4 ms·

Google's 2FA is dreadful. 2FA is a good idea when it's added with consent, but Google adds it behind your back in ways that are both infuriating and brain-dead.

Google's 2FA is dreadful. 2FA is a good idea when it's added with consent, but Google adds it behind your back in ways that are both infuriating and brain-dead. I've been caught out recently twice: once I was away on work and had to access my email. Google demanded that I verify it using my phone that I'd previously accessed my work email with. However, this phone was just a phone I use for development, had never had a sim card inserted, and was on my desk at home. I hadn't agreed that it should be used for 2FA. It was tremendously inconvenient because I needed to find where my hotel was. Another time recently I managed to destroy my phone in an accident and got the phone replaced. Despite taking the sim card from the old phone and putting it in the new one, doing a factory reset on the old one, and it not being active for a week, Google still demanded I 2FA authenticate on the old one. I feel these problems could have easily been avoided, but it's typical latter-day Google experience: a tin ear for the customer experience and a general attitude of automation knows better than users.

gigglesupstairs 4y ago
Apple does it too. I have three iPhones, one much older than the other two. Recently, in one of my new iPhones, Apple decided to ask me about my passcode I used in my “giggleupstairs’s iPhone” for some special verification scenario. Now, what? I have THREE iPhones, how will I remember which iPhone is this generic looking iPhone name referring to? I kept entering what I thought was the correct passcode for at least three times before realising what was happening. I shudder to think I could have ended up locking up my account like this.
- Sirened 4y ago
  fwiw, the passcode challenge is for decrypting your keychain. If you fail that, you lose your passwords and other E2E data, but for better or for worse, not that much stored stuff is E2E encrypted and so you don't lose too much. I don't know if it's still true, but a few years back if you lost everything (i.e. didn't know your passcodes, didn't have a device to approve the sign in from) you could still get back into your account by waiting two weeks and recreating your keychain. This also means that if you are ever away from the internet for two weeks and someone knows your password that they can jack your shit but that's quite the edge case imo.
kyle-rb 4y ago
Disclaimer: I work at Google. I've never seen this issue. I don't have 2FA enabled for any personal Google account. There are some dark patterns to try and get you to enable 2FA that I don't agree with, e.g. a big "add a phone number to your account" page after you log in, with a small "skip for now" button at the bottom.
- chimprich 4y ago
  This doesn't involve a phone number, and I haven't enabled 2FA either. This is a security check that's activated under some combination of unfamiliar location, WiFi network, or device. It requires you to confirm your identity by using the app. If you delve though GMail's settings, under "Sign-in and recovery": Trusted mobile devices Google can verify that it's you by sending sign-in notifications to a private phone or tablet. You can remove it in your recently used devices. There's no way to turn it off as far as I can see. You can remove a device from the authorised list, but that's not very helpful if you don't realise that it's been added. It's idiotic. It's essentially: "confirm that you're allowed to access your email by confirming that you already have access to your email".
- WaitWaitWha 4y ago
  Goog did it to me too. I was using a burner phone, and logged into the Goog account. Next thing I know, after I chucked the burner, Goog is demanding I authN using the burner phone. If you are wondering how I authenticated the first place onto the burner, I used TOTP, but she would not let me use it again; she wanted my burner.
icehawk 4y ago
Yeah I had a similar issue. I had TOTP 2FA set up on my google account, and connected an android phone to it purely to download something from the app store. Google then decided that it was going to ignore TOTP set up and prefer the "Trusted mobile device." In a way it actually made my account less secure, since that was a testing device and had no passcode on it.

gigglesupstairs 4y ago

Apple does it too. I have three iPhones, one much older than the other two. Recently, in one of my new iPhones, Apple decided to ask me about my passcode I used in my “giggleupstairs’s iPhone” for some special verification scenario. Now, what? I have THREE iPhones, how will I remember which iPhone is this generic looking iPhone name referring to? I kept entering what I thought was the correct passcode for at least three times before realising what was happening. I shudder to think I could have ended up locking up my account like this.

Sirened 4y ago
fwiw, the passcode challenge is for decrypting your keychain. If you fail that, you lose your passwords and other E2E data, but for better or for worse, not that much stored stuff is E2E encrypted and so you don't lose too much. I don't know if it's still true, but a few years back if you lost everything (i.e. didn't know your passcodes, didn't have a device to approve the sign in from) you could still get back into your account by waiting two weeks and recreating your keychain. This also means that if you are ever away from the internet for two weeks and someone knows your password that they can jack your shit but that's quite the edge case imo.

kyle-rb 4y ago

Disclaimer: I work at Google. I've never seen this issue. I don't have 2FA enabled for any personal Google account. There are some dark patterns to try and get you to enable 2FA that I don't agree with, e.g. a big "add a phone number to your account" page after you log in, with a small "skip for now" button at the bottom.

chimprich 4y ago
This doesn't involve a phone number, and I haven't enabled 2FA either. This is a security check that's activated under some combination of unfamiliar location, WiFi network, or device. It requires you to confirm your identity by using the app. If you delve though GMail's settings, under "Sign-in and recovery": Trusted mobile devices Google can verify that it's you by sending sign-in notifications to a private phone or tablet. You can remove it in your recently used devices. There's no way to turn it off as far as I can see. You can remove a device from the authorised list, but that's not very helpful if you don't realise that it's been added. It's idiotic. It's essentially: "confirm that you're allowed to access your email by confirming that you already have access to your email".
WaitWaitWha 4y ago
Goog did it to me too. I was using a burner phone, and logged into the Goog account. Next thing I know, after I chucked the burner, Goog is demanding I authN using the burner phone. If you are wondering how I authenticated the first place onto the burner, I used TOTP, but she would not let me use it again; she wanted my burner.

icehawk 4y ago

Yeah I had a similar issue. I had TOTP 2FA set up on my google account, and connected an android phone to it purely to download something from the app store. Google then decided that it was going to ignore TOTP set up and prefer the "Trusted mobile device." In a way it actually made my account less secure, since that was a testing device and had no passcode on it.