3 ms·
You don't have to use a mobile phone/SMS for Google 2FA. You can use: - Hardware key (fido u2f). - TOTP or HOTP generator (on any platform, PC, Mac, iOS, Andr
by Someone1234 5y ago
You don't have to use a mobile phone/SMS for Google 2FA. You can use:
- Hardware key (fido u2f).
- TOTP or HOTP generator (on any platform, PC, Mac, iOS, Android, whatever).
- Trusted Device.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- avodonosov 5y agoIn all those cases the user needs a device for auth
- Someone1234 5y agoYou also need a device for logging into a Google Account at all. These can be the same device.
- avodonosov 5y agoWith password I can login from any device (guest session on a friend's laptop, etc). So I am independent of a specific device. The second factor ties me to a specific device.
- Someone1234 5y agoTOTP does not. Plus Google supports multiple concurrent 2FA tokens anyway.
- avodonosov 5y agoMultiple still tie user to specific devices. It will not work on a friends machine (unless user memorises the shared secret used for hashes). TOTP is essentially a glorified password (which is the shared secret), only so long that the user presumably does not remember it, so it is taken as a representation of a trusted device access. TOTP / HOTP are close to manual CHAP. I don't feel two passwords (the real password and TOTP shared secret) are better than one.
- l72 5y agoHow do I set up TOTP with Google? As far as I can tell, you first have to give them a mobile phone number and configure 2FA with that. Once it is configured, you can then change it to TOTP and remove your phone number. But I don't want to give Google my phone number in the first place.
- dmantis 5y agoIn my account I either see the option with "push notifications on your phone", usb dongle or SMS (security nightmare). I'm not against RFC'd TOTP , but is it possible with google?