports multiple accounts or even multiple 2FA's (I don't think I've ever seen the latter, at least in non-enterprise settings) there is a way to do this but most apps/SaaS/etc there isn't an alternative (other than disabling 2FA). [0] https://support.1password.com/secret-key/ https://support.1password.com/secret-key/
margofx 5y ago
Google's 2FA doesn't make sense. The 2FA bugs sometimes tried to log in to a brand new laptop, and it automatically logged me in without any asking for verification.
04rob 5y ago
Is this really "mandatory" or rather just "opt-out?" My understanding is that it can still be disabled...
mid-kid 5y ago
This was already required to generate what's called an "App Password", in order to keep using IMAP in a sane way without constantly getting emails about suspicious logins when my K9-Mail app on my phone connects to public hotspots. The irony of the matter is that I keep my OTP key in the same password manager as my google password, in order to not require a phone to access it, and this "App Password" is significantly weaker than my generated passwords...
- mid-kid 5y ago
  Oh and I should add that it was already rather compulsory in order to be able to log in to your account on "public" computers (think printing services, schools, ...), as google would straight up block the login unless you got an existing device to confirm your login (i.e. a phone with google apps and services, which I don't have). With the 2FA enabled this no longer is a problem as long as I have a device nearby on which my OTP key is stored...
trollski 5y ago
it is for your own protection. time to switch to outlook.com
aliswe 5y ago
I'm OK with MFA, but it doesn't allow a swedish phone number as backup solution. That's annoying ...
gjsman-1000 5y ago
Seems like a great backdoor method to fool everyone into giving Google their phone numbers.
- bpodgursky 5y ago
  can't you use an authenticator app or hardware key?
  - gjsman-1000 5y ago
    You could, but the vast majority of people probably won't.
deleted 5y ago
[deleted]
jacquesm 5y ago
This article links to a Google blog post which notes explicitly: "NOTE: The automatic 2SV enrollment will not impact organizations on Google Workspace. Organizations on Google Workspace will continue to have the choice of enrolling their users in 2SV via the admin console."
jsnell 5y ago
The title is highly misleading, and is predictably being interpreted as 2SV becoming mandatory for everyone. But that's not what the article text says: > We will soon start automatically enabling two-step verification for users if their accounts are configured correctly” And then goes on to speculate about who exactly that group of users is.
- ergot_vacation 5y ago
  Glad this is (at the moment at least) the top comment. Add another to the infinitely growing pile of HN news posts that are either out of date, massively misleading in making a calamity out of a non-issue, or both. Not that it's HN's fault. This is just modern "media." Yeck. Still, worth griping about 2FA while we're here.
  - evandwight 5y ago
    Do you think it would be better to filter the news as a group rather than individually? I find it very frustrating not being able to trust titles.
  - reaperducer 5y ago
    Not that it's HN's fault In a way, it is. A lot of people joined HN searching for a higher level of discussion and thought. And HN is powered by submissions from its users. What would be nice is if we could get more high-quality submissions to drown out the bots and other low-grade content. Perhaps if users could filter out submissions by domain. For example, I don't mind seeing nytimes.com submissions, but I don't want to see anything from youtube.com. But then we're just back to building yet another social media echo chamber. Yuck. Life is hard.
nonbirithm 5y ago
Does anyone else need to isolate their phone in another room to prevent distractions, only for some web service to restrict logging in behind a 2FA method with no other hardware option, thus forcing you to go back to your phone, and then once the phone is in your hands you end up getting distracted?
account-5 5y ago
If they don't allow me to use TOTP via keepass then they can kiss my @*. I only have Google accounts because of android so not fussed if they decide I'm not receiving ads on their service.
maxk42 5y ago
Recently my cell phone suffered a catastrophic failure and had to be replaced. "No problem", I thought "I'll just restore my data from Android's automatic backups onto my new device." Google's Authenticator app's data is not restored. I have no way of logging into half a dozen apps that require 2FA now. Good going, Google. I'll never use your shitty 2FA again.
- CaptainJustin 5y ago
  1. What is the official way we're supposed to handle this? 2. How should the tech world communicate that better so that it's more user-friendly?
  - te_chris 5y ago
    Yeah, I've been burned by Goog Authenticator not being cloud. I use 1pass for 2FA now and it works in the cloud at least.
  - r1ch 5y ago
    The most common solution is one-time-use backup codes that most services give you when enrolling. Hopefully you saved them somewhere safe! The main issue is Google Authenticator and how popular it is. As GP noticed, it doesn't flag the files as being allowed for backup which is kind of ridiculous. Almost anything is better, https://getaegis.app/ https://getaegis.app/ is my recommendation. You can also manually backup your seed (screenshot / save the QR code during enrollment).
  - creato 5y ago
    I think the only way to handle the possibility of failure of a 2FA system is to have multiple options configured. They all can fail somehow: loss, damage, hardware failure, etc. On my Google account I have two security keys, an OTP app, and saved backup codes. That's not user friendly though. I don't see how to make a user friendly, reliable, and safe 2FA system. Not having 2FA isn't safe either!
  - deleted 5y ago
    [deleted]
mattowen_uk 5y ago
Ok, I know I'm shouting into the wind on this one, but I really dislike 2FA. Like the CCV code on the back of your credit card, it only exists to give the provider a 'get out of jail' free card if your access is comprised. As long as I have a nice strong password, why do I need 2FA? Also, normal people share accounts. This is a known fact. By enforcing 2FA, the provider is preventing the other users of the account access if they don't have the registered phone or yubikey type device with them. Of course this is what they WANT. They absolutely want to force a one person, one account system, so that the data collection for advertising isn't muddled by multiple people using the account. What I would like to see is a separation between the 'logon' and the 'service'. This would be a system where there can be multiple users accessing, say, a shared mailbox. In this way 2FA would not create a barrier for access. Another good example would be a shared Amazon account that is used by a couple. The account is set up to pull payments from a joint bank account, if 2FA was enforced (and I'm sure it's coming to Amazon), then only one of the couple would be able to use it. Generationally, older people are used to joint finances, and they are not all dead yet, but are being forced into a usage model dreamt up by someone who has no appreciation that the one person, one account system is not something that fits everyone. I know my view on this is not in line with the group think on Hacker News, but it's something I feel very strongly about. Providers need to fix the multiple account user problem first, before enforcing 2FA. Before you just think "Disagree!" and vote me down, why not reply with your viewpoint?
- forty 5y ago
  You can store your 2FA in a password manager, and use it to share it with people. (I work for Dashlane which supports this, but I'm sure some other PM can also do this)
  - mattowen_uk 5y ago
    Password Managers all have the concept of a 'Primary' user, who shares access to passwords etc. with 'Secondary' users. The primary can cut off the secondary at any point, but not the other way around. For couples/groups where everyone has equal standing, this model doesn't work. Also a lot of 2FAs are based around authenticator apps which can only be installed onto one device at a time.
apricot13 5y ago
The past week I've had a few family members and friends need tech support thinking they had been hacked (had ignored the email telling them about the change over) issue is they don't have a 2fa application. If they follow the instructions they download the google one which doesn't do backups and they don't trust authy or think the m$ one wont work with a google account. Scanning a QR code is something some can do but not all. The issue now is that even though they were using an insecure account they always had the ability to get back in - but now if they lose their phone and are signed out of the gmail apps for whatever reason thats it they're locked out forever!
t0bia_s 5y ago
So basically another data harvesting from Google. They want ID scans for YT, mobile phone to login... What else? Selfie for gmail? Fortunately I do not use anything from google over 2 years, so it is not problem for me, but I cannot imagine frustrations for everyone, that needs their data from google and they are systematically forced to share more and more personal data with them.
- jfrunyon 5y ago
  It's pretty clear that they're only turning it on for people for whom they already have the appropriate data. You can also use any of the many other 2FA methods they support, like standard TOTP, a security key, or even by simply rotating a sheet of scratch codes.
alphabet9000 5y ago
I'm trying to update a chrome extension, and it now asks me to set up 2FA. I don't want to use a phone, and I don't see any option for using Google Authenticator to do one time keys. It is asking for a physical hardware key. Surely there's got to be another way to do this right?
rcarmo 5y ago
Oh well. I still find it extremely weird to be asked to open YouTube on my iPhone to login, though. And my IMAP scripts are going to be irrevocably broken as well, I suppose.
bg117 5y ago
Had a GMail account with 2FA enabled - Google Authenticator App(GAA). GAA was on my mobile. Lost my mobile and access to my Gmail account last month since I couldn't authenticate without that phone. Stay away.

160 points by vezycash 5y ago

smcameron 5y ago

Great now if I lose my phone, or if it breaks, I'm in grave danger of losing my google account.

Jxl180 5y ago
That’s the beauty of 2 factor. If you lose your phone and a bad actor picks it up, they now have one of your factors (what you have) but not “what you know.” Your example is a great reason for 2FA to exist.
- ergot_vacation 5y ago
  Consider 3 situations: 1. Google does not require 2FA. 2. Google DOES require 2FA on an account, but only requires the second auth if "suspicious activity" crops up. 3. Google requires 2 auths on each and every login. On 1, if a bad actor picks up your phone and tries to log in, they will fail if you haven't saved your login, or succeed if you've been lazy and saved it. In the latter case, that's really on you (and you might still be able to get your account back even then, if they didn't fully and quickly reset password and other details!) On 2 however, they will try to log in, fail, and trigger a lock-down that can only be lifted with both auths. One of which you don't have anymore. Congrads, you've just lost your account! 3 is the same as 2, just for different reasons. As soon as that phone disappears, you don't have the second auth, and you're screwed. And don't even bother with anything that isn't a phone. We both know nobody in the general public is using anything other than text for this. And some older folks don't even have that! Add on to this that SMS can be easily hacked, and it's pretty clear this whole system is a joke.
  - Jxl180 5y ago
    You just put in your back up codes to restore access. That’s why the backup codes/words exist. If I lose my crypto wallet or it gets stolen, I go to my bank, get the words from my safe deposit box, and use those words to seed my new wallet. Doesn’t have to be a bank — a home safe or filing cabinet will work, but when my phone broke I had zero problem restoring my 2FA on my new phone using the backup words.
darkwizard42 5y ago
You can use your backup codes. In fact your point is a good reason to HAVE MFA given that in the past, if you lost your phone all your data would be compromised.
- xboxnolifes 5y ago
  > In fact your point is a good reason to HAVE MFA given that in the past, if you lost your phone all your data would be compromised. In the past, wouldn't all your data still be behind a password? Am I missing something?

officeplant 5y ago

Been using google prompt 2-step since they first started offering it a while back. Gotta say its the most painless 2-factor authentication of any account I actively use. Although its a bit clunky to have to open gmail on an iphone to get the prompt when I'm not dailying an android phone for testing reasons.

0des 5y ago

I'd like to make a humble appeal to you, dear Reader, that you consider if you are able to exist without Google services and the tradeoffs they entail.

shadowgovt 5y ago
I'm having the opposite reaction. 2FA is a strict improvement and everyone should be using it. I applaud Google for mandating a best practice. It's far preferable to the alternative of having your account compromised because your password is guessed or stolen.
- 0des 5y ago
  This is not my opinion against 2FA, it is me using this moment of friction to ask a question most people are often too happy to ignore when things are going fine. Are you able to live without your captors or not?
  - shadowgovt 5y ago
    I also don't see them as my "captors." I'm able to live without electricity but I'm not about to call the power company and have them cut my feed. There are folks who consider it some kind of incarceration to be beholden to the electricity provided by a power company; I respect them but I don't share their philosophy.
    - xdennis 5y ago
      Depending on the situation it can be easy to cut yourself from the power company, but no one can create his own phone carrier regardless of the situation.
      - shadowgovt 5y ago
        > Depending on the situation it can be easy to cut yourself from the power company Unless the situation is "There is another power company right next door," I'll have to disagree. If the claim is one can self-generate power, the analogy holds but not in the way, I think, the author means. Self-generation off-grid is a pain... Buy or build and maintain your own generators, your own storage, deal with impedance, deal with the risks of operating on high voltage, equipment breakdowns are yours and yours alone to repair, etc. Similarly, I can self-host my own email, video, web servers, and possibly even build my own voice-activated assistants tuned perfectly to my specifications, sharing my data with nobody... But that's a lot of work when Google has provided all of that for me.

lemoncookiechip 5y ago

They really want our phone numbers. I have a few throwaway accounts for subbing to sites that require log-in that I don't want connected to a phone. IF they brick my accounts, I'm just going to stop using Gmail and turn to Proton or something else.

cornstalks 5y ago
Aren't there non-phone-number 2FA options?
- danlugo92 5y ago
  Yes, OTP.
  - Freak_NL 5y ago
    Possible, and a real burden to set up: https://webapps.stackexchange.com/questions/127464/enabling-2fa-on-a-google-account-how-to-get-totp-secret https://webapps.stackexchange.com/questions/127464/enabling-... Perhaps this changed now, but I had to set up a different 2FA method first (I used a U2F security key), then add OTP, and then it was possible to remove the U2F method. After logging in with OTP once (I just keep the private key on my laptop in pass) you never seem to get asked to provide it again, but 2FA is nominally enabled.
- tyingq 5y ago
  "Then, a code will be sent to your phone via text, voice call, or our mobile app. Or, if you have a Security Key, you can insert it into your computer’s USB port." https://www.google.com/intl/en/landing/2step/#tab=how-it-works https://www.google.com/intl/en/landing/2step/#tab=how-it-wor... I'm not sure why TOTP isn't an option. Google Authenticator still seems to be a supported app.
  - sumeno 5y ago
    It is. Look under Features > The Google Authenticator app for Android, iPhone, or BlackBerry can generate verification codes. It even works when your device has no phone or data connectivity. You can also use third party apps, I use Authy

avodonosov 5y ago

How annoying, in particular that service providers expect me to have a mobile phone and that the phone represents me (can not be lost, etc)

derekp7 5y ago
You don't need a mobile phone for TOTP -- you can do it from a shell script and openssl. Many security keys support storing TOTP built in, and Google also supports the various security key protocols (FIDO2 I think is the current version?)
- deleted 5y ago
  [deleted]
- dane-pgp 5y ago
  I should point out that FIDO2 allows sites to require that visitors use a device from a specific whitelist of devices.[0] Google has already tightened the requirements by mandating 2FA, so don't be surprised when they start blocking "insecure" factors like shell scripts. It probably wouldn't go down well if Google required an Android device to provide the second factor, but I could definitely see them requiring a device which does biometric verification of the user. That's a pretty good way of connecting online activity to a specific human (assuming the attacker can gain physical access to your authentication device, and has a model of your fingerprint/face, which governments increasingly do have). [0] https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Attestation.html https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Gu...
scrollaway 5y ago
Google doesn't, they still allow you to use TOTP 2FA.
Someone1234 5y ago
You don't have to use a mobile phone/SMS for Google 2FA. You can use: - Hardware key (fido u2f). - TOTP or HOTP generator (on any platform, PC, Mac, iOS, Android, whatever). - Trusted Device.

grawprog 5y ago

This hit me the other day. I dropped my phone and smashed both the screen and display making it essentially unusable. I needed to get into my email. I had no WiFi but I had access to an older phone with data. Tried to sign in on the other phone. It said I needed to confirm the login on my device, I obviously could not, it gave me an option saying 'can't access phone' so I clicked it, it took me to a page saying too bad sorry no signing in for you and that was it, I was locked out of email until I bought a new phone and set it up.

danlugo92 5y ago
1. Add OTP to your account ("Google Authenticator", Lastpass, etc). 2. Remove phone number from account. 3. Enjoy not needing a phone ever again to login. 4. Might take a couple of days for (3) to stick, train the algorith by logging in a couple of times using OTP.
- programmertote 5y ago
  How does one add OTP to her/his Google account? Is there a guide/instruction that you could share? Thanks in advance!
- maxk42 5y ago
  Your solution for not needing a phone to log in is to use Google Authenticator which is a phone app that would've been on the smashed phone? I recently went through this exact scenario: Old phone broke. Bought a new one, restored backup. Guess which app doesn't restore its data from the old phone? Google Authenticator. Lost access to all my TOTP logins.
shadowgovt 5y ago
I've been bit by this before also. It's important to take the one time passcodes that Google provides seriously and keep a couple of them in your wallet.

marcodiego 5y ago

This means I cannot login just using my password?

anter 5y ago
That's already the case. If their algorithms decide that your activity is "unusual", they can disable your ability to login with literally no option to bypass it. https://i.imgur.com/4YrElkJ.png https://i.imgur.com/4YrElkJ.png Keep that in mind when you e.g. go traveling.
- danlugo92 5y ago
  If you have OTP 2FA set up they let you login from anywhere.
  - deleted 5y ago
    [deleted]
- mindslight 5y ago
  I've been getting this for years. This announcement doesn't seem like a major change to their overall policy, just a ramping up of the roadblocks for CGNAT and the like. Rather than giving users options, Big Tech has decided to paternalistically kill passwords in favor of less convenient and less secure methods (my email is much less secure than my password store). Even from residential IPs, it's become the norm for banking websites to harass you with snake oil "2FA" every time you login. The only solution is to split up your online activities so you can conform to their demands with one VM/browser config, account for the extra annoyances as the price of using their services, and move as much activity as possible to freedom-respecting technologies.
  - pullitoutur 5y ago
    Which of course is why those tech companies spent effort writing and advancing FIDO specs, and why I am able to login to my Goog/Facebook/MS accounts just perfectly damn fine using offline tools (pass, pass-otp). Can we please stop spreading FUD because people here really getting their jimmies rustled at any extra steps (even though this forum is often rife with people falling for phishing attempts, repeatedly using GoDaddy, on and on, proving that they can't protect themeselves.)* But maybe you could name a few tech companies besides Twitter who have implement 2FA you way you imply.

trasz 5y ago

Pathetic. GMail authentication was already quite broken as it is - eg for me it just won't let me in over cellular connection.

m-s 5y ago
Having 2FA set up usually gets around those pesky risk-scoring algorithms.
- trasz 5y ago
  At the cost of introducing other, even worse problems.
  - aoeusnth1 5y ago
    What are some of these worse problems that MFA introduces?
    - trasz 5y ago
      Not being able to get to your account when you lose the phone; having to run extra software. But also, frankly, I just don't trust Google to implement this correctly, given their track record. Google sure employs a lot of smart people, but the quality of their products and services is generally crap.
      - jfrunyon 5y ago
        > Not being able to get to your account when you lose the phone Really? There are scratch codes for that. Or you can use an app that backs up your TOTP key for you, like Authy. Or you can store your TOTP key manually. Or you can have multiple devices. Or... > having to run extra software Oh, come on. Are you really complaining about having to compute an HMAC? > I just don't trust Google to implement this correctly, given their track record. Huh? You do know "The day Google forgot to check passwords" was fictional?

dmw_ng 5y ago

Seems like a great opportunity for folk to reevaluate whether they need a Google account at all. I finally escaped in September, after first trying all the way back in 2011. Dragged my feet for so long until eventually just saying "fuck it" after a few glasses of wine, and even recorded a screen cap of the final GAFYD deletion. For anyone attempting escape, rclone seems to be the only tool that supports exporting all Google Docs ever shared to the account. Google Takeout (or the equivalent GAFYD tool) worked for everything else

tablespoon 5y ago
> Seems like a great opportunity for folk to reevaluate whether they need a Google account at all. Yeah, but still pretty inconvenient. I migrated all my main stuff way from Google years ago, but I have a bunch of accounts I use as throwaways that will be a much bigger PITA to use.
- dmw_ng 5y ago
  Probably a little easier for me, I stopped adopting anything new from Google for personal use after the Reader episode. I still have access to some business accounts mostly for GCloud.
ferdowsi 5y ago
Why would 2FA of all things be the critical issue? Tech savvy people should understand and use hardware security keys at this point to be securing their cloud accounts in general.
- dmw_ng 5y ago
  Tech savvy people often discard browser cookies at every opportunity. Adding a 2FA step to every interaction with Google is a change in routine, and forced routine changes are a great time to break any harmful habit
  - dannyw 5y ago

Apreche 5y ago

This article is from May.

Someone1234 5y ago
It is still generating useful discussion though. Sometimes news gets lost, I certainly haven't seen this discussed on HN before today.

PaulHoule 5y ago

This guarantees 100% that you will get locked out of your account permanently at some point in your life.

remus 5y ago
How so? If you have a variety of second factors enabled (security key, TOTP, recovery codes) it seems like you can be confident enough in not getting locked out.
- PaulHoule 5y ago
  People who are in the top 1% of technical skill will do that. Not "the rest of us". Most of those tools suck. For instance I got a yubikey which has numerous flaws (not quite a regulation USB device), but the one that "EOLed" it was that the hole to attach it to a keychain wore away. A 0.25-cent nylon washer would have fixed it. Fortunately I was able to recover the yubikey rather than lose it, but it isn't on my keychain anymore. Banks and other high-margin organizations can afford heavy reset and recovery processes. Companies like Google where customer service is "talk to the hand" can't and won't.
  - arbitrage 5y ago
    > People who are in the top 1% of technical skill will do that. Not "the rest of us". Nobody is obligated to help you learn.
    - ergot_vacation 5y ago
      Is this the standard answer now every time someone complains of beating treated like shit? "I was walking down the street in broad daylight and someone beat me and threw me in the gutter!" "Nobody is obligated to teach you self-defense." "I tried to stop while driving but my breaks failed and I crashed into a house!" "Nobody is obligated to teach you proper car maintenance." "My wife's surgeon lied about his qualifications and now she's dead!" "Nobody is obligated to teach you how to spot a quack." IT'S NOT OUR OBLIGATION EITHER. It's Google's, to make products that don't abuse and exploit their users. Stop this bizarre gaslighting tactic. 2FA is a shitty scam system that increases complexity and failure rates, radically decreases privacy, and DOESN'T increase security because the vast majority of users will just use SMS, which is easily hacked.

aimor 5y ago

I feel I'm the only one who absolutely hates the zoo of MFA I'm subjected to as part of the latest and greatest in security for the masses. I hope something comes along to replace all of it soon.

TeaDude 5y ago
Don't worry. Many companies are already replacing it with a simple webcam image of your mug (Hopefully directly stored on a server somewhere so it can be used for identity theft purposes).
- treesknees 5y ago
  Assuming you mean face and not a coffee mug, can you give an example? Most companies using facial recognition are using 3D maps of facial features using IR or other sensors, not a camera image. Windows Hello and Face ID come to mind, hence why they work in the dark.
  - TeaDude 5y ago
    I am fully aware that these algorithms use reference points on your face. I'm still not pleased with that data getting passed around. As for the part of my comment in parentheses; I'm graciously awaiting the facial equivalent of "passwords in plaintext on the server". It's rather uncommon these days but I can almost guarantee it'll happen at least once.
    - treesknees 5y ago
      My point is that generalizing it as a "webcam image on a server" is not only disingenuous, it's incorrect. It's not from the webcam, it's not an image, and it's not on any server except your own local device. Unless you have an example of a company doing this, which I did ask for. As far as I know companies are not storing that data in the cloud, at least the major ones I'm aware of.
ZetaZero 5y ago

Brendinooo 5y ago

> Supports Google Authenticator and other authentication apps that can generate one-time security codes. How do you do this? I'm looking at my personal account settings and the 2-step options are "app on my iOS devices", "security key", or "text message/voice call".

Flipflip79 5y ago
Was the same for me until I enrolled one of the above. I used a security key to get past that stage, then I was allowed add an Authenticator app. Very frustrating UX.
- gostsamo 5y ago
  Most people don't have a hardware key so Google gets your verified phone number for free.
- Brendinooo 5y ago
  This worked. Thanks!
miohtama 5y ago
App on your iOS device is an open TOTP standard (RFC 6238) for which you can find a client on every possible device, including the command line. https://en.wikipedia.org/wiki/Time-based_One-Time_Password https://en.wikipedia.org/wiki/Time-based_One-Time_Password
- Brendinooo 5y ago
  Not quite - that option runs through Google apps. The TOTP client option only pops up once you've done another method.
browningstreet 5y ago
Am I understanding this correctly: you can't sign up with Authy for Google Accounts if you don't have a mobile device to authenticate with first..?

legrande 5y ago

Got a 2FA prompt for my Google account which said something like: 'Tap the confirm button on your phone to verify it's you'. Just dawned on me I switched to a dumbphone about 5 years ago for privacy reasons and binned my smartphone. So no more Google account for me. It makes me wonder how many people are going to be locked out of their accounts because of these changes. So many people looking for a human. Sadly Google support is famously terrible, and 99% of queries are just Google replying back saying: 'RTFM' or 'Please refer to the FAQ for support'.

cromwellian 5y ago
Then you click "Try another way..." and send a code to SMS, or you use U2F.

0x0000000 5y ago

Google locking me out of my account, despite me providing valid credentials, was the catalyst in de-googlifying my life. The inherent tradeoff with information security is convenience. For a personal account, the user should decide where they want to exist on that curve. Google's assumptions that I have perpetual access to a cellular device, or a consistent ISP, are user hostile.

m-s 5y ago
I think most users lack understanding to make an informed decision about where they want to be on that curve.
- 29095432 5y ago
  Absolutely. Additionally, when The Verge runs an article about how “Google doesn’t do anything to protect your account even though it’s the center of your digital existence”, with the story of a user who failed to enable 2FA and had their entire life upended, the retort that “users should be able to decide for themselves where they want to be on the convenience / security curve doesn’t play.
  - KennyBlanken 5y ago
    This isn't about articles by a site 95% of the population has never heard of and it sure isn't about security if SMS is considered acceptable for the second factor. Cellular providers have laughable security when it comes to account access and changes. The easiest way to get to someone's money and digital life is to figure out their cell phone company, and then convince them to send you a new SIM card for their account. Presto, instant to their bank account and now their google account. This is about google wanting to tie more identifying information to a google account, and (by way of making all but "install our app" incredibly annoying) force iOS users to have a Google app on their phone so they know what IP address to associate with you at all times. I was in the process of stripping Google out of my life and this looks like excellent motivation to speed that along.
- Proven 5y ago

g42gregory 5y ago

This spells the end of privacy on the Internet. Your phone 100% identifies you. Plus, if you lose it, you may lose your account as well. I just got an email from Twitter support, saying that I could “restore” my lost access by creating new account. I thought this email was some kind of a joke, but no.

derekp7 5y ago
That is why I use a TOTP app that lets me export an encrypted copy of the TOTP secrets. I also have a printed-out copy of the secrets stored in a secure location, which I update monthly for new accounts I add in. Prior to that when I was just using Google Authenticator I would record the TOTP secret prior to importing it into the app.
- nerdponx 5y ago
  What TOTP app do you use, and what format do you print the secrets in? I currently use "OTP Auth" for iOS, which supports backup and encrypted cloud sync, but I'm not sure if that supports something like "export to a text file".
  - nh2 5y ago
    On Android, andOTP is good. It is open source, maintained, easy to use, can do backups and re-present the QR code so you can easily scan it with another device. https://github.com/andOTP/andOTP https://github.com/andOTP/andOTP
  - derekp7 5y ago
    I stumbled across Aegis for Android (they don't have an iOS version though). The export format is json, you can export in cleartext or aes encrypted.
- tgb 5y ago
  What app is it?
lrem 5y ago

spsful 5y ago

Google's 2FA is very frustrating to say the least. The forced use of a mobile device with a Google app installed as my primary 2FA device is nothing if not annoying-- I already have 1Password set up in the browser to autofill 2FA codes. Google doesn't seem to like this because after sign in I always have to wait for the prompt saying "open the google app on your phone", then scroll down and click "try a different way" and THEN click a selection to enter a 2FA code. Very very frustrating.

dannyw 5y ago
That sounds like design decisions for optimising the 2FA experience for the vast majority of users, who don't want to mess with Google Authenticator or their password manager _is_ Google (Chrome).
cletus 5y ago
I use a password manager myself (as IMHO everyone should). It's not ideal because if your master password gets compromised it's potentially catastrophic in away that any individual getting compromised isn't. The problem with 1Password 2FA is, I believe, that the 2FA itself is still gated behind your master password, in that if that gets compromised so does your supposed 2FA. The central idea of 2FA is it's something you know and something you have. If that 1Password master password is the only thing needed to gain access then you don't really have 2FA. Again, I don't use this feature of 1Paswword so this might not be exactly how it works. But if so, I'm sympathetic to Google not treating it as 2FA because, well, it isn't.
- joshstrange 5y ago
  I know 2FA is often described in this way but it's not the way I really use it or how your average person wants to use it IMHO. It's just a second piece of data that is needed to login, which does add significant security. Maybe I just don't oversee anything important enough but I don't actually want my digital security to be dependent on a single piece of hardware ever. Yes, I know about backup codes but where are you going to store those if not 1Password/alternative-manager? So for me I'm perfectly happy to keep my 2FA alongside my password in 1Password. As for "If that 1Password master password is the only thing needed to gain access then you don't really have 2FA." it's not, unless they get access to a device you have logged into 1Password on in the past (and thus entered your secret key [0]). For me this stays true enough to "something I have". If someone has my phone/computer AND can guess my 1Password master password then things are already pretty bleak and they already have access to whatever other 2FA app I was using (Authy/GA). Lastly 2FA falls apart if you share an account with a significant other (or a team). In 1Password I can just move that login to a shared vault or share that login individually and everyone can log in and use 2FA. I'm not sure what the alternative would be. Sure, if a product supports multiple accounts or even multiple 2FA's (I don't think I've ever seen the latter, at least in non-enterprise settings) there is a way to do this but most apps/SaaS/etc there isn't an alternative (other than disabling 2FA). [0] https://support.1password.com/secret-key/ https://support.1password.com/secret-key/

margofx 5y ago

Google's 2FA doesn't make sense. The 2FA bugs sometimes tried to log in to a brand new laptop, and it automatically logged me in without any asking for verification.

04rob 5y ago

Is this really "mandatory" or rather just "opt-out?" My understanding is that it can still be disabled...

mid-kid 5y ago

This was already required to generate what's called an "App Password", in order to keep using IMAP in a sane way without constantly getting emails about suspicious logins when my K9-Mail app on my phone connects to public hotspots. The irony of the matter is that I keep my OTP key in the same password manager as my google password, in order to not require a phone to access it, and this "App Password" is significantly weaker than my generated passwords...

mid-kid 5y ago
Oh and I should add that it was already rather compulsory in order to be able to log in to your account on "public" computers (think printing services, schools, ...), as google would straight up block the login unless you got an existing device to confirm your login (i.e. a phone with google apps and services, which I don't have). With the 2FA enabled this no longer is a problem as long as I have a device nearby on which my OTP key is stored...

trollski 5y ago

it is for your own protection. time to switch to outlook.com

aliswe 5y ago

I'm OK with MFA, but it doesn't allow a swedish phone number as backup solution. That's annoying ...

gjsman-1000 5y ago

Seems like a great backdoor method to fool everyone into giving Google their phone numbers.

bpodgursky 5y ago
can't you use an authenticator app or hardware key?
- gjsman-1000 5y ago
  You could, but the vast majority of people probably won't.

deleted 5y ago

[deleted]

jacquesm 5y ago

This article links to a Google blog post which notes explicitly: "NOTE: The automatic 2SV enrollment will not impact organizations on Google Workspace. Organizations on Google Workspace will continue to have the choice of enrolling their users in 2SV via the admin console."

jsnell 5y ago

The title is highly misleading, and is predictably being interpreted as 2SV becoming mandatory for everyone. But that's not what the article text says: > We will soon start automatically enabling two-step verification for users if their accounts are configured correctly” And then goes on to speculate about who exactly that group of users is.

ergot_vacation 5y ago
Glad this is (at the moment at least) the top comment. Add another to the infinitely growing pile of HN news posts that are either out of date, massively misleading in making a calamity out of a non-issue, or both. Not that it's HN's fault. This is just modern "media." Yeck. Still, worth griping about 2FA while we're here.
- evandwight 5y ago
  Do you think it would be better to filter the news as a group rather than individually? I find it very frustrating not being able to trust titles.
- reaperducer 5y ago
  Not that it's HN's fault In a way, it is. A lot of people joined HN searching for a higher level of discussion and thought. And HN is powered by submissions from its users. What would be nice is if we could get more high-quality submissions to drown out the bots and other low-grade content. Perhaps if users could filter out submissions by domain. For example, I don't mind seeing nytimes.com submissions, but I don't want to see anything from youtube.com. But then we're just back to building yet another social media echo chamber. Yuck. Life is hard.

nonbirithm 5y ago

Does anyone else need to isolate their phone in another room to prevent distractions, only for some web service to restrict logging in behind a 2FA method with no other hardware option, thus forcing you to go back to your phone, and then once the phone is in your hands you end up getting distracted?

account-5 5y ago

If they don't allow me to use TOTP via keepass then they can kiss my @*. I only have Google accounts because of android so not fussed if they decide I'm not receiving ads on their service.

maxk42 5y ago

Recently my cell phone suffered a catastrophic failure and had to be replaced. "No problem", I thought "I'll just restore my data from Android's automatic backups onto my new device." Google's Authenticator app's data is not restored. I have no way of logging into half a dozen apps that require 2FA now. Good going, Google. I'll never use your shitty 2FA again.

CaptainJustin 5y ago
1. What is the official way we're supposed to handle this? 2. How should the tech world communicate that better so that it's more user-friendly?
- te_chris 5y ago
  Yeah, I've been burned by Goog Authenticator not being cloud. I use 1pass for 2FA now and it works in the cloud at least.
- r1ch 5y ago
  The most common solution is one-time-use backup codes that most services give you when enrolling. Hopefully you saved them somewhere safe! The main issue is Google Authenticator and how popular it is. As GP noticed, it doesn't flag the files as being allowed for backup which is kind of ridiculous. Almost anything is better, https://getaegis.app/ https://getaegis.app/ is my recommendation. You can also manually backup your seed (screenshot / save the QR code during enrollment).
- creato 5y ago
  I think the only way to handle the possibility of failure of a 2FA system is to have multiple options configured. They all can fail somehow: loss, damage, hardware failure, etc. On my Google account I have two security keys, an OTP app, and saved backup codes. That's not user friendly though. I don't see how to make a user friendly, reliable, and safe 2FA system. Not having 2FA isn't safe either!
- deleted 5y ago
  [deleted]

mattowen_uk 5y ago

Ok, I know I'm shouting into the wind on this one, but I really dislike 2FA. Like the CCV code on the back of your credit card, it only exists to give the provider a 'get out of jail' free card if your access is comprised. As long as I have a nice strong password, why do I need 2FA? Also, normal people share accounts. This is a known fact. By enforcing 2FA, the provider is preventing the other users of the account access if they don't have the registered phone or yubikey type device with them. Of course this is what they WANT. They absolutely want to force a one person, one account system, so that the data collection for advertising isn't muddled by multiple people using the account. What I would like to see is a separation between the 'logon' and the 'service'. This would be a system where there can be multiple users accessing, say, a shared mailbox. In this way 2FA would not create a barrier for access. Another good example would be a shared Amazon account that is used by a couple. The account is set up to pull payments from a joint bank account, if 2FA was enforced (and I'm sure it's coming to Amazon), then only one of the couple would be able to use it. Generationally, older people are used to joint finances, and they are not all dead yet, but are being forced into a usage model dreamt up by someone who has no appreciation that the one person, one account system is not something that fits everyone. I know my view on this is not in line with the group think on Hacker News, but it's something I feel very strongly about. Providers need to fix the multiple account user problem first, before enforcing 2FA. Before you just think "Disagree!" and vote me down, why not reply with your viewpoint?

forty 5y ago
You can store your 2FA in a password manager, and use it to share it with people. (I work for Dashlane which supports this, but I'm sure some other PM can also do this)
- mattowen_uk 5y ago
  Password Managers all have the concept of a 'Primary' user, who shares access to passwords etc. with 'Secondary' users. The primary can cut off the secondary at any point, but not the other way around. For couples/groups where everyone has equal standing, this model doesn't work. Also a lot of 2FAs are based around authenticator apps which can only be installed onto one device at a time.

apricot13 5y ago

The past week I've had a few family members and friends need tech support thinking they had been hacked (had ignored the email telling them about the change over) issue is they don't have a 2fa application. If they follow the instructions they download the google one which doesn't do backups and they don't trust authy or think the m$ one wont work with a google account. Scanning a QR code is something some can do but not all. The issue now is that even though they were using an insecure account they always had the ability to get back in - but now if they lose their phone and are signed out of the gmail apps for whatever reason thats it they're locked out forever!

t0bia_s 5y ago

So basically another data harvesting from Google. They want ID scans for YT, mobile phone to login... What else? Selfie for gmail? Fortunately I do not use anything from google over 2 years, so it is not problem for me, but I cannot imagine frustrations for everyone, that needs their data from google and they are systematically forced to share more and more personal data with them.

jfrunyon 5y ago
It's pretty clear that they're only turning it on for people for whom they already have the appropriate data. You can also use any of the many other 2FA methods they support, like standard TOTP, a security key, or even by simply rotating a sheet of scratch codes.

alphabet9000 5y ago

I'm trying to update a chrome extension, and it now asks me to set up 2FA. I don't want to use a phone, and I don't see any option for using Google Authenticator to do one time keys. It is asking for a physical hardware key. Surely there's got to be another way to do this right?

rcarmo 5y ago

Oh well. I still find it extremely weird to be asked to open YouTube on my iPhone to login, though. And my IMAP scripts are going to be irrevocably broken as well, I suppose.

bg117 5y ago

Had a GMail account with 2FA enabled - Google Authenticator App(GAA). GAA was on my mobile. Lost my mobile and access to my Gmail account last month since I couldn't authenticate without that phone. Stay away.