4 ms·
> It is possible to encourage 2FA but allow to opt out. You might be surprised to learn that this is how it works for Google accounts: it is default-on but you
by cmeacham98 4y ago
> It is possible to encourage 2FA but allow to opt out.
You might be surprised to learn that this is how it works for Google accounts: it is default-on but you can turn it off.
> If they at least would allow for a sufficient number of options. Like paper-tan (even self printed), yubikey or similar, second email address, an authenticator, ... but even big companies often only require a phone number.
You might be even more surprised to discover that all of these options are supported for Google accounts.
- valenterry 4y agoNot only have I not said that Google doesn't offer 2FA - yes they do. However, Google tries _very hard_ to prevent people from e.g. creating a gmail account without a phone number. Try it if you don't believe me.
- judge2020 4y agoI definitely vividly remember needing it a few years ago, but right now I can try to sign up and it says "Mobile Number (optional)" (Maybe that's based on some security heuristics).
- valenterry 4y agoYeah and it also only works on your phone (or if you know how to make Google think you are on your phone) and in certain countries. All to my knowledge and based on my tests.
- a_JIT_pie 4y agoI thought the same but I just tried on firefox desktop (Windows) and spun up a new google account with email, password, fake first+last name and fake bday. Really, I was expecting to be stopped at "Phone Number required" but it is indeed optional.
- nahkoots 4y agoI just did it from Firefox on Linux in a private tab near Washington, D.C.. Fake name, no phone, no backup email. I was able to log out, sign back in, and send an email without any trouble. No doubt they're letting me through because some security heuristic says I'm a real human, and I'm sure they'd eventually make me provide a number if I continued using the account (this happened to me with my university G Suite account a couple years ago and I needed to contact my IT department to manually disable the phone challenge), but so far I can't see any evidence that they're doing anything unreasonable. Perhaps they're requiring you to use a number because you've tested it a lot.
- valenterry 4y agoWe are talking about creating an new account, not about signing in.
- ranger_danger 4y agoGoogle only allows non-U2F 2FA methods (like TOTP) to be enabled AFTER enabling a hardware U2F device. And signing up without a working mobile number is impossible. Anyone who says that's not true hasn't actually tried in the last several years.
- nyuszika7h 4y agoI definitely had TOTP before I had U2F. I think you mean after enabling SMS 2FA, not U2F.
- ranger_danger 4y agoNope, while I also did have TOTP before U2F (because it wasn't even a thing then), the rules changed to where if you don't have a phone number on your account, then you're required to enroll a U2F device before you can turn on TOTP.
- exodust 4y agoCan't turn it off for Google Ads account any more. Won't let you in. This is a real pain for shared google account in a small team like ours. Sick of Google removing user choice. We all knew password, no problems at all. Now it mandates 2FA. And because they mandate it for Google Ads, now it's on for everything like Google Drive etc.