7 ms·

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=e

For the people that want to turn on two-factor authentication on their Gmail account, here's how to do it: http://support.google.com/accounts/bin/answer.py?hl=en&topic=1056283&answer=185839 http://support.google.com/accounts/bin/answer.py?hl=en&t... I highly recommend it. Some of the common misperceptions I see: Myth: But what if my cell phone doesn't have SMS/signal? Reality: You can install a standalone program called Google Authenticator, so your cell phone doesn't need a signal. Myth: Okay, but what about if my cell phone runs out of power (added: or my phone is stolen)? Reality: You can print out a small piece of paper with 10 one-time rescue codes and put that in your wallet. Myth: Don't I have to fiddle with an extra PIN every time I log in? Reality: You can tell Google to trust your computer for 30 days and maybe even longer. Myth: I heard two-factor authentication doesn't work with POP and IMAP? Reality: You can still use two-factor authentication even with POP and IMAP. You create a special "application-specific password" that your mail client can use instead of your regular password. You can revoke application-specific passwords at any time. Myth: Okay, but what if I want to verify how secure Google Authenticator is? Reality: Google Authenticator is open-source: http://code.google.com/p/google-authenticator/ http://code.google.com/p/google-authenticator/ Hmm. Maybe I should throw this up on my blog too.

almost 14y ago
Well that answered all my misgivings about 2 factor with Gmail. I'm setting it up now. Thanks!
xmpir 14y ago
convinced - i will set it up in a minute :)
danielpal 14y ago
Although enabling two-factor auth in gmail is great, I still fail to see how it would have protected his iCloud account. Sure his gmail account wouldn't have been compromised, but what about his his iCloud and twitter?. Why doesn't apple and twitter provide two-factor authentication? Why doesn't everyone do it this days?
- nilsbunger 14y ago
  Good point. But even two-factor auth wouldn't have saved him because the hacker got the customer support people to issue a temporary password. Apple (and others) need to implement better controls on how you reestablish identity once you've lost access.
  - majelix 14y ago
    Que the "Apple locked me out of my OWN DATA!" screed in 3, 2, ...
  - jcheng 14y ago
    Wouldn't the hacker still need the temporary password AND the Google Authenticator code? Or are you assuming that the customer support people could and would turn off two-factor auth while resetting the password?
    - nilsbunger 14y ago
      Yes I'm assuming I call a company having lost all access. Would a company have a different way of establishing identity for someone who lost all access if they've implemented TFA?
- Matt_Cutts 14y ago
  Two-factor Google authentication would have had two benefits. First, the Gmail and Twitter accounts wouldn't have been hacked. Secondly, the Wired article made this claim: "Because I didn’t have Google’s two-factor authentication turned on, when Phobia entered my Gmail address, he could view the alternate e-mail I had set up for account recovery. Google partially obscures that information, starring out many characters, but there were enough characters available, m••••n@me.com." I don't know for sure whether that's true or not. But assume it is true. If two-factor authentication had been enabled, then the hackers would have had a much harder time guessing Mat's email address for iCloud and whether he had a @me.com email address at all.
  - 14y ago
jrockway 14y ago
Have you encountered any other sites that allow you to use Google Authenticator to generate OTPs? Part of the reason I think two-factor authentication is a usability burden is because each "identity provider" wants to use its own protocol. Google uses an Android app. PayPal sent me a card. My brokerage has a keychain token available. Other companies use a "soft" RSA token that runs on Windows. But if everyone agreed on a protocol, then I could have everything in one place, which would make two factor authentication significantly more enjoyable to use. (I know there are standards: the question is, who other than Google follows them? :)
- nilsbunger 14y ago
  Amazon AWS supports the google authenticator app. It is an open standard protocol, but I don't know in practice how many companies have compatible implementations.
- danielpal 14y ago
  A lot of the tokens(Google Auth included) follow http://www.ietf.org/rfc/rfc4226.txt http://www.ietf.org/rfc/rfc4226.txt. Problem is everyone has a different way of provisioning the secure key. Some of which are unsafe (I am looking at you Google Authenticator!. Yes a qrcode is kool idea but theres no guarantee that you are the only one who provisions the key using the image.) I designed Authy with that in mind. I wanted a way to have a 1 token for all accounts. Maybe we will add support for Google Authenticator, so you could import your Google Auth token into the app.
- tytso 14y ago
  Lastpass also uses Google Authenticator. You can get server-side code so you can use Google Authenticator on your own server, or use it to offer two-factor authentication to a web service you are running. It's an open protocol, with an open source implementation. All you have to use it.
- Matt_Cutts 14y ago
  Good question. I have seen http://drupal.org/project/ga_login http://drupal.org/project/ga_login for Drupal, for example. Likewise, here's a write-up about using a YubiKey with Gmail's two-factor authentication: http://static.yubico.com/var/uploads/pdfs/Howto_GmailYubiKey.pdf http://static.yubico.com/var/uploads/pdfs/Howto_GmailYubiKey... I believe Google Authenticator is based on open standards and open source, so people could standardize on it if they wanted too.
SCdF 14y ago
Myth: Right, but what happens in the very common scenario of my Android phone-- logged into Google with the Authenticator installed-- getting lost / stolen? Surely then 2-factor auth is basically useless? (insert your answer below)
- grey413 14y ago
  I just set up 2-factor auth 1) You still need to enter your password every time you log in. 2) You can add backup phones that can be called/texted with the verification codes 3) You can print out back-up codes that will always work (once) 4) If your phone is stolen and is using an application-specific password, you can revoke that password for that application.
- rblackwater 14y ago
  You should be using POP or IMAP only on your phone so that you can revoke permission after it is stolen (when you log in to your account from a desktop and use a backup key from the printout). If you are logged in to your main Google account on your phone you are asking for trouble. While I will be sympathetic after it gets stolen and someone ruins your life, I won't be surprised.
  - ikonst 14y ago
    If you're logged into your Google account from your Android, it's roughly the same amount of control as an IMAP account would give. They can wreck havoc, but they cannot change your password and steal your account.
- Matt_Cutts 14y ago
  I think the answer is that you can print out one-time codes on paper and put them into your wallet. I would also recommend putting an unlock pattern on your phone to protect in case your phone is stolen.
- rgrw 14y ago
  Reality: You go into Google account security and choose 'Clear the phone info and printable codes' and 'Forget all other trusted computers. Require a verification code the next time I log in from any other computer'.
kmm 14y ago
There's something that bugged me about two-factor the moment I activated it. The application specific passwords are stored in plain-text. How does Google know that it's actually e.g. Chrome accessing my mail with a given application-specific password? If a hacker gets a hold of an old backup of mine, which includes a Pidgin configuration file I forgot to delete, which holds a plaintext password, can he get into my account with that?
- tnorthcutt 14y ago
  Are you asking if a hacker could use the application-specific password to access your email account? I'm pretty sure the application-specific passwords are only good for the service using them (e.g. the first service to use a newly generated password is the only one allowed to ever use it), but that would be trivial to test for yourself.
  - gsa 14y ago
    I just used the same password to login to my Talk account in Pidgin and later for my Android. This is really insecure, especially when Pidgin saves passwords in plain text.
    - pseudonym 14y ago
      You're perfectly welcome to use the same password multiple times-- it's as secure as you yourself make it. When Google generates an App password, it displays it once-- and then trashes it. On that same page is a list of the identifiers you've given all of your apps, and the last time that identifier's password was used to log into your account. At any point, you can trash a generated password, and anything using that password can't log into your account anymore. If you use the same generated password for every application, then you're not in that much better a situation than you would be otherwise. If you use different identifiers for each application, you can identify exactly where a breach happened from by last login time, and disable that password entirely.
      - gsa 14y ago
mike_esspe 14y ago
What if i lost my phone and didn't print backup codes? Will i lose my google account forever?
- rsingel 14y ago
  There are other backup measures, including a trusted friend's phone as backup. But being totally locked out is a feature, not a bug.
- nodata 14y ago
  Yes. The aim is that someone without authentication can't get into your account.
- maxerickson 14y ago
  If you regain control of the phone number before someone finds the phone and uses it to seize control of the Google account, you wouldn't lose anything more than the phone.
tdavis 14y ago
I was reluctant to setup two-factor for a long time, perceiving it to be an unnecessary hassle. Then somebody tried to gain access to some of my accounts through my Apple ID. They were unsuccessful (I don't have any common passwords these days so managing to send a password reset to my GMail wasn't terribly helpful) but it certainly made me paranoid enough to switch. I currently have two-factor setup on two accounts. I won't say there's no hassle involved--authorizing a machine via SMS so that I can login and generate an app-specific password is a chore--but the peace of mind is well worth the hassle. Did you also know that you can re-assign your Apple ID to an existing e-mail address? Like, say, one you have two-factor enabled for? Now people can socially engineer Apple's flawed policy all day but they'll need to steal my phone, too. EDIT: Also, if you don't have backups, you might as well just delete everything yourself right now and use that as motivation to prevent the same thing from happening again. Hackers, tornadoes, spontaneous combustion and ghosts are all conspiring to destroy your data sooner or later.
- dieordigg 14y ago
  One great Pic which I like from this article: http://goo.gl/fWpqd http://goo.gl/fWpqd
- fullfilldreams 14y ago
  http://goo.gl/fWpqd http://goo.gl/fWpqd
inflatablenerd 14y ago
"Myth: I've heard two factor authentication doesn't work in IMAP and POP" I've found this to be true - to a certain extent. I had two factor authentication turned on and found it to be a nightmare in OSX Mail. Failures to retrieve mail, asking for my password constantly, etc. I was resetting the application passwords every two days. I tried to research a fix, but in the end it became less of a hassle just to turn it off and have my email work 100% of the time. It's probably a bug in Mail.app in Lion, but I can't say my experiences with two factor auth have been positive.
- alastair 14y ago
  Make sure you're using an application-specific password for any application that doesn't support two factor authentication - eg, Mail.app on Lion. Thats what they're for.
- DigitalJack 14y ago
  I remember having to generate the 2 or 3 times, but it did eventually work for me, on several gmail accounts. That is with both Lion and Mountain Lion.
- pooriaazimi 14y ago
  Definitely a bug in Mail.app, not 2FA. I had no problem with 2-way on IMAP on Lion, Mountain Lion, iOS 5 or iOS 6. But as I use Mail.app constantly I can assure you that it's desperately buggy. At times I had it laying around downloading gigabytes and gigabytes of Gmail mail again and again and again until I took pity and kill it.
harshreality 14y ago
http://code.google.com/p/google-authenticator/issues/detail?id=118 http://code.google.com/p/google-authenticator/issues/detail?... The inflexible account ordering in Authenticator is bugging me, since I recently added a 5th account (not 5 google accounts) and my phone only shows 4 at a time. I don't know if you have any influence over the people maintaining the app, but it looks trivial to fix, given the comments.
- Matt_Cutts 14y ago
  That's good feedback--I'll pass it on.
Kerrick 14y ago
I was wary to set up 2FA until I learned that you can set it up even without a cellphone or your own computer. You can have the second factor be a voice call, so it can call a landline or dumbphone without an SMS plan. Plus, if you ever lose your phone or cancel your number, you can set up backup phone numbers. I set up my fiancee's phone number as a backup number in case I ever lose my phone.
- einhverfr 14y ago
  How well does this work if you are in, say, South-east Asia?
  - eblade 14y ago
    I am in Singapore and have been using it for a couple of months now. Works great.
  - sondh 14y ago
    I have been using it in Vietnam for over a year without any major problems and I have suggested a few family members (who are not tech savvy at all) to use it too. The app works very good on both Android and iOS (I personally use the iOS app because I flashed new ROM all the time and sometimes Titanium Backup of the app doesn't work). I tried the SMS a few times, the message normally arrives within one minute.
- bigiain 14y ago
  Someone big got hacked this way recently - the attacker managed to social-engineer a call forwarding change, then used a "landline 2FA auth call" to gain the foothold then needed. (I think it was Cloudflare?) It's similar to @mat's problem - Amazon assumed the CC last 4 digits was "non identifying", Apple assumed they were. How much effort do you suppose your phone company expends securing your voicemail or call forwarding? I'll bet it's less than would be considered "industry best practice" for securing your corporate dns records…
  - mirkules 14y ago
tedunangst 14y ago
Not quite the same as two factor auth (almost the opposite in fact), but I was extremely annoyed when gmail started relentlessly asking me to add a backup email address for password resets. Had the author not had an insecure backup email address, this wouldn't have happened either. Of all the passwords I'm likely to forget, gmail ranks near the bottom. The password to login to who knows where to get the gmail recovery email? The top.
- pooriaazimi 14y ago
  That's absolutely true. I was horrified last week when I discovered my Gmail account (with a unique 30-character long password, 2-factor enabled, NEVER used unless on my MacBook at my house) had a "backup" email address to my Yahoo account from 8 years ago, with the nice password '1123581321'. I could've killed myself.
  - 385668 14y ago
    That's amazing. I've got the same combination on my luggage.
beambot 14y ago
There seems to be something funky with "application-specific passwords" (ASP) on Chrome. Let me explain the problem (that I documented to a friend ~1 month ago): I just revoked all Google Chrome keys, cleared out all of my history / cookies / passwords / forms, etc. I went to a different computer that had previously had Chrome synced using ASP, switched to my account, and went to settings. At the top, I get this error message: "Account sign-in details are out of date. Sign in again" That's good since ASP was revoked. But then I go down to advanced settings => passwords, and they're all still visible?!?! That's just WRONG! If the ASP login credentials have been revoked, access to all locally stored passwords need to be revoked too! Any idea what's going on? This seems like a flaw. The 2-factor authentication is still great though.
- deleted 14y ago
  [deleted]
- pooriaazimi 14y ago
  Did you also file it with Google? Definitely a nasty bug in implementation.
  - beambot 14y ago
    The friend was a GOOG employee, but not a member of the Chrome team. Indeed, I should file an official bug report... but the Matt Cutts bug reporting system is usually so much more responsive. ;-)
chmars 14y ago
Why do you use the term 'application-specific passwords' although these passwords are not application-specific at all? They are Google-generated passwords with a user label. And if you use 2-factor authentication, they are the weakest link in the chain since they provide full access to a google account except for access vectors with 2-factor authentication. In addition, every app can use such a password, not just the app you created the password for … 2-factor authentication is great and certainly recommendable but you should not fool users by using the false term 'application-specific passwords'. In addition, more complex Google-generated password would be appreciated.
- odiroot 14y ago
  Application-specific is just a friendly name. Also this password doesn't give you full access to your Google account. You cannot log into Google web apps this way (AFAIR). Thus you won't be able to mess with account settings (passwords etc). Before you can change critical account settings Google asks you to provide your traditional password again. Your comment is a bit harsh if not FUD.
  - chmars 14y ago
    'Application-specific' is IMHO not just a friendly but a misleading name. They are simply not application-specific. Using one of these so-called application-specific passwords, you can delete calendars, mails and contacts. That is critical enough for most users. An additional concern is the usual 30-day authorization you give in order to avoid entering your 2-factor token again and again. Is there any way to de-authorize such a 30-day authorization? Anyway, I don't rule out that my perspective might be too strict. For must users, the whole Google 2-step authentication system is probably a very important step towards improved security.
karlb 14y ago
Matt, your list of objections and counter-objections is great – too good to be hidden away in a Hacker News comment thread and on your blog. It belongs somewhere within the sign-up flow itself: http://support.google.com/accounts/bin/topic.py?hl=en&topic=28786&parent=2373945&ctx=topic http://support.google.com/accounts/bin/topic.py?hl=en&to...
SquareWheel 14y ago
I've tried turning it on multiple times by using an iPod Touch, but I can't figure it out. The support article says the device is supported but the actual page only asks me for a phone number. Either I'm being obtuse or the steps for non-phone users aren't very clear.
saint-loup 14y ago
There's no Google Authenticator for Windows Phone, but there's an equivalent: http://www.windowsphone.com/en-US/apps/021dd79f-0598-e011-986b-78e7d1fa76f8 http://www.windowsphone.com/en-US/apps/021dd79f-0598-e011-98...
romaniv 14y ago
Sounds like a lot of effort, or at least a lot of things to consider. I wonder how many people were completely locked out of their accounts because they enabled 2-factor auth and didn't do all the right things. The root problem in this story is that things are just too damn interconnected these days. And we're encourage to interconnect them even further (using cellphones to authenticate email, in this case). Edit: I think that my reply is not harsh enough. After reading the comments more closely, I see that this a typical IT response to IT failure. 1. Ignore the root cause. (Interconnectedness.) 2. Blame the user. (Implicitly, for not enabling two-factor auth.) 3. Suggest a workaround and dismiss any concerns real-life scenarios. (E.g. loosing your wallet and cellphone in an emergency. Emergencies like that happen more often that you'd think.) 4. Feel smug.

almost 14y ago

Well that answered all my misgivings about 2 factor with Gmail. I'm setting it up now. Thanks!

xmpir 14y ago

convinced - i will set it up in a minute :)

danielpal 14y ago

Although enabling two-factor auth in gmail is great, I still fail to see how it would have protected his iCloud account. Sure his gmail account wouldn't have been compromised, but what about his his iCloud and twitter?. Why doesn't apple and twitter provide two-factor authentication? Why doesn't everyone do it this days?

nilsbunger 14y ago
Good point. But even two-factor auth wouldn't have saved him because the hacker got the customer support people to issue a temporary password. Apple (and others) need to implement better controls on how you reestablish identity once you've lost access.
- majelix 14y ago
  Que the "Apple locked me out of my OWN DATA!" screed in 3, 2, ...
- jcheng 14y ago
  Wouldn't the hacker still need the temporary password AND the Google Authenticator code? Or are you assuming that the customer support people could and would turn off two-factor auth while resetting the password?
  - nilsbunger 14y ago
    Yes I'm assuming I call a company having lost all access. Would a company have a different way of establishing identity for someone who lost all access if they've implemented TFA?
Matt_Cutts 14y ago
Two-factor Google authentication would have had two benefits. First, the Gmail and Twitter accounts wouldn't have been hacked. Secondly, the Wired article made this claim: "Because I didn’t have Google’s two-factor authentication turned on, when Phobia entered my Gmail address, he could view the alternate e-mail I had set up for account recovery. Google partially obscures that information, starring out many characters, but there were enough characters available, m••••n@me.com." I don't know for sure whether that's true or not. But assume it is true. If two-factor authentication had been enabled, then the hackers would have had a much harder time guessing Mat's email address for iCloud and whether he had a @me.com email address at all.
- 14y ago

jrockway 14y ago

Have you encountered any other sites that allow you to use Google Authenticator to generate OTPs? Part of the reason I think two-factor authentication is a usability burden is because each "identity provider" wants to use its own protocol. Google uses an Android app. PayPal sent me a card. My brokerage has a keychain token available. Other companies use a "soft" RSA token that runs on Windows. But if everyone agreed on a protocol, then I could have everything in one place, which would make two factor authentication significantly more enjoyable to use. (I know there are standards: the question is, who other than Google follows them? :)

nilsbunger 14y ago
Amazon AWS supports the google authenticator app. It is an open standard protocol, but I don't know in practice how many companies have compatible implementations.
danielpal 14y ago
A lot of the tokens(Google Auth included) follow http://www.ietf.org/rfc/rfc4226.txt http://www.ietf.org/rfc/rfc4226.txt. Problem is everyone has a different way of provisioning the secure key. Some of which are unsafe (I am looking at you Google Authenticator!. Yes a qrcode is kool idea but theres no guarantee that you are the only one who provisions the key using the image.) I designed Authy with that in mind. I wanted a way to have a 1 token for all accounts. Maybe we will add support for Google Authenticator, so you could import your Google Auth token into the app.
tytso 14y ago
Lastpass also uses Google Authenticator. You can get server-side code so you can use Google Authenticator on your own server, or use it to offer two-factor authentication to a web service you are running. It's an open protocol, with an open source implementation. All you have to use it.
Matt_Cutts 14y ago
Good question. I have seen http://drupal.org/project/ga_login http://drupal.org/project/ga_login for Drupal, for example. Likewise, here's a write-up about using a YubiKey with Gmail's two-factor authentication: http://static.yubico.com/var/uploads/pdfs/Howto_GmailYubiKey.pdf http://static.yubico.com/var/uploads/pdfs/Howto_GmailYubiKey... I believe Google Authenticator is based on open standards and open source, so people could standardize on it if they wanted too.

SCdF 14y ago

Myth: Right, but what happens in the very common scenario of my Android phone-- logged into Google with the Authenticator installed-- getting lost / stolen? Surely then 2-factor auth is basically useless? (insert your answer below)

grey413 14y ago
I just set up 2-factor auth 1) You still need to enter your password every time you log in. 2) You can add backup phones that can be called/texted with the verification codes 3) You can print out back-up codes that will always work (once) 4) If your phone is stolen and is using an application-specific password, you can revoke that password for that application.
rblackwater 14y ago
You should be using POP or IMAP only on your phone so that you can revoke permission after it is stolen (when you log in to your account from a desktop and use a backup key from the printout). If you are logged in to your main Google account on your phone you are asking for trouble. While I will be sympathetic after it gets stolen and someone ruins your life, I won't be surprised.
- ikonst 14y ago
  If you're logged into your Google account from your Android, it's roughly the same amount of control as an IMAP account would give. They can wreck havoc, but they cannot change your password and steal your account.
Matt_Cutts 14y ago
I think the answer is that you can print out one-time codes on paper and put them into your wallet. I would also recommend putting an unlock pattern on your phone to protect in case your phone is stolen.
rgrw 14y ago
Reality: You go into Google account security and choose 'Clear the phone info and printable codes' and 'Forget all other trusted computers. Require a verification code the next time I log in from any other computer'.

kmm 14y ago

There's something that bugged me about two-factor the moment I activated it. The application specific passwords are stored in plain-text. How does Google know that it's actually e.g. Chrome accessing my mail with a given application-specific password? If a hacker gets a hold of an old backup of mine, which includes a Pidgin configuration file I forgot to delete, which holds a plaintext password, can he get into my account with that?

tnorthcutt 14y ago
Are you asking if a hacker could use the application-specific password to access your email account? I'm pretty sure the application-specific passwords are only good for the service using them (e.g. the first service to use a newly generated password is the only one allowed to ever use it), but that would be trivial to test for yourself.
- gsa 14y ago
  I just used the same password to login to my Talk account in Pidgin and later for my Android. This is really insecure, especially when Pidgin saves passwords in plain text.
  - pseudonym 14y ago
    You're perfectly welcome to use the same password multiple times-- it's as secure as you yourself make it. When Google generates an App password, it displays it once-- and then trashes it. On that same page is a list of the identifiers you've given all of your apps, and the last time that identifier's password was used to log into your account. At any point, you can trash a generated password, and anything using that password can't log into your account anymore. If you use the same generated password for every application, then you're not in that much better a situation than you would be otherwise. If you use different identifiers for each application, you can identify exactly where a breach happened from by last login time, and disable that password entirely.
    - gsa 14y ago

mike_esspe 14y ago

What if i lost my phone and didn't print backup codes? Will i lose my google account forever?

rsingel 14y ago
There are other backup measures, including a trusted friend's phone as backup. But being totally locked out is a feature, not a bug.
nodata 14y ago
Yes. The aim is that someone without authentication can't get into your account.
maxerickson 14y ago
If you regain control of the phone number before someone finds the phone and uses it to seize control of the Google account, you wouldn't lose anything more than the phone.

tdavis 14y ago

I was reluctant to setup two-factor for a long time, perceiving it to be an unnecessary hassle. Then somebody tried to gain access to some of my accounts through my Apple ID. They were unsuccessful (I don't have any common passwords these days so managing to send a password reset to my GMail wasn't terribly helpful) but it certainly made me paranoid enough to switch. I currently have two-factor setup on two accounts. I won't say there's no hassle involved--authorizing a machine via SMS so that I can login and generate an app-specific password is a chore--but the peace of mind is well worth the hassle. Did you also know that you can re-assign your Apple ID to an existing e-mail address? Like, say, one you have two-factor enabled for? Now people can socially engineer Apple's flawed policy all day but they'll need to steal my phone, too. EDIT: Also, if you don't have backups, you might as well just delete everything yourself right now and use that as motivation to prevent the same thing from happening again. Hackers, tornadoes, spontaneous combustion and ghosts are all conspiring to destroy your data sooner or later.

dieordigg 14y ago
One great Pic which I like from this article: http://goo.gl/fWpqd http://goo.gl/fWpqd
fullfilldreams 14y ago
http://goo.gl/fWpqd http://goo.gl/fWpqd

inflatablenerd 14y ago

"Myth: I've heard two factor authentication doesn't work in IMAP and POP" I've found this to be true - to a certain extent. I had two factor authentication turned on and found it to be a nightmare in OSX Mail. Failures to retrieve mail, asking for my password constantly, etc. I was resetting the application passwords every two days. I tried to research a fix, but in the end it became less of a hassle just to turn it off and have my email work 100% of the time. It's probably a bug in Mail.app in Lion, but I can't say my experiences with two factor auth have been positive.

alastair 14y ago
Make sure you're using an application-specific password for any application that doesn't support two factor authentication - eg, Mail.app on Lion. Thats what they're for.
DigitalJack 14y ago
I remember having to generate the 2 or 3 times, but it did eventually work for me, on several gmail accounts. That is with both Lion and Mountain Lion.
pooriaazimi 14y ago
Definitely a bug in Mail.app, not 2FA. I had no problem with 2-way on IMAP on Lion, Mountain Lion, iOS 5 or iOS 6. But as I use Mail.app constantly I can assure you that it's desperately buggy. At times I had it laying around downloading gigabytes and gigabytes of Gmail mail again and again and again until I took pity and kill it.

harshreality 14y ago

http://code.google.com/p/google-authenticator/issues/detail?id=118 http://code.google.com/p/google-authenticator/issues/detail?... The inflexible account ordering in Authenticator is bugging me, since I recently added a 5th account (not 5 google accounts) and my phone only shows 4 at a time. I don't know if you have any influence over the people maintaining the app, but it looks trivial to fix, given the comments.

Matt_Cutts 14y ago
That's good feedback--I'll pass it on.

Kerrick 14y ago

I was wary to set up 2FA until I learned that you can set it up even without a cellphone or your own computer. You can have the second factor be a voice call, so it can call a landline or dumbphone without an SMS plan. Plus, if you ever lose your phone or cancel your number, you can set up backup phone numbers. I set up my fiancee's phone number as a backup number in case I ever lose my phone.

einhverfr 14y ago
How well does this work if you are in, say, South-east Asia?
- eblade 14y ago
  I am in Singapore and have been using it for a couple of months now. Works great.
- sondh 14y ago
  I have been using it in Vietnam for over a year without any major problems and I have suggested a few family members (who are not tech savvy at all) to use it too. The app works very good on both Android and iOS (I personally use the iOS app because I flashed new ROM all the time and sometimes Titanium Backup of the app doesn't work). I tried the SMS a few times, the message normally arrives within one minute.
bigiain 14y ago
Someone big got hacked this way recently - the attacker managed to social-engineer a call forwarding change, then used a "landline 2FA auth call" to gain the foothold then needed. (I think it was Cloudflare?) It's similar to @mat's problem - Amazon assumed the CC last 4 digits was "non identifying", Apple assumed they were. How much effort do you suppose your phone company expends securing your voicemail or call forwarding? I'll bet it's less than would be considered "industry best practice" for securing your corporate dns records…
- mirkules 14y ago

tedunangst 14y ago

Not quite the same as two factor auth (almost the opposite in fact), but I was extremely annoyed when gmail started relentlessly asking me to add a backup email address for password resets. Had the author not had an insecure backup email address, this wouldn't have happened either. Of all the passwords I'm likely to forget, gmail ranks near the bottom. The password to login to who knows where to get the gmail recovery email? The top.

pooriaazimi 14y ago
That's absolutely true. I was horrified last week when I discovered my Gmail account (with a unique 30-character long password, 2-factor enabled, NEVER used unless on my MacBook at my house) had a "backup" email address to my Yahoo account from 8 years ago, with the nice password '1123581321'. I could've killed myself.
- 385668 14y ago
  That's amazing. I've got the same combination on my luggage.

beambot 14y ago

There seems to be something funky with "application-specific passwords" (ASP) on Chrome. Let me explain the problem (that I documented to a friend ~1 month ago): I just revoked all Google Chrome keys, cleared out all of my history / cookies / passwords / forms, etc. I went to a different computer that had previously had Chrome synced using ASP, switched to my account, and went to settings. At the top, I get this error message: "Account sign-in details are out of date. Sign in again" That's good since ASP was revoked. But then I go down to advanced settings => passwords, and they're all still visible?!?! That's just WRONG! If the ASP login credentials have been revoked, access to all locally stored passwords need to be revoked too! Any idea what's going on? This seems like a flaw. The 2-factor authentication is still great though.

deleted 14y ago
[deleted]
pooriaazimi 14y ago
Did you also file it with Google? Definitely a nasty bug in implementation.
- beambot 14y ago
  The friend was a GOOG employee, but not a member of the Chrome team. Indeed, I should file an official bug report... but the Matt Cutts bug reporting system is usually so much more responsive. ;-)

chmars 14y ago

Why do you use the term 'application-specific passwords' although these passwords are not application-specific at all? They are Google-generated passwords with a user label. And if you use 2-factor authentication, they are the weakest link in the chain since they provide full access to a google account except for access vectors with 2-factor authentication. In addition, every app can use such a password, not just the app you created the password for … 2-factor authentication is great and certainly recommendable but you should not fool users by using the false term 'application-specific passwords'. In addition, more complex Google-generated password would be appreciated.

odiroot 14y ago
Application-specific is just a friendly name. Also this password doesn't give you full access to your Google account. You cannot log into Google web apps this way (AFAIR). Thus you won't be able to mess with account settings (passwords etc). Before you can change critical account settings Google asks you to provide your traditional password again. Your comment is a bit harsh if not FUD.
- chmars 14y ago
  'Application-specific' is IMHO not just a friendly but a misleading name. They are simply not application-specific. Using one of these so-called application-specific passwords, you can delete calendars, mails and contacts. That is critical enough for most users. An additional concern is the usual 30-day authorization you give in order to avoid entering your 2-factor token again and again. Is there any way to de-authorize such a 30-day authorization? Anyway, I don't rule out that my perspective might be too strict. For must users, the whole Google 2-step authentication system is probably a very important step towards improved security.

karlb 14y ago

Matt, your list of objections and counter-objections is great – too good to be hidden away in a Hacker News comment thread and on your blog. It belongs somewhere within the sign-up flow itself: http://support.google.com/accounts/bin/topic.py?hl=en&topic=28786&parent=2373945&ctx=topic http://support.google.com/accounts/bin/topic.py?hl=en&to...

SquareWheel 14y ago

I've tried turning it on multiple times by using an iPod Touch, but I can't figure it out. The support article says the device is supported but the actual page only asks me for a phone number. Either I'm being obtuse or the steps for non-phone users aren't very clear.

saint-loup 14y ago

There's no Google Authenticator for Windows Phone, but there's an equivalent: http://www.windowsphone.com/en-US/apps/021dd79f-0598-e011-986b-78e7d1fa76f8 http://www.windowsphone.com/en-US/apps/021dd79f-0598-e011-98...

romaniv 14y ago

Sounds like a lot of effort, or at least a lot of things to consider. I wonder how many people were completely locked out of their accounts because they enabled 2-factor auth and didn't do all the right things. The root problem in this story is that things are just too damn interconnected these days. And we're encourage to interconnect them even further (using cellphones to authenticate email, in this case). Edit: I think that my reply is not harsh enough. After reading the comments more closely, I see that this a typical IT response to IT failure. 1. Ignore the root cause. (Interconnectedness.) 2. Blame the user. (Implicitly, for not enabling two-factor auth.) 3. Suggest a workaround and dismiss any concerns real-life scenarios. (E.g. loosing your wallet and cellphone in an emergency. Emergencies like that happen more often that you'd think.) 4. Feel smug.