[HN Gopher] Google introduces mandatory 2-Step Verification for ...
       ___________________________________________________________________
        
       Google introduces mandatory 2-Step Verification for Google Accounts
        
       Author : vezycash
       Score  : 143 points
       Date   : 2021-11-03 14:13 UTC (8 hours ago)
        
 (HTM) web link (trustcoyote.com)
 (TXT) w3m dump (trustcoyote.com)
        
       | [deleted]
        
       | avodonosov wrote:
       | How annoying, in particular that service providers expect me to
       | have a mobile phone and that the phone represents me (can not be
       | lost, etc)
        
         | ziml77 wrote:
         | They don't think the phone represents you. But the combination
         | of proving you know the password and that you have physical
         | access to a trusted device increases the confidence that it's
         | you by a lot.
         | 
         | Depending on the form of second factor you use, it can stop
         | phishing attacks (and don't say you'll never fall for one,
         | anyone can make a mistake). The "send a notification" option
         | for 2FA gives you information about where the login request is
         | coming from, which is a chance to check that someone isn't
         | sitting in the middle of login process. And something like
         | WebAuthn makes phishing impossible outside of a browser exploit
         | since the domains won't match.
        
         | andrewzah wrote:
         | You can lose the phone, just use your backup codes. Bitwarden
         | supports otp and you can use that from any browser.
        
           | browningstreet wrote:
           | I'm a technical person and I have no idea what your post
           | means... and I also need to figure this out and explain it to
           | the rest of my (extended) family.
           | 
           | Google Accounts are the new printers, familial-y speaking.
        
             | andrewzah wrote:
             | One common 2FA method is TOTP (time-based, one time
             | password). Bitwarden [0] is a password/secrets manager that
             | you can host yourself. It supports TOTP so you can just use
             | that instead of a separate app like Google Authenticator or
             | Authy. I would not recommend this personally as if you
             | expose your master password for bitwarden, you've also made
             | it possible for the attacker to sign in via 2FA... which
             | normally would require access to your phone or backup keys.
             | But it is more convenient.
             | 
             | Basically, people should be using password managers by this
             | point. I recommend bitwarden because you can host it
             | yourself, it's good for storing other secrets, and it has
             | browser plugins/apps.
             | 
             | [0]: https://bitwarden.com/
        
               | browningstreet wrote:
               | Thanks for the explanation.
               | 
               | Follow-up question: I downloaded Authy on my phone and my
               | desktop, and the first thing it wants is a phone number.
               | I'm trying to solve for not having a phone -- can
               | Bitwarden's TOTP be used without a phone number being
               | provided?
               | 
               | Thanks in advance.
        
               | PufPufPuf wrote:
               | Bitwarden does not require a phone, but it sadly TOTP
               | support is only in the paid version. What I do is keep
               | TOTP in an app called Aegis, which supports backing up
               | the seeds. This way, I can always use the seed file to
               | setup Aegis on a new device.
        
               | andrewzah wrote:
               | TOTP support is free if you selfhost it, e.g. with
               | Vaultwarden [0].
               | 
               | 0: https://github.com/dani-garcia/vaultwarden
        
         | derekp7 wrote:
         | You don't need a mobile phone for TOTP -- you can do it from a
         | shell script and openssl. Many security keys support storing
         | TOTP built in, and Google also supports the various security
         | key protocols (FIDO2 I think is the current version?)
        
           | [deleted]
        
           | dane-pgp wrote:
           | I should point out that FIDO2 allows sites to require that
           | visitors use a device from a specific whitelist of
           | devices.[0] Google has already tightened the requirements by
           | mandating 2FA, so don't be surprised when they start blocking
           | "insecure" factors like shell scripts.
           | 
           | It probably wouldn't go down well if Google required an
           | Android device to provide the second factor, but I could
           | definitely see them requiring a device which does biometric
           | verification of the user. That's a pretty good way of
           | connecting online activity to a specific human (assuming the
           | attacker can gain physical access to your authentication
           | device, and has a model of your fingerprint/face, which
           | governments increasingly do have).
           | 
           | [0] https://developers.yubico.com/WebAuthn/WebAuthn_Developer
           | _Gu...
        
         | scrollaway wrote:
         | Google doesn't, they still allow you to use TOTP 2FA.
        
         | Someone1234 wrote:
         | You don't have to use a mobile phone/SMS for Google 2FA. You
         | can use:
         | 
         | - Hardware key (fido u2f).
         | 
         | - TOTP or HOTP generator (on any platform, PC, Mac, iOS,
         | Android, whatever).
         | 
         | - Trusted Device.
        
           | [deleted]
        
             | [deleted]
        
           | l72 wrote:
           | How do I set up TOTP with Google? As far as I can tell, you
           | first have to give them a mobile phone number and configure
           | 2FA with that. Once it is configured, you can then change it
           | to TOTP and remove your phone number. But I don't want to
           | give Google my phone number in the first place.
        
           | avodonosov wrote:
           | In all those cases the user needs a device for auth
        
             | Someone1234 wrote:
             | You also need a device for logging into a Google Account at
             | all. These can be the same device.
        
               | avodonosov wrote:
               | With password I can login from any device (guest session
               | on a friend's laptop, etc). So I am independent of a
               | specific device.
               | 
               | The second factor ties me to a specific device.
        
               | Someone1234 wrote:
               | TOTP does not. Plus Google supports multiple concurrent
               | 2FA tokens anyway.
        
         | UncleMeat wrote:
         | This is only rolling out to people who _already_ have devices
         | attached to Google services.
        
         | q1w2 wrote:
         | While I agree with your general point about the pressure to
         | link accounts to phone numbers...
         | 
         | The post specifically states that there are other forms of 2FA,
         | including token based.
        
       | 04rob wrote:
       | Is this really "mandatory" or rather just "opt-out?" My
       | understanding is that it can still be disabled...
        
       | g42gregory wrote:
       | This spells the end of privacy on the Internet. Your phone 100%
       | identifies you. Plus, if you lose it, you may lose your account
       | as well. I just got an email from Twitter support, saying that I
       | could "restore" my lost access by creating new account. I thought
       | this email was some kind of a joke, but no.
        
         | TacticalCoder wrote:
         | > This spells the end of privacy on the Internet. Your phone
         | 100% identifies you.
         | 
         | But I don't think Google mandates you to use a phone for 2FA?
         | You can use any TOTP app or a U2F dongle like the Yubikey (or
         | the Ledger Nano S, which has an U2F app).
        
         | junon wrote:
         | I see your point but unlike climate change, privacy is not a
         | one-way loss. It can be restored so long as some other
         | technology prevails. Wishful thinking perhaps, but it's well
         | within the realm of possibilty.
        
         | rsync wrote:
         | "This spells the end of privacy on the Internet. Your phone
         | 100% identifies you."
         | 
         | My "2FA Mule" has no identifying information of any kind on it
         | and doesn't follow my location(s).
         | 
         | It's a stock android phone with no google account and no apps
         | installed except for "SMS Forwarder"[1].
         | 
         | It is configured to forward all SMS to an email address via
         | encrypted SMTP. This means that I can receive these 2FA codes
         | anywhere I have Internet access - such as an airplane or newly
         | arrived in a foreign country where my SIM card does not work.
         | 
         | The "2FA Mule" itself is plugged in at my office in a corner.
         | 
         | I'm not employing this for anything sensitive but it's
         | interesting to consider that I can use SMS based 2FA while
         | divorcing it from my day to day SIM identity ...
         | 
         | [1]
         | https://play.google.com/store/apps/details?id=com.frzinapps....
        
           | kradeelav wrote:
           | That's a great idea, and worth remembering for me in the
           | future, but it's also worth noting not everyone can afford a
           | 2FA mule phone.
           | 
           | (yes even as relatively "cheap" phones are these days. there
           | was a time that $20 was a no-go for me.)
        
           | fragmede wrote:
           | What happens if that phone is destroyed through some sort of
           | accident, possibly involving your office? No matter how
           | unlikely, if that's not a contingency you've planned for, the
           | plan needs some work.
        
             | mattowen_uk wrote:
             | At some point you've got to sign off on 'acceptable risk'.
        
             | rsync wrote:
             | "What happens if that phone is destroyed through some sort
             | of accident ..."
             | 
             | I don't think that's an issue at all ...
             | 
             | I don't care about the _phone_ - all I care about is the
             | SIM card. If the SIM card is destroyed, your provider can
             | issue a new one.
             | 
             | I guess if the 2FA mule was destroyed _while I was
             | traveling_ that would be a real pain but ...
        
         | AlexandrB wrote:
         | AFAIK you should be able to remove your phone number from your
         | account after adding some other type of MFA (authenticator app
         | or key fob). Did this change recently?
        
         | lrem wrote:
         | Uh, doesn't this accept U2F?
         | 
         | I'm a Googler, but haven't really looked into this yet.
        
         | jjulius wrote:
         | >This spells the end of privacy on the _pop(ular)_ internet.
         | 
         | FTFY. Though, I'd argue privacy has been dead there for years
         | already.
        
         | derekp7 wrote:
         | That is why I use a TOTP app that lets me export an encrypted
         | copy of the TOTP secrets. I also have a printed-out copy of the
         | secrets stored in a secure location, which I update monthly for
         | new accounts I add in. Prior to that when I was just using
         | Google Authenticator I would record the TOTP secret prior to
         | importing it into the app.
        
           | nerdponx wrote:
           | What TOTP app do you use, and what format do you print the
           | secrets in?
           | 
           | I currently use "OTP Auth" for iOS, which supports backup and
           | encrypted cloud sync, but I'm not sure if that supports
           | something like "export to a text file".
        
             | nh2 wrote:
             | On Android, andOTP is good.
             | 
             | It is open source, maintained, easy to use, can do backups
             | and re-present the QR code so you can easily scan it with
             | another device.
             | 
             | https://github.com/andOTP/andOTP
        
           | tgb wrote:
           | What app is it?
        
       | nonbirithm wrote:
       | Does anyone else need to isolate their phone in another room to
       | prevent distractions, only for some web service to restrict
       | logging in behind a 2FA method with no other hardware option,
       | thus forcing you to go back to your phone, and then once the
       | phone is in your hands you end up getting distracted?
        
       | account-5 wrote:
       | If they don't allow me to use TOTP via keepass then they can kiss
       | my @*. I only have Google accounts because of android so not
       | fussed if they decide I'm not receiving ads on their service.
        
       | spsful wrote:
       | Google's 2FA is very frustrating to say the least. The forced use
       | of a mobile device with a Google app installed as my primary 2FA
       | device is nothing if not annoying-- I already have 1Password set
       | up in the browser to autofill 2FA codes. Google doesn't seem to
       | like this because after sign in I always have to wait for the
       | prompt saying "open the google app on your phone", then scroll
       | down and click "try a different way" and THEN click a selection
       | to enter a 2FA code. Very very frustrating.
        
         | cletus wrote:
         | I use a password manager myself (as IMHO everyone should). It's
         | not ideal because if your master password gets compromised it's
         | potentially catastrophic in away that any individual getting
         | compromised isn't.
         | 
         | The problem with 1Password 2FA is, I believe, that the 2FA
         | itself is still gated behind your master password, in that if
         | that gets compromised so does your supposed 2FA.
         | 
         | The central idea of 2FA is it's something you know and
         | something you have. If that 1Password master password is the
         | only thing needed to gain access then you don't really have
         | 2FA.
         | 
         | Again, I don't use this feature of 1Paswword so this might not
         | be exactly how it works.
         | 
         | But if so, I'm sympathetic to Google not treating it as 2FA
         | because, well, it isn't.
        
           | fsflover wrote:
           | > It's not ideal because if your master password gets
           | compromised it's potentially catastrophic in away that any
           | individual getting compromised isn't.
           | 
           | If you care about this, consider security through
           | compartmentalization provided by Qubes OS. I store my
           | passwords in plain text in an offline VM (with hardware
           | virtualization).
        
             | jfrunyon wrote:
             | There are vulnerabilities disclosed in VMs and containers
             | almost weekly.
        
           | reshie wrote:
           | somthing you have and something you know. a password can be
           | hacked remotely. something you have is more involved. these
           | are layees if security. some are better than others and there
           | are gimicks like some forms of recovery.
        
           | LordLandon wrote:
           | The way I see my password manager, is that its password store
           | in itself is "something I have", while the password to it, is
           | "something I know".
        
             | tshaddox wrote:
             | The problem is that "something I have" is generally
             | supposed to imply that it's a physical object whose
             | functionality cannot be feasibly copied to another object.
             | Some data, especially data stored in the cloud, isn't
             | really a good candidate, even if it's protected by a
             | password that only you know.
        
               | hunter2_ wrote:
               | I disagree. The "have" factor can be soft or hard. It
               | just needs to not be memorable (because then it's
               | guessable, which is a primary weakness of a "know"
               | factor).
               | 
               | For example: if you have an application protected by
               | password+yubikey with "remember device" enabled, after
               | prompting for your password it may decide not to also
               | prompt you for the yubikey, and that can be because a
               | cookie (perhaps ANDed with some other heuristics) is
               | taking its place. A cookie which can be trivially copied
               | to another device, but can't be trivially memorized nor
               | guessed, and is for that reason not a "knowable" thing.
               | If it was considered a "know" factor, then the "remember
               | device" feature would effectively be a "conditionally
               | disable 2FA" feature (two "knows" are 1FA), but it's
               | really not that, outside of describing the interim UX.
        
               | tshaddox wrote:
               | I think that a "remember device" feature is a totally
               | orthogonal concept. That's really just another word for a
               | session, and it's quite common for authentication to
               | apply to an entire session rather than to each and every
               | message in a session.
               | 
               | It's true, of course, that once you have created an
               | authenticated session on a device, anyone who has
               | compromised that device (with physical access or a
               | software hack) can likely gain access to that session.
               | But the authentication method still prevents _unwanted
               | initiation of sessions_ , which is the whole point.
               | 
               | Any service provider obviously needs to choose their
               | session policies to match the sensitivity of their
               | service, their own threat models, and the threat models
               | of their clients. So e.g. an online bank probably
               | shouldn't issue cookies that last for a year and are
               | portable across IP addresses. For some services, it could
               | be a good idea for the session to only grant less
               | sensitive access (e.g. only read access), and still
               | require fresh authentication for sensitive actions (e.g.
               | transferring money).
        
           | kitbrennan wrote:
           | Totally agree, it's crazy to have your 2FA and password
           | manager be the same application. You can actually disable
           | 1Password's 2FA and tie a different 2FA. I'm not sure if it's
           | just a business/teams feature, but we are able to require
           | everyone at the company install and use Duo as their primary
           | 2FA as part of their 1Password activation.
        
           | daveidol wrote:
           | 1. 1Password requires a secret key[1] in addition to the
           | master password to gain access on a new device - specifically
           | to protect against weak/reused/leaked master passwords
           | 
           | 2. You can add 2FA (well, technically 3FA if you need the
           | secret key, master password, AND a rotating token) to your
           | 1Password signin as well (I auth Authy for that purpose)
           | 
           | [1] https://support.1password.com/secret-key/
        
             | jfrunyon wrote:
             | The second factor for login to 1Password (or other password
             | managers) protects you from people logging into your
             | account officially, but not from vulnerabilities or inside
             | action of the vendor.
             | 
             | 1Password also seems able to bypass the secret key ("If you
             | still can't find your Secret Key, contact 1Password
             | Support.") which means social engineering, phishing, and/or
             | credential stuffing attacks are viable.
        
             | programmarchy wrote:
             | By implementing #1 and #2 seems like you would still have a
             | layer of protection even if your master password get key-
             | logged.
        
           | cmroanirgo wrote:
           | I avoided using my password manager's 2fa for quite some time
           | for the same argumentation...
           | 
           | But when I realised the 'something you have' is the password
           | manager (actually, the data store) itself, and the 'thing I
           | know' is my master password (and not the individual site's
           | password) I've started using it for 2fa. I can still see how
           | the subscription version of 1password stretches that
           | definition though (because you don't actively have unique
           | ownership of the data itself), which is why I use keepass
           | now.
           | 
           | Just like a dongle, your pc is not immune to evil maid if
           | left unattended. My threat model isn't inclusive of that (my
           | threats come from the internet - I live rurally).
           | 
           | Requiring your phone for 2fa (google auth or sms 2fa or
           | other) isn't a panacea either, especially if that's the
           | device you're logging in with.
           | 
           | I wish Google would allow setting 2fa without a phone
           | number...
        
             | jfrunyon wrote:
             | > the 'something you have' is the password manager
             | 
             | The problem is, assuming your master password is unique (I
             | hope so!), all of the likely vectors for exposing it also
             | expose the database, even if it's only kept locally. Having
             | the database only stored in one place is also quite
             | inconvenient, of course, and any sync mechanism adds even
             | more opportunities for it to be exposed.
             | 
             | My computer could very easily have a zero-day vulnerability
             | get exploited. So could my phone. Either one would expose
             | anything I do on it (for example: access my password
             | database using my master password).
             | 
             | (My solution to this is to use a security key for as much
             | as I can. If you're not concerned about this risk, great,
             | but it definitely is a threat.)
        
           | barkerja wrote:
           | Your example is correct, but your 1Password account can be
           | protected by MFA that's separate from 1Password itself. They
           | also support U2F.
           | 
           | I personally have all my MFA codes in 1Password, but
           | 1Password is protected with my Yubikey. In the unlikely event
           | that a bad actor did acquire my master password, they
           | wouldn't get far unless they also physically had my hardware
           | security key.
        
           | SkyPuncher wrote:
           | The only use case I've identified for 1Password 2FA is an
           | account that _must_ be a shared login. There are a few
           | business services we use that don't support multiple users on
           | an account.
           | 
           | Our choice is either:
           | 
           | * No 2FA
           | 
           | * Virtual, 1Password 2FA
           | 
           | It's better. But it's not great.
        
             | cbsks wrote:
             | Is there any reason why you couldn't set up the same TOTP
             | authentication on multiple devices?
        
               | SkyPuncher wrote:
               | It's a pain and would require setting it up on nearly
               | every employee's device.
        
           | joshstrange wrote:
           | I know 2FA is often described in this way but it's not the
           | way I really use it or how your average person wants to use
           | it IMHO. It's just a second piece of data that is needed to
           | login, which does add significant security. Maybe I just
           | don't oversee anything important enough but I don't actually
           | want my digital security to be dependent on a single piece of
           | hardware ever. Yes, I know about backup codes but where are
           | you going to store those if not 1Password/alternative-
           | manager? So for me I'm perfectly happy to keep my 2FA
           | alongside my password in 1Password.
           | 
           | As for "If that 1Password master password is the only thing
           | needed to gain access then you don't really have 2FA." it's
           | not, unless they get access to a device you have logged into
           | 1Password on in the past (and thus entered your secret key
           | [0]). For me this stays true enough to "something I have". If
           | someone has my phone/computer AND can guess my 1Password
           | master password then things are already pretty bleak and they
           | already have access to whatever other 2FA app I was using
           | (Authy/GA).
           | 
           | Lastly 2FA falls apart if you share an account with a
           | significant other (or a team). In 1Password I can just move
           | that login to a shared vault or share that login individually
           | and everyone can log in and use 2FA. I'm not sure what the
           | alternative would be. Sure, if a product supports multiple
           | accounts or even multiple 2FA's (I don't think I've ever seen
           | the latter, at least in non-enterprise settings) there is a
           | way to do this but most apps/SaaS/etc there isn't an
           | alternative (other than disabling 2FA).
           | 
           | [0] https://support.1password.com/secret-key/
        
             | toomanybeersies wrote:
             | > backup codes but where are you going to store those
             | 
             | On a flash drive/SD card, or even printed out, and then
             | stashed somewhere safe/secure (i.e. not in an unlocked
             | drawer next to your desk)
        
               | tialaramex wrote:
               | Yes. I write them in a book. The book lives in a locked
               | desk drawer.
               | 
               | My threat model does not include "Nation state adversary
               | breaks into my home and... reads the contents of the
               | book". If I annoy the Russians enough, presumably they
               | would just try to outright murder me.
               | 
               | In contrast, "Person I annoyed online plans elaborate
               | Internet revenge" is definitely a potential threat I want
               | to cope with, as are "Scam email claiming to be from
               | company I have account with", "Facebook lose everybody's
               | passwords", and so on.
        
           | zzyzxd wrote:
           | A password manager itself should be protected with 2FA
           | already. Especially in terms of 1Password since you mentioned
           | it, you need to have both master password and private key to
           | decrypt a vault. It is a pretty strong 2FA as long as you
           | know how to protect the private key.
           | 
           | Granted that if you put your TOTP seed somewhere else outside
           | the password manager, you technically achieved
           | "3FA"(1Password master password + 1Password private key +
           | TOTP token) and it is more secure. But I don't think putting
           | TOTP seed and password together in the same password manager
           | weakens 2FA?
           | 
           | To login to a website:
           | 
           | - Without a password manager, your 2 factors are account
           | password + account TOTP.
           | 
           | - With 1Password, your 2 factors are 1Password master
           | password + 1Password private key.
        
         | cageface wrote:
         | My parents are low tech and don't have cellphones. I guess
         | they're going to have to get a call on their landline now every
         | time they have to 2fa?
        
           | tialaramex wrote:
           | Because your parents do not have cellphones, Google will
           | conclude that it doesn't know a better way to authenticate
           | them and they get to keep their existing (poor) security. As
           | the article eventually explains.
           | 
           | If you would like your parents to have _better_ security for
           | these accounts, I commend Security Keys. Unless your parents
           | aren 't together any more, or are just really fervently
           | independent, it's probably fine to buy them one each, but
           | with the suggestion that they _both_ enroll _both_ keys. This
           | way when Parent #1 loses the Yubikey you bought them, Parent
           | #2 can use _their_ Yubikey to save the day until a new one is
           | purchased.
           | 
           | Yubico's USB A format factor "Security Key 2" is robust, but
           | relatively expensive for what you need.
           | 
           | Searches for "Security Key" on Amazon or your preferred site
           | will give you a pile of products and review feedback across
           | price brackets, the only thing your parents are likely to
           | care about are the connector (USB A is no use for a USB C
           | MacBook for example) and maybe other form factor concerns
           | like can it hang from a keychain, or would it fit in a
           | wallet? For their purpose these things don't fill up, and
           | shouldn't (modulo physically smashing it) wear out.
        
             | cageface wrote:
             | Something like this is really going to be a challenge for
             | them. Might be time to move them to fastmail.
        
           | throw63738 wrote:
           | low tech, but with google account?
        
             | cageface wrote:
             | Yeah they can barely manage email. I've taught them how to
             | forward email a dozen times but that's a bridge too far for
             | them.
        
           | closetohome wrote:
           | Google discontinued the "read you a number over a landline"
           | feature a little while back and only supports texting now.
        
           | 14 wrote:
           | I am curious about this as well parents in the same position.
           | What happens now?
        
           | wstrange wrote:
           | My Dad is in the same boat. What about a Titan/yubikey? They
           | are fairly easy to use - although you might have to help your
           | parents with enrollement.
        
           | fragmede wrote:
           | Others have mentioned a desktop app, but how often do your
           | parents have to 2fa? It's not every time they log in (unless
           | they're buying a new burner laptop every time they log in. If
           | they are, there may be other issues to discuss first.)
        
             | cageface wrote:
             | I've found Google asks for 2fa at pretty random times. I do
             | travel a lot but still it happens at least once a month.
        
         | bradfa wrote:
         | I've used a U2F dongle for my 2FA with Google for a few years.
         | I've been enrolled in the Google Advanced Protection program
         | for a while. I don't have any issues around Google logins, just
         | plug in my U2F dongle and press the button or hold the dongle
         | near my phone for NFC to do its magic.
         | 
         | Another benefit is that I'm much less likely to lose my U2F
         | dongle as it's on my physical keychain (and has been, for
         | years, without damage) than I am to need to replace or wipe my
         | phone (although a password manager with 2FA codes in it also
         | avoids this).
        
           | bradfa wrote:
           | For anyone who says, "But what if $WORKPLACE doesn't allow
           | you to plug in USB dongles or use NFC!?!" my counter is then
           | maybe you shouldn't be logging into your personal Google
           | account on that PC. And you probably have an IT department
           | who already have a solution for 2FA that you're required to
           | use.
        
             | CogitoCogito wrote:
             | This is quite a flippant response. These requirements are
             | being put in place against (some) users' will. Simple
             | changing email providers isn't exactly easy and maybe they
             | need to access that account. Maybe Google should allow
             | users to turn this off?
        
             | tialaramex wrote:
             | Also, just because you aren't allowed to plug in "USB
             | dongles" such as flash drives, does _not_ mean FIDO
             | authenticators [the things needed to make WebAuthn or its
             | predecessor U2F work] won 't work.
             | 
             | A FIDO authenticator is actually a USB HID class device,
             | like a keyboard++. So, if your $WORKPLACE doesn't allow you
             | to plug in keyboards then, OK, I guess maybe a FIDO dongle
             | isn't worth trying, but few people are in that situation.
             | 
             | If your employer has a policy of specifically issuing and
             | authorising only particular devices (e.g. you can pick from
             | a list of 3 Dell branded keyboards and 2 Logitech keyboards
             | and anything else needs HR director override) then seems
             | like it's time for them to authorise and issue a nice high
             | quality FIDO authenticator. Yubico make some eye-wateringly
             | expensive models, maybe they should pick those.
             | 
             | ++ "Like" a keyboard but it isn't a keyboard. The FIDO
             | protocols don't involve keypresses, the device is just HID
             | class because well, it's a Human Interface Device, seems
             | legit. It sets protocol to 0xFF custom, and needs dedicated
             | software to use that, which is fine.
        
               | rot13xor wrote:
               | Some work machines have all external ports glued shut and
               | the mouse/keyboard are non-removable to prevent data
               | exfiltration. Though you shouldn't be logging into
               | personal accounts on those machines anyway.
        
           | eikenberry wrote:
           | What's your plan for when your dongle is
           | lost/stolen/destroyed? Many U2F devices cannot be backed up
           | and they recommend that you register with 2 separate devices.
           | But while that is possible, it certainly doesn't scale and
           | really is useless advice for the general case.
        
           | LUmBULtERA wrote:
           | I've had the same experience. Signed up for Advanced
           | Protection Program not long after it was announced and I've
           | been very happy with my MFA experience with Google for years
           | now.
        
         | k8sToGo wrote:
         | Security often comes at the cost of convenience.
        
           | DoingIsLearning wrote:
           | False dichotomy, these issues would be gone if google
           | provided any meaningful customer service for edge cases.
           | 
           | You can fill forms and feedback but I have never heard of
           | free users ever getting as much as a reply back.
        
         | junon wrote:
         | One alternative (though it's absurd it has to be this way) is
         | to use two separate google accounts - one for your phone, one
         | for everything else. It actually solves a few invasive/dark
         | patterns Google employs.
        
         | ABS wrote:
         | FWIW I've been using Authy for all my 2FA for years, including
         | Google's, without any issues
        
           | dazc wrote:
           | And authy has a desktop app too, which makes it much more
           | convenient.
        
         | ramesh31 wrote:
         | You can always use SMS 2FA
        
           | latchkey wrote:
           | Please, no. https://en.wikipedia.org/wiki/SIM_swap_scam
        
             | dazc wrote:
             | SMS 2fa is still multiple times more secure than no 2fa at
             | all though.
        
               | latchkey wrote:
               | That's not really on the table though. We are not talking
               | about your local tech illiterate bank here. We are
               | talking about securing your Google account which is
               | likely used to SSO authenticate with many other accounts.
        
               | filmgirlcw wrote:
               | I sort of disagree. With social engineering, it could be
               | easier to reset someone's password with a SIM swap than
               | traditional means. For many years, PayPal refused to do
               | true 2FA and I cringed at having to choose between no 2FA
               | or SMS-based. Phone numbers are much easier to source
               | through public records than many people realize. As
               | someone who has had the same primary cell phone number
               | since I was a teenager, I'm honestly shocked it isn't in
               | more places (I've taken great pains to limit it getting
               | out, but I'm still shocked). That scares me enough to
               | almost get a second number, but that's such a pain in the
               | ass and not a great solution.
        
             | bduerst wrote:
             | There are services that have safeguards in place against
             | sim swapping, coincidentally one of them is Fi:
             | https://support.google.com/fi/answer/9834243?hl=en
        
               | zrm wrote:
               | Apparently the safeguards consist of using a non-SMS
               | method of 2FA. Maybe just do that in the other case too.
        
               | latchkey wrote:
               | While I'm sure that Fi and Google Voice are better than
               | almost any other carrier based SMS security, this does
               | nothing to convince me to ever use SMS 2FA.
               | 
               | "Your Fi number is tied to your Google Account." -- I'm
               | sure you've seen cases of people's google accounts being
               | randomly locked for no reason. Now you lose access to
               | make a call too!
               | 
               | The last thing I'd ever trust security to is SMS. Lots of
               | good technical details here:
               | 
               | https://lucky225.medium.com/its-time-to-stop-using-sms-
               | for-a...
        
               | bduerst wrote:
               | No matter what cellular service you use, you run a risk
               | of being flagged as a false positive for fraud locks
               | (irrespective of SIM swaps).
               | 
               | If a SIM swap scam is happening and your account is
               | locked, it is incredibly unlikely they'll be able to swap
               | it out.
        
           | gchucky wrote:
           | Here in the US, NIST has deprecated the use of SMS as
           | 2-factor auth[1] on the grounds that "there's a risk that SMS
           | messages can be intercepted or redirected".
           | 
           | [1] https://www.zdnet.com/article/nist-blog-clarifies-sms-
           | deprec...
        
         | psanford wrote:
         | Huh. My google account shows Security Keys as the default 2fa
         | option. When I login it goes straight to the security key
         | prompt.
        
         | shoto_io wrote:
         | FWIW, you could use a different app, other than Google's. For
         | example, you could use an app called Authy or the Microsoft
         | authenticator app. Then AT LEAST, the app is outside the Google
         | network.
        
         | omegalulw wrote:
         | > I already have 1Password set up in the browser to autofill
         | 2FA codes
         | 
         | The whole point of 2FA is to have "2" independent pieces of
         | data to verify logins. Gating 2FA behind a single password
         | defeats the point.
        
           | fragmede wrote:
           | Two passwords - a master password, and a secret key. That
           | secret key comprises the phone or laptop with 1password
           | configured being the "something you have" for MFA because
           | it's basically the same as the TOTP seed value/QR code - that
           | secret key is only used by the user when setting up a new
           | device - similar to when a new TOTP MFA is set up.
        
           | andrewaylett wrote:
           | My password manager requires a hardware token to log in. So
           | now the second factor is "has a device I've logged into my
           | password manager with, or the hardware token for the password
           | manager".
        
           | TacticalCoder wrote:
           | > The whole point of 2FA is to have "2" independent pieces of
           | data to verify logins. Gating 2FA behind a single password
           | defeats the point.
           | 
           | Indeed.
           | 
           | It's also why I think U2F should be mandatory in way more
           | places/sites/companies (it is in some, thankfully): you then
           | need to physically have a Yubikey or similar and it's not
           | possible anymore to trade security for convenience. It
           | doesn't solve all security issues, but it's already a great
           | step forward.
           | 
           | When you let people the choice, they'll pick the lazy,
           | insecure, way.
        
         | mattmcknight wrote:
         | If you are working in facility where you can't have a mobile
         | phone nearby, it is incredibly frustrating. Sure, just print
         | out a long list of codes every week.
        
         | dannyw wrote:
         | That sounds like design decisions for optimising the 2FA
         | experience for the vast majority of users, who don't want to
         | mess with Google Authenticator or their password manager _is_
         | Google (Chrome).
        
       | gjsman-1000 wrote:
       | Seems like a great backdoor method to fool everyone into giving
       | Google their phone numbers.
        
         | bpodgursky wrote:
         | can't you use an authenticator app or hardware key?
        
           | gjsman-1000 wrote:
           | You could, but the vast majority of people probably won't.
        
       | alphabet9000 wrote:
       | I'm trying to update a chrome extension, and it now asks me to
       | set up 2FA. I don't want to use a phone, and I don't see any
       | option for using Google Authenticator to do one time keys. It is
       | asking for a physical hardware key. Surely there's got to be
       | another way to do this right?
        
       | grawprog wrote:
       | This hit me the other day. I dropped my phone and smashed both
       | the screen and display making it essentially unusable. I needed
       | to get into my email. I had no WiFi but I had access to an older
       | phone with data. Tried to sign in on the other phone. It said I
       | needed to confirm the login on my device, I obviously could not,
       | it gave me an option saying 'can't access phone' so I clicked it,
       | it took me to a page saying too bad sorry no signing in for you
       | and that was it, I was locked out of email until I bought a new
       | phone and set it up.
        
         | danlugo92 wrote:
         | 1. Add OTP to your account ("Google Authenticator", Lastpass,
         | etc). 2. Remove phone number from account. 3. Enjoy not needing
         | a phone ever again to login. 4. Might take a couple of days for
         | (3) to stick, train the algorith by logging in a couple of
         | times using OTP.
        
           | maxk42 wrote:
           | Your solution for not needing a phone to log in is to use
           | Google Authenticator which is a phone app that would've been
           | on the smashed phone?
           | 
           | I recently went through this exact scenario: Old phone broke.
           | Bought a new one, restored backup. Guess which app doesn't
           | restore its data from the old phone? Google Authenticator.
           | Lost access to all my TOTP logins.
        
           | programmertote wrote:
           | How does one add OTP to her/his Google account? Is there a
           | guide/instruction that you could share? Thanks in advance!
        
         | shadowgovt wrote:
         | I've been bit by this before also. It's important to take the
         | one time passcodes that Google provides seriously and keep a
         | couple of them in your wallet.
        
       | apricot13 wrote:
       | The past week I've had a few family members and friends need tech
       | support thinking they had been hacked (had ignored the email
       | telling them about the change over) issue is they don't have a
       | 2fa application. If they follow the instructions they download
       | the google one which doesn't do backups and they don't trust
       | authy or think the m$ one wont work with a google account.
       | Scanning a QR code is something some can do but not all. The
       | issue now is that even though they were using an insecure account
       | they always had the ability to get back in - but now if they lose
       | their phone and are signed out of the gmail apps for whatever
       | reason thats it they're locked out forever!
        
       | mid-kid wrote:
       | This was already required to generate what's called an "App
       | Password", in order to keep using IMAP in a sane way without
       | constantly getting emails about suspicious logins when my K9-Mail
       | app on my phone connects to public hotspots.
       | 
       | The irony of the matter is that I keep my OTP key in the same
       | password manager as my google password, in order to not require a
       | phone to access it, and this "App Password" is significantly
       | weaker than my generated passwords...
        
         | mid-kid wrote:
         | Oh and I should add that it was already rather compulsory in
         | order to be able to log in to your account on "public"
         | computers (think printing services, schools, ...), as google
         | would straight up block the login unless you got an existing
         | device to confirm your login (i.e. a phone with google apps and
         | services, which I don't have). With the 2FA enabled this no
         | longer is a problem as long as I have a device nearby on which
         | my OTP key is stored...
        
       | marcodiego wrote:
       | This means I cannot login just using my password?
        
         | doodlebugging wrote:
         | This is an old article. When it first was posted I strongly
         | considered finally ditching Google forever. Of all the Google
         | services, I only use gmail and then only for catching junk,
         | spam, for Craigslist posts, and for bullshit account creations.
         | I have two active junk gmail accounts.
         | 
         | I log in all the time, this morning included, and do it every
         | time with a simple password. I have never been prompted for 2FA
         | and there is no identifying info in my account or in the emails
         | that it catches. The account names are even fake.
         | 
         | If I do end up prompted to set up 2FA I will simply delete the
         | whole shitteroo and start over somewhere else with another fake
         | name.
        
           | jfrunyon wrote:
           | It seems you didn't read the article.
           | 
           | "The company plans to automatically enable two-step
           | verification for accounts that have been configured
           | correctly."
        
         | anter wrote:
         | That's already the case. If their algorithms decide that your
         | activity is "unusual", they can disable your ability to login
         | with literally no option to bypass it.
         | 
         | https://i.imgur.com/4YrElkJ.png
         | 
         | Keep that in mind when you e.g. go traveling.
        
           | danlugo92 wrote:
           | If you have OTP 2FA set up they let you login from anywhere.
        
             | [deleted]
        
           | mindslight wrote:
           | I've been getting this for years. This announcement doesn't
           | seem like a major change to their overall policy, just a
           | ramping up of the roadblocks for CGNAT and the like.
           | 
           | Rather than giving users options, Big Tech has decided to
           | paternalistically kill passwords in favor of less convenient
           | and less secure methods (my email is much less secure than my
           | password store). Even from residential IPs, it's become the
           | norm for banking websites to harass you with snake oil "2FA"
           | every time you login. The only solution is to split up your
           | online activities so you can conform to their demands with
           | one VM/browser config, account for the extra annoyances as
           | the price of using their services, and move as much activity
           | as possible to freedom-respecting technologies.
        
             | pullitoutur wrote:
             | Which of course is why those tech companies spent effort
             | writing and advancing FIDO specs, and why I am able to
             | login to my Goog/Facebook/MS accounts _just perfectly damn
             | fine_ using offline tools (pass, pass-otp).
             | 
             | Can we _please_ stop spreading FUD because people here
             | _really getting their jimmies rustled at any extra steps_
             | (even though this forum is often rife with people falling
             | for phishing attempts, repeatedly using GoDaddy, on and on,
             | proving that they can 't protect themeselves.)*
             | 
             | But maybe you could name a few tech companies besides
             | Twitter who have implement 2FA you way you imply.
        
       | aimor wrote:
       | I feel I'm the only one who absolutely hates the zoo of MFA I'm
       | subjected to as part of the latest and greatest in security for
       | the masses. I hope something comes along to replace all of it
       | soon.
        
         | mywittyname wrote:
         | Yes.
         | 
         | I feel like my PC is should be the source of truth for my
         | identity, not my phone. Phones get lost, stolen, and destroyed
         | at times and there's no guarantee that I'll have access to my
         | phone number for the rest of my life. I'm already completely
         | screwed if my phone number changes, because not every service
         | offers one-time-use codes to bypass 2FA.
         | 
         | It is absolutely baffling that there's no desktop 2FA program
         | that's widely used. I guess tech savvy people are using android
         | emulators on their PC to run google authenticator, but that's
         | such a pain.
         | 
         | Has anyone had luck with yubikeys for personal accounts?
        
         | TheJoeMan wrote:
         | Would you be interested in an emulated Android phone hosted
         | somewhere that just auto-clicks "approve" on 2FA, maybe as a
         | low-fee subscription service?
         | 
         | Could even set up rules for like "only during business hours in
         | my country"
        
           | loxias wrote:
           | Hah! I actually did exactly that! (ran Android in a VM just
           | for 2FA) until I realized I could do it from the command line
           | easily with `oathtool`.
        
         | dbbk wrote:
         | Apple is working on this using WebAuthn, they call it Passkeys:
         | 
         | https://sixcolors.com/post/2021/06/wwdc-2021-apple-takes-the...
        
           | cromwellian wrote:
           | This seems pretty worrisome if you have ANY non-Apple device.
           | So if I create an account using PassKeys, but at some later
           | date, I need to log in using a browser on a Windows or Linux
           | box, what do I do? I don't have a password, since one was
           | never created. And all my credentials are in iCloud.
        
         | TeaDude wrote:
         | Don't worry. Many companies are already replacing it with a
         | simple webcam image of your mug (Hopefully directly stored on a
         | server somewhere so it can be used for identity theft
         | purposes).
        
           | treesknees wrote:
           | Assuming you mean face and not a coffee mug, can you give an
           | example? Most companies using facial recognition are using 3D
           | maps of facial features using IR or other sensors, not a
           | camera image. Windows Hello and Face ID come to mind, hence
           | why they work in the dark.
        
             | TeaDude wrote:
             | I am fully aware that these algorithms use reference points
             | on your face. I'm still not pleased with that data getting
             | passed around.
             | 
             | As for the part of my comment in parentheses; I'm
             | graciously awaiting the facial equivalent of "passwords in
             | plaintext on the server". It's rather uncommon these days
             | but I can almost guarantee it'll happen at least once.
        
               | treesknees wrote:
               | My point is that generalizing it as a "webcam image on a
               | server" is not only disingenuous, it's incorrect. It's
               | not from the webcam, it's not an image, and it's not on
               | any server except your own local device. Unless you have
               | an example of a company doing this, which I did ask for.
               | As far as I know companies are not storing that data in
               | the cloud, at least the major ones I'm aware of.
        
         | ZetaZero wrote:
         | Sure, but doesn't that lead to XKCD Standards?
         | 
         | https://xkcd.com/927/
        
           | mid-kid wrote:
           | Literally everything you can make to solve a problem leads to
           | XKCD standards. If we go by XKCD logic we wouldn't have
           | Netflix because it would just be another "standard" alongside
           | all of the other film distribution methods.
        
       | aliswe wrote:
       | I'm OK with MFA, but it doesn't allow a swedish phone number as
       | backup solution. That's annoying ...
        
       | maxk42 wrote:
       | Recently my cell phone suffered a catastrophic failure and had to
       | be replaced. "No problem", I thought "I'll just restore my data
       | from Android's automatic backups onto my new device."
       | 
       | Google's Authenticator app's data is not restored. I have no way
       | of logging into half a dozen apps that require 2FA now. Good
       | going, Google. I'll never use your shitty 2FA again.
        
         | paride5745 wrote:
         | I use Authy, which stores the 2FA on their cloud safely.
         | 
         | Super easy to move between phones and to recover in case of
         | disaster.
        
           | omnimus wrote:
           | We need 2FA because our password manager is not enough.
           | 
           | ...
           | 
           | We put 2FA keys in different password manager it works great.
        
           | lelandbatey wrote:
           | I also use Authy, so I want to point out something. Authy
           | doesnt exactly "store the credentials online"; they do allow
           | you to store an encrypted snapshot backup in the cloud which
           | you can restore from, but that's not the same as storing them
           | in the cloud.
           | 
           | As far as I can tell, for cases where you're just using Authy
           | in the same way as Google Authenticator (a big standard TOTP
           | app), the only value proposition is that Authy allows
           | separate programs with your TOTP keys in them to communicate
           | together so that they all have copies of the same keys. It
           | seems in those cases that Authy is storing very little and is
           | instead acting like a dumb "connecting layer" for
           | installations of the Authy app to talk to each other. This is
           | nice for security, but the consequence is that if you lose
           | access to all your Authy installations at the same time then
           | you're SOL.
           | 
           | I'm inferring this merely from using Authy for years, if
           | someone knows more about how they work, please chime in to
           | correct me.
        
         | taf2 wrote:
         | that does suck... they do provide backup codes... and they do
         | present a page every few months for you to verify that... i
         | would recommend a 2fa app such as Authy maybe as a good way in
         | the future to have a backup for your 2fa codes...
        
           | throwawayboise wrote:
           | Yep -- you _must_ save the backup codes off line, off-device
           | for any hope of recovery from loss or damage of that device.
           | 
           | This is the weakness of the scheme. It relies on people doing
           | something that most people are not good at doing.
           | 
           | Thus there will probably be a way for the user to recover
           | without the codes (sending in photo ID or whatever) and that
           | will be the point of attack for anyone trying to maliciously
           | take over the account.
        
         | tinus_hn wrote:
         | Don't know if it's available on Android, but on iOS
         | Authenticator by Matt Rubin is a tiny app that properly backs
         | up your codes if you use (as documented) iOS' encrypted
         | backups.
         | 
         | Where Google Authenticator just doesn't backup half your codes,
         | leaving you in for a surprise if you lose your phone.
        
         | spixy wrote:
         | Microsoft Authenticator does support backups (already tried a
         | few times)
        
         | reaperducer wrote:
         | _Google 's Authenticator app's data is not restored. I have no
         | way of logging into half a dozen apps that require 2FA now.
         | Good going, Google. I'll never use your shitty 2FA again._
         | 
         | Don't just blame Google. The same thing happened to me with an
         | iPhone using Duo. Now I'm locked out of Facebook because Duo
         | wants me to re-link my Facebook account, and I can't log in to
         | Facebook to do the link because I can't use Duo.
         | 
         | To make things worse, Facebook's customer service has lived up
         | to its reputation. Meaning my requests for access, including
         | sending in copy of my government ID, have gone ignored.
         | 
         | I appreciate that 2FA is better, but this is the reason I don't
         | use 2FA anymore.
        
         | CaptainJustin wrote:
         | 1. What is the official way we're supposed to handle this?
         | 
         | 2. How should the tech world communicate that better so that
         | it's more user-friendly?
        
           | r1ch wrote:
           | The most common solution is one-time-use backup codes that
           | most services give you when enrolling. Hopefully you saved
           | them somewhere safe!
           | 
           | The main issue is Google Authenticator and how popular it is.
           | As GP noticed, it doesn't flag the files as being allowed for
           | backup which is kind of ridiculous. Almost anything is
           | better, https://getaegis.app/ is my recommendation.
           | 
           | You can also manually backup your seed (screenshot / save the
           | QR code during enrollment).
        
           | creato wrote:
           | I think the only way to handle the possibility of failure of
           | a 2FA system is to have multiple options configured. They all
           | can fail somehow: loss, damage, hardware failure, etc. On my
           | Google account I have two security keys, an OTP app, and
           | saved backup codes.
           | 
           | That's not user friendly though. I don't see how to make a
           | user friendly, reliable, and safe 2FA system. Not having 2FA
           | isn't safe either!
        
           | [deleted]
        
           | te_chris wrote:
           | Yeah, I've been burned by Goog Authenticator not being cloud.
           | I use 1pass for 2FA now and it works in the cloud at least.
        
         | rabboRubble wrote:
         | pro-tip for next, back up the otp set up keys or capture the qr
         | code during initial sign up.
         | 
         | i've been able to do this because i replicated otp set up in a
         | second source (1password).
         | 
         | in 1password, edit the record then inspect the otp field
         | string. it will look like this:
         | 
         | otpauth://totp/Discord:you@email.com?secret=blahblahblah&issuer
         | =Discord
         | 
         | save the "blahblahblah" and you can manually recreate a token
         | at any time.
        
           | dcow wrote:
           | Unless you truly want to uphold the property "the something I
           | have is not the something that stores my passwords" (you
           | likely don't), your two factor codes _should be_ in your
           | password manager. Period. A good password manager has a
           | strong user /device PKI backed by an offline key and will
           | only be accessible on devices you've bootstrapped, so it's
           | isomorphic to "something I have" at least and usually exactly
           | equal to "somethings I have". And if you _are_ a security nut
           | trying to uphold that property and telling people it 's bad
           | to put your TOTP urls in your password manager... you better
           | not have an authenticator app installed on the same device as
           | your password manager or you've thrown that property out the
           | window. Not saying it's never appropriate to have a true
           | second factor. Just that it's not appropriate for 99% of
           | consumer use cases and the security setup and structure
           | afforded by password managers is more than sufficient to have
           | good account hygiene. It would be a better world if everyone
           | used a password manager and stored their totp codes in it
           | than everyone has a hodgepodge of authentication apps that
           | aren't reliable and break and cause services to implement
           | manual verification backdoor loopholes into their auth anyway
           | etc. etc. TOTP 2FA defends against _weak_ passwords. A
           | password manager enables strong passwords largely making TOTP
           | irrelevant. Unfortunately not everyone uses a password
           | manager and thus services are compelled to add TOTP 2FA
           | because what other choice do they have?
        
             | rabboRubble wrote:
             | yeah, the only reason that i didn't get burned like the
             | person above my original quote is that i got lucky. i had
             | figured out that i could have two tokens running at the
             | same time (one token for service A in Google Authenticator,
             | second token for service A in 1Password). But I realized
             | when I lost all Google Authenticator tokens one time, that
             | I was this close || to a disaster. I had only recently also
             | set up 1pw.
             | 
             | The most ideal set up would be to have a universally
             | Yubikey or something equivalent. Preferrably with a backup
             | pre-configured second Yukibey possible in a disaster
             | recovery bugout kit. Then have all the initial QR codes,
             | otp secret manual otp key strings like i demonstrated above
             | your post, account recovery keys, backup break-in codes, or
             | whatever other flavor of two-factor recovery a service
             | uses, all this notated in a secured password manager. The
             | real problem i see with two factor is that the offered
             | recovery method is so variable from service to service. it
             | makes knowing which information you need to have on hand
             | when you've gotten locked out is problematic.
             | 
             | the other thing i do is that for core cloud service
             | providers, i print out the password manager details for the
             | accounts. this is apple, cloud backup service, google,
             | microsoft and a couple of hardware device passwords. it's a
             | risk to have this printed, but the print out is in a
             | fireproof safe with a trusted party.
             | 
             | i basically assume my disaster recovery plan is that i have
             | my wallet and the clothes on my back and nothing else.
             | everything else gone including my computers and phones and
             | i have to get back all services and data without having any
             | devices.
             | 
             | the higher the level of security, the higher level of
             | disaster preparedness the end user needs to practice.
             | 
             | I've emailed my elderly parents to make sure they
             | understand that this mandatory 2fa roll out is happening,
             | and I've explained how they could fuck up their accounts by
             | not notating the recovery method. offered to review their
             | details to make sure it passes a sniff test.
        
       | Brendinooo wrote:
       | > Supports Google Authenticator and other authentication apps
       | that can generate one-time security codes.
       | 
       | How do you do this? I'm looking at my personal account settings
       | and the 2-step options are "app on my iOS devices", "security
       | key", or "text message/voice call".
        
         | browningstreet wrote:
         | Am I understanding this correctly: you can't sign up with Authy
         | for Google Accounts if you don't have a mobile device to
         | authenticate with first..?
        
           | Brendinooo wrote:
           | There's an option to use a hardware key. I don't have one so
           | I couldn't try. I did the text message option and that
           | worked.
        
             | browningstreet wrote:
             | I'm looking at a family member who has Google Mail and
             | Google Voice because they don't have a cellphone.
             | 
             | I guess there's some needles here to be threaded, whether
             | we stay or leave Google.
        
         | miohtama wrote:
         | App on your iOS device is an open TOTP standard (RFC 6238) for
         | which you can find a client on every possible device, including
         | the command line.
         | 
         | https://en.wikipedia.org/wiki/Time-based_One-Time_Password
        
           | Brendinooo wrote:
           | Not quite - that option runs through Google apps. The TOTP
           | client option only pops up once you've done another method.
        
         | Flipflip79 wrote:
         | Was the same for me until I enrolled one of the above. I used a
         | security key to get past that stage, then I was allowed add an
         | Authenticator app. Very frustrating UX.
        
           | Brendinooo wrote:
           | This worked. Thanks!
        
           | gostsamo wrote:
           | Most people don't have a hardware key so Google gets your
           | verified phone number for free.
        
       | 0des wrote:
       | I'd like to make a humble appeal to you, dear Reader, that you
       | consider if you are able to exist without Google services and the
       | tradeoffs they entail.
        
         | shadowgovt wrote:
         | I'm having the opposite reaction.
         | 
         | 2FA is a strict improvement and everyone should be using it. I
         | applaud Google for mandating a best practice.
         | 
         | It's far preferable to the alternative of having your account
         | compromised because your password is guessed or stolen.
        
           | kitsunesoba wrote:
           | Yes, it's immensely frustrating when a service doesn't
           | support proper 2FA or forces weak SMS as a backup to proper
           | 2FA, undermining much of its value.
           | 
           | So while I support asking people to reconsider if they need a
           | Google account, I would never recommend alternatives that
           | lack 2FA and where possible, I refuse to use services that
           | lack 2FA myself. Unfortunately there are still some
           | categories like banking where TOTP, FIDO, etc is practically
           | unheard of.
        
           | 0des wrote:
           | This is not my opinion against 2FA, it is me using this
           | moment of friction to ask a question most people are often
           | too happy to ignore when things are going fine. Are you able
           | to live without your captors or not?
        
             | shadowgovt wrote:
             | I also don't see them as my "captors."
             | 
             | I'm able to live without electricity but I'm not about to
             | call the power company and have them cut my feed. There are
             | folks who consider it some kind of incarceration to be
             | beholden to the electricity provided by a power company; I
             | respect them but I don't share their philosophy.
        
               | xdennis wrote:
               | Depending on the situation it can be easy to cut yourself
               | from the power company, but no one can create his own
               | phone carrier regardless of the situation.
        
               | shadowgovt wrote:
               | > Depending on the situation it can be easy to cut
               | yourself from the power company
               | 
               | Unless the situation is "There is another power company
               | right next door," I'll have to disagree.
               | 
               | If the claim is one can self-generate power, the analogy
               | holds but not in the way, I think, the author means.
               | Self-generation off-grid is a pain... Buy or build and
               | maintain your own generators, your own storage, deal with
               | impedance, deal with the risks of operating on high
               | voltage, equipment breakdowns are yours and yours alone
               | to repair, etc.
               | 
               | Similarly, I can self-host my own email, video, web
               | servers, and possibly even build my own voice-activated
               | assistants tuned perfectly to my specifications, sharing
               | my data with nobody... But that's a _lot_ of work when
               | Google has provided all of that for me.
        
           | xdennis wrote:
           | I'm continuously surprised how authoritarian some people are.
           | 
           | You consider something superior just because it works for you
           | and therefore everyone should be forced to do as you, but you
           | ignore what doesn't work for others (such as being tied to a
           | phone).
        
             | darkwizard42 wrote:
             | The announcement doesn't even require a phone... it just
             | requires SOME second device to confirm your identity. There
             | are several alternatives.
             | 
             | And as others have said, you can use another product.
        
             | arbitrage wrote:
             | Nobody is forcing you to use Google's products. If having a
             | phone is that onerous for you, you're allowed to not do
             | that.
        
               | ergot_vacation wrote:
               | GOOGLE is literally forcing people to use their products.
               | Their entire business strategy is based around it,
               | gobbling up or destroying every competitor, advertising
               | and promoting their own services on search above others,
               | illegally collaborating with other giant tech companies,
               | and on and on. That's how monopolies work. That's the
               | whole point.
        
         | tqi wrote:
         | What are the tradeoffs?
        
       | lemoncookiechip wrote:
       | They really want our phone numbers. I have a few throwaway
       | accounts for subbing to sites that require log-in that I don't
       | want connected to a phone. IF they brick my accounts, I'm just
       | going to stop using Gmail and turn to Proton or something else.
        
         | stevespang wrote:
         | Yeah, true, all they really want is our phone no's so they can
         | sell the numbers to spammers and completely render our phones
         | useless, even for texting . . . fuck GOOGLE
        
         | cornstalks wrote:
         | Aren't there non-phone-number 2FA options?
        
           | tyingq wrote:
           | _" Then, a code will be sent to your phone via text, voice
           | call, or our mobile app. Or, if you have a Security Key, you
           | can insert it into your computer's USB port."_
           | 
           | https://www.google.com/intl/en/landing/2step/#tab=how-it-
           | wor...
           | 
           | I'm not sure why TOTP isn't an option. Google Authenticator
           | still seems to be a supported app.
        
             | jfrunyon wrote:
             | Google Authenticator _is_ TOTP and you can use any other
             | app.
        
               | tyingq wrote:
               | Yes, that was what I meant. The quoted passage didn't
               | seem to include any TOTP app, including GA. Apparently
               | they are supported, the info is just on another page.
        
               | jfrunyon wrote:
               | Yeah, they don't really want you to do it. That kinda
               | makes sense when you think about it; TOTP has a lot of
               | friction compared to "just press the button on the device
               | 99% of you already have linked to your account".
        
               | tyingq wrote:
               | That makes sense for most. For me, I can have my TOTP app
               | running on my laptop all the time. Looking around for my
               | phone is higher friction.
        
             | davidcbc wrote:
             | It is. Look under Features
             | 
             | > The Google Authenticator app for Android, iPhone, or
             | BlackBerry can generate verification codes. It even works
             | when your device has no phone or data connectivity.
             | 
             | You can also use third party apps, I use Authy
        
               | [deleted]
        
           | lemoncookiechip wrote:
           | There's only 3 options (I'm on the panel), Google Prompt
           | (requires a phone), security key, or text message/voice call
           | (requires a phone). 2 out of 3 require you to attach a phone
           | number and the last one requires a security key to be
           | inserted every time you want to make throw away accounts via
           | Gmail.
        
             | derekp7 wrote:
             | I'm using a TOTP authentication, are they taking that away?
             | Because TOTP doesn't require a phone.
        
           | danlugo92 wrote:
           | Yes, OTP.
        
             | Freak_NL wrote:
             | Possible, and a real burden to set up:
             | 
             | https://webapps.stackexchange.com/questions/127464/enabling
             | -...
             | 
             | Perhaps this changed now, but I had to set up a different
             | 2FA method first (I used a U2F security key), then add OTP,
             | and then it was possible to remove the U2F method.
             | 
             | After logging in with OTP once (I just keep the private key
             | on my laptop in _pass_ ) you never seem to get asked to
             | provide it again, but 2FA is nominally enabled.
        
         | ferdowsi wrote:
         | Google has supported WebAuthn security keys for a while now.
         | Don't give your phone number if you don't want to.
        
       | PaulHoule wrote:
       | This guarantees 100% that you will get locked out of your account
       | permanently at some point in your life.
        
         | remus wrote:
         | How so? If you have a variety of second factors enabled
         | (security key, TOTP, recovery codes) it seems like you can be
         | confident enough in not getting locked out.
        
           | PaulHoule wrote:
           | People who are in the top 1% of technical skill will do that.
           | Not "the rest of us".
           | 
           | Most of those tools suck. For instance I got a yubikey which
           | has numerous flaws (not quite a regulation USB device), but
           | the one that "EOLed" it was that the hole to attach it to a
           | keychain wore away. A 0.25-cent nylon washer would have fixed
           | it. Fortunately I was able to recover the yubikey rather than
           | lose it, but it isn't on my keychain anymore.
           | 
           | Banks and other high-margin organizations can afford heavy
           | reset and recovery processes. Companies like Google where
           | customer service is "talk to the hand" can't and won't.
        
             | arbitrage wrote:
             | > People who are in the top 1% of technical skill will do
             | that. Not "the rest of us".
             | 
             | Nobody is obligated to help you learn.
        
               | ergot_vacation wrote:
               | Is this the standard answer now every time someone
               | complains of beating treated like shit? "I was walking
               | down the street in broad daylight and someone beat me and
               | threw me in the gutter!"
               | 
               | "Nobody is obligated to teach you self-defense."
               | 
               | "I tried to stop while driving but my breaks failed and I
               | crashed into a house!"
               | 
               | "Nobody is obligated to teach you proper car
               | maintenance."
               | 
               | "My wife's surgeon lied about his qualifications and now
               | she's dead!"
               | 
               | "Nobody is obligated to teach you how to spot a quack."
               | 
               | IT'S NOT OUR OBLIGATION EITHER. It's Google's, to make
               | products that don't abuse and exploit their users. Stop
               | this bizarre gaslighting tactic. 2FA is a shitty scam
               | system that increases complexity and failure rates,
               | radically decreases privacy, and DOESN'T increase
               | security because the vast majority of users will just use
               | SMS, which is easily hacked.
        
               | PaulHoule wrote:
               | SMS excludes people who live in places where cell phone
               | carriers choose not to cover. I've had to drive 2 miles
               | from my house to receive an SMS, and I live just 20
               | minutes from a major research university.
        
       | trasz wrote:
       | Pathetic. GMail authentication was already quite broken as it is
       | - eg for me it just won't let me in over cellular connection.
        
         | m-s wrote:
         | Having 2FA set up usually gets around those pesky risk-scoring
         | algorithms.
        
           | trasz wrote:
           | At the cost of introducing other, even worse problems.
        
             | aoeusnth1 wrote:
             | What are some of these worse problems that MFA introduces?
        
               | trasz wrote:
               | Not being able to get to your account when you lose the
               | phone; having to run extra software.
               | 
               | But also, frankly, I just don't trust Google to implement
               | this correctly, given their track record. Google sure
               | employs a lot of smart people, but the quality of their
               | products and services is generally crap.
        
               | jfrunyon wrote:
               | > Not being able to get to your account when you lose the
               | phone
               | 
               | Really? There are scratch codes for that. Or you can use
               | an app that backs up your TOTP key for you, like Authy.
               | Or you can store your TOTP key manually. Or you can have
               | multiple devices. Or...
               | 
               | > having to run extra software
               | 
               | Oh, come on. Are you really complaining about having to
               | compute an HMAC?
               | 
               | > I just don't trust Google to implement this correctly,
               | given their track record.
               | 
               | Huh? You do know "The day Google forgot to check
               | passwords" was fictional?
        
               | trasz wrote:
               | So yeah, the additional problems this introduces do have
               | workarounds. Still, the point remains: this adds new
               | problems for no gain (for me).
               | 
               | As for the track record: we are talking about a company
               | that can't properly implement basic password
               | authentication, see my first comment. And no, I'm not
               | interested for possible reasons/excuses why is it so;
               | what matters is that it doesn't work _for me_.
        
       | rcarmo wrote:
       | Oh well. I still find it extremely weird to be asked to open
       | YouTube on my iPhone to login, though. And my IMAP scripts are
       | going to be irrevocably broken as well, I suppose.
        
       | smcameron wrote:
       | Great now if I lose my phone, or if it breaks, I'm in grave
       | danger of losing my google account.
        
         | darkwizard42 wrote:
         | You can use your backup codes. In fact your point is a good
         | reason to HAVE MFA given that in the past, if you lost your
         | phone all your data would be compromised.
        
         | Jxl180 wrote:
         | That's the beauty of 2 factor. If you lose your phone and a bad
         | actor picks it up, they now have one of your factors (what you
         | have) but not "what you know."
         | 
         | Your example is a great reason for 2FA to exist.
        
           | ergot_vacation wrote:
           | Consider 3 situations:
           | 
           | 1. Google does not require 2FA.
           | 
           | 2. Google DOES require 2FA on an account, but only requires
           | the second auth if "suspicious activity" crops up.
           | 
           | 3. Google requires 2 auths on each and every login.
           | 
           | On 1, if a bad actor picks up your phone and tries to log in,
           | they will fail if you haven't saved your login, or succeed if
           | you've been lazy and saved it. In the latter case, that's
           | really on you (and you might still be able to get your
           | account back even then, if they didn't fully and quickly
           | reset password and other details!)
           | 
           | On 2 however, they will try to log in, fail, and trigger a
           | lock-down that can only be lifted with both auths. One of
           | which you don't have anymore. Congrads, you've just lost your
           | account!
           | 
           | 3 is the same as 2, just for different reasons. As soon as
           | that phone disappears, you don't have the second auth, and
           | you're screwed.
           | 
           | And don't even bother with anything that isn't a phone. We
           | both know nobody in the general public is using anything
           | other than text for this. And some older folks don't even
           | have that! Add on to this that SMS can be easily hacked, and
           | it's pretty clear this whole system is a joke.
        
             | Jxl180 wrote:
             | You just put in your back up codes to restore access.
             | That's why the backup codes/words exist. If I lose my
             | crypto wallet or it gets stolen, I go to my bank, get the
             | words from my safe deposit box, and use those words to seed
             | my new wallet. Doesn't have to be a bank -- a home safe or
             | filing cabinet will work, but when my phone broke I had
             | zero problem restoring my 2FA on my new phone using the
             | backup words.
        
       | jacquesm wrote:
       | This article links to a Google blog post which notes explicitly:
       | "NOTE: The automatic 2SV enrollment will not impact organizations
       | on Google Workspace. Organizations on Google Workspace will
       | continue to have the choice of enrolling their users in 2SV via
       | the admin console."
        
       | jsnell wrote:
       | The title is highly misleading, and is predictably being
       | interpreted as 2SV becoming mandatory for everyone. But that's
       | not what the article text says:
       | 
       | > We will soon start automatically enabling two-step verification
       | for users if their accounts are configured correctly"
       | 
       | And then goes on to speculate about who exactly that group of
       | users is.
        
         | ergot_vacation wrote:
         | Glad this is (at the moment at least) the top comment. Add
         | another to the infinitely growing pile of HN news posts that
         | are either out of date, massively misleading in making a
         | calamity out of a non-issue, or both. Not that it's HN's fault.
         | This is just modern "media." Yeck.
         | 
         | Still, worth griping about 2FA while we're here.
        
           | reaperducer wrote:
           | _Not that it 's HN's fault_
           | 
           | In a way, it is.
           | 
           | A lot of people joined HN searching for a higher level of
           | discussion and thought. And HN is powered by submissions from
           | its users.
           | 
           | What would be nice is if we could get more high-quality
           | submissions to drown out the bots and other low-grade
           | content.
           | 
           | Perhaps if users could filter out submissions by domain. For
           | example, I don't mind seeing nytimes.com submissions, but I
           | don't want to see anything from youtube.com.
           | 
           | But then we're just back to building yet another social media
           | echo chamber. Yuck. Life is hard.
        
           | evandwight wrote:
           | Do you think it would be better to filter the news as a group
           | rather than individually? I find it very frustrating not
           | being able to trust titles.
        
       | dmw_ng wrote:
       | Seems like a great opportunity for folk to reevaluate whether
       | they need a Google account at all. I finally escaped in
       | September, after first trying all the way back in 2011. Dragged
       | my feet for so long until eventually just saying "fuck it" after
       | a few glasses of wine, and even recorded a screen cap of the
       | final GAFYD deletion.
       | 
       | For anyone attempting escape, rclone seems to be the only tool
       | that supports exporting all Google Docs ever shared to the
       | account. Google Takeout (or the equivalent GAFYD tool) worked for
       | everything else
        
         | tablespoon wrote:
         | > Seems like a great opportunity for folk to reevaluate whether
         | they need a Google account at all.
         | 
         | Yeah, but still pretty inconvenient. I migrated all my main
         | stuff way from Google years ago, but I have a bunch of accounts
         | I use as throwaways that will be a much bigger PITA to use.
        
           | dmw_ng wrote:
           | Probably a little easier for me, I stopped adopting anything
           | new from Google for personal use after the Reader episode. I
           | still have access to some business accounts mostly for
           | GCloud.
        
         | ferdowsi wrote:
         | Why would 2FA of all things be the critical issue? Tech savvy
         | people should understand and use hardware security keys at this
         | point to be securing their cloud accounts in general.
        
           | dmw_ng wrote:
           | Tech savvy people often discard browser cookies at every
           | opportunity. Adding a 2FA step to every interaction with
           | Google is a change in routine, and forced routine changes are
           | a great time to break any harmful habit
        
             | dannyw wrote:
             | Firefox Containers. Sandbox Google from the rest of the
             | internet, while still appearing logged-in to Google
             | products.
        
           | [deleted]
        
           | xdennis wrote:
           | Because my email account is that's linked to every other
           | account and I can't afford to lose everything just because
           | I've lost my phone (which has happened twice in the last two
           | years, but recovered it both times).
        
             | r0m4n0 wrote:
             | You have many options including notifications in google
             | apps, authenticator apps, text messages, hardware tokens,
             | written backup codes. Not all of these rely on your phone
             | so set them all up
        
               | KennyBlanken wrote:
               | So in other words dramatically increase the attack
               | surface on my account.
               | 
               | Enabling SMS authentication for an account is a huge
               | DOWNGRADE in security, not an increase. Cellular
               | providers are infamously easy to socially engineer.
        
               | iszomer wrote:
               | Especially some banks that still use SMS as your 2FA.
        
           | toast0 wrote:
           | As a tech savvy person, I used 2fa for all the corporate
           | stuff I could and for some personal stuff too.
           | 
           | Now that I only have one phone, I've turned off 2FA as much
           | as possible, because only one phone means when it breaks, I
           | can't access my accounts, because I can't get to the 2FA
           | tokens. No thanks.
        
             | sct202 wrote:
             | You can add the 2FA authenticator codes to multiple
             | authenticator programs. I usually add them on to 2
             | different devices at the same time.
        
             | artificialLimbs wrote:
             | You didn't read any of those screens warning about you
             | needing the backup codes? I do realize some services don't
             | provide backup codes (which is insane), but when they don't
             | I have found that they provide the codes you can manually
             | type in to authenticator apps. With that, you can add the
             | code in multiple places, like on your phone and also
             | another computer with any totp app like authy or TOFU or
             | whatever to have a 'backup'.
             | 
             | I keep my backup codes in a plain text files in a folder on
             | my home NAS which is encrypted on disk, and backs up
             | through rclone (with encryption) to backblaze every night.
             | I'm about to configure up a second NAS for redundancy
             | because 3 2 1.
        
               | toast0 wrote:
               | > You didn't read any of those screens warning about you
               | needing the backup codes?
               | 
               | I read them, and said, no thanks; I'd rather be able to
               | recover my accounts easily.
        
             | lotsofpulp wrote:
             | I use Keepass with Strongbox and save the database file in
             | iCloud. That way I have TOTP codes backed up, and I can
             | share with others such as my spouse.
        
           | handrous wrote:
           | > Why would 2FA of all things be the critical issue? Tech
           | savvy people should understand and use hardware security keys
           | at this point to be securing their cloud accounts in general.
           | 
           | Yeah, sure, should be.
           | 
           | Meanwhile I've yet to actually _see one_ in the wild, in a 20
           | year career, aside from one that 's used on a server I know
           | of.
           | 
           | Coworkers at small tech companies? Nope. Serious-business
           | clients coming into the office? Don't see them busting out
           | the USB stick and plugging it in to their laptops. Medium-
           | sized tech companies? Nope.
           | 
           | Hell, I'd hate it even worse than phone 2fa. I lose my
           | _actual_ keys all the damn time. 80% of all remote controls
           | in our house are, at any given time, vanished to some other
           | dimension, because I have kids. The last thing I need is
           | another tiny, super-important physical thing to lose. The
           | only reason a _cell phone_ is a useful object to me, and not
           | another annoying thing I can never find, is because of  "Find
           | My".
        
           | browningstreet wrote:
           | Oh c'mon, even tech savvy people are just using email for
           | email.
           | 
           | For me, I have to consider 2FA, or in the case of my son, who
           | doesn't want a phone, a Yubikey or similar. I don't want to
           | live with the additional management and potential disaster of
           | 2FA blocking his access to his email account, which is
           | currently his gateway to university.
           | 
           | At work I have 2FA, but there's a whole IT/IS team to manage
           | and unblock things (which happens, co-workers get blocked out
           | of their email accounts regularly).
           | 
           | Personally, I'm hoping to convince my domain cohorts (family)
           | to move to Protonmail or similar.
        
             | ryandrake wrote:
             | > For me, I have to consider 2FA, or in the case of my son,
             | who doesn't want a phone, a Yubikey or similar. I don't
             | want to live with the additional management and potential
             | disaster of 2FA blocking his access to his email account,
             | which is currently his gateway to university.
             | 
             | This is a good point: For many people, passwords are
             | already too much of a hassle. 2FA is going to be just more
             | hassle. I manage all the passwords for everyone in my
             | family, because they just can't manage to remember theirs
             | (even simple ones like hunter2), and they don't want to use
             | a password manager themselves. I'm sure ours is not the
             | only family in the world who does this. So, the burden
             | falls on me to keep their passwords stored and secure, and
             | tell it to them when they need it. Now add 2FA onto that
             | pile and it's just going to be more of a hassle for me.
        
         | Someone1234 wrote:
         | And move to _what_?
         | 
         | Your choices are:
         | 
         | - Run it yourself: And get eaten alive by third party anti-spam
         | products. Maintaining a mail server is a full time job.
         | 
         | - Move to another large corporation (e.g. Apple, Microsoft, et
         | al). What have you solved exactly?
         | 
         | - Move to a small mail provider and hope they don't go under
         | (and you lose your x year old email address associated with
         | tons of stuff) or have security issues because they
         | didn't/couldn't afford the expertise.
         | 
         | The "least bad" option right now just seems to be to spread
         | yourself around, so you're not too invested in any one vendor
         | (in particular in case they ban you randomly for reasons they
         | won't disclose or discuss).
        
           | dannyw wrote:
           | Domain name with Namecheap, Gandi, $your_favorite_registrar.
           | 
           | Mail provider with any small provider.
           | 
           | Use Thunderbird, it's honestly better that it has been in
           | maintenance-only mode for a decade and isn't being
           | "innovated".
        
           | malka wrote:
           | I use my own domain + small mail provider. If they go under,
           | I just need to change DNS records.
        
           | tomjen3 wrote:
           | I will never again create an email that matters for a domain
           | I don't control. I learned that lesson with my nerdshack
           | account.
        
           | dmw_ng wrote:
           | > The "least bad" option right now just seems to be to spread
           | yourself around
           | 
           | Sounds about right. For e-mail I'm using SES for outbound on
           | my domain, and.. of all things.. Yandex Mail for inbound. SES
           | doesn't seem to have any problem with spam filters, Yandex
           | OTOH, it's definitely a temporary solution, I'm only using it
           | for POP3, but their webmail is also fairly cute. Yandex
           | outbound is treated as spam by basically everything except
           | Yandex
        
           | [deleted]
        
           | BeetleB wrote:
           | Chiming in with what everyone is saying:
           | 
           | 1. Have your own domain name.
           | 
           | 2. Use a small-ish mail provider that supports IMAP, etc.
           | 
           | 3. Store all your emails/folders on a device (laptop,
           | whatever). This way if the provider locks you out or goes
           | under, it's easy to switch to another.
           | 
           | Has worked since what, the 80's? Personally been doing this
           | since before Gmail existed. Ironically I chose this route
           | precisely because the _major_ providers (Yahoo, etc) were too
           | unreliable for me - I had lost accounts multiple times
           | because some of the (then) top mail providers decided to get
           | out of the mail business and /or regressed their featureset
           | so much that it hurt.
           | 
           | Of all the Internet services, this is the easiest one for
           | someone to own.
        
           | marginalia_nu wrote:
           | > Move to a small mail provider and hope they don't go under
           | (and you lose your x year old email address associated with
           | tons of stuff) or have security issues because they
           | didn't/couldn't afford the expertise.
           | 
           | You can also just use an email client that downloads the
           | emails you get, and then point your MX-records to another
           | provider if and when your provider goes belly up.
        
           | stOneskull wrote:
           | i find migadu great, using my own domain names
        
           | nojs wrote:
           | D) go with any vendor but use your own domain. That way if
           | you get randomly banned or they go under you still have the
           | address, and it mostly solves issues with
           | deliverability/being spam filtered.
        
             | johndough wrote:
             | That only shifts the issue from having to trust Google to
             | having to trust the domain registrar. It does not solve the
             | underlying problem.
        
               | throw63738 wrote:
               | you can register domain on your own name.
        
           | Semaphor wrote:
           | HN's darling fastmail has been around for 22 years, I
           | somewhat doubt they'd randomly go under.
           | 
           | On the other hand they are small enough to certainly be hurt
           | by concentrated DDoS attacks as it's been happening the last
           | week.
        
       | Apreche wrote:
       | This article is from May.
        
         | Someone1234 wrote:
         | It is still generating useful discussion though. Sometimes news
         | gets lost, I certainly haven't seen this discussed on HN before
         | today.
        
       | legrande wrote:
       | Got a 2FA prompt for my Google account which said something like:
       | 'Tap the confirm button on your phone to verify it's you'. Just
       | dawned on me I switched to a dumbphone about 5 years ago for
       | privacy reasons and binned my smartphone. So no more Google
       | account for me.
       | 
       | It makes me wonder how many people are going to be locked out of
       | their accounts because of these changes. So many people looking
       | for a human. Sadly Google support is famously terrible, and 99%
       | of queries are just Google replying back saying: 'RTFM' or
       | 'Please refer to the FAQ for support'.
        
         | cromwellian wrote:
         | Then you click "Try another way..." and send a code to SMS, or
         | you use U2F.
        
       | trollski wrote:
       | it is for your own protection. time to switch to outlook.com
        
       | 0x0000000 wrote:
       | Google locking me out of my account, despite me providing valid
       | credentials, was the catalyst in de-googlifying my life.
       | 
       | The inherent tradeoff with information security is convenience.
       | For a personal account, the user should decide where they want to
       | exist on that curve. Google's assumptions that I have perpetual
       | access to a cellular device, or a consistent ISP, are user
       | hostile.
        
         | m-s wrote:
         | I think most users lack understanding to make an informed
         | decision about where they want to be on that curve.
        
           | 29095432 wrote:
           | Absolutely. Additionally, when The Verge runs an article
           | about how "Google doesn't do anything to protect your account
           | even though it's the center of your digital existence", with
           | the story of a user who failed to enable 2FA and had their
           | entire life upended, the retort that "users should be able to
           | decide for themselves where they want to be on the
           | convenience / security curve doesn't play.
        
             | KennyBlanken wrote:
             | This isn't about articles by a site 95% of the population
             | has never heard of and it sure isn't about security if SMS
             | is considered acceptable for the second factor.
             | 
             | Cellular providers have laughable security when it comes to
             | account access and changes. The easiest way to get to
             | someone's money and digital life is to figure out their
             | cell phone company, and then convince them to send you a
             | new SIM card for their account. Presto, instant to their
             | bank account and now their google account.
             | 
             | This is about google wanting to tie more identifying
             | information to a google account, and (by way of making all
             | but "install our app" incredibly annoying) force iOS users
             | to have a Google app on their phone so they know what IP
             | address to associate with you at all times.
             | 
             | I was in the process of stripping Google out of my life and
             | this looks like excellent motivation to speed that along.
        
           | Proven wrote:
           | What's why we need Big Government, too.
        
         | ncann wrote:
         | I also have an old account that despite knowing the correct
         | password AND having access to the recovery email for that
         | account, Google refuses to let me log in and there's no
         | recourse. It's frustrating to say the least.
        
           | gregschlom wrote:
           | I've been through the process of recovering an old account
           | and I can share some tips, feel free to email me if you'd
           | like (address in my profile)
        
             | DoingIsLearning wrote:
             | Please consider doing a write up on how you resolved this?
             | There must be thousands of people impacted by this.
             | 
             | I've also had this situation when relocating countries. I
             | had to abandon a 15 year old account (for which I also had
             | a valid working recovery email) with a lot of issues
             | recovering online banking etc. (Had to physically travel to
             | another country to restore multiple services associated
             | with the account).
             | 
             | I'm with fastmail now. I will never again depend on a mail
             | service that I am not paying for.
        
               | ygram wrote:
               | You need to own the domain in your email adress, then the
               | email provider does not matter that much.
        
           | topicseed wrote:
           | How did you regain access in the end? That's the only worry I
           | have with relying on Google services so much...
        
             | ncann wrote:
             | I never regained access to it. It's just an old account
             | that I only used for a brief period of time so I don't
             | think there's anything valuable in there, but it still
             | sucks nonetheless.
        
       | mattowen_uk wrote:
       | Ok, I know I'm shouting into the wind on this one, but I really
       | dislike 2FA. Like the CCV code on the back of your credit card,
       | it only exists to give the provider a 'get out of jail' free card
       | if your access is comprised.
       | 
       | As long as I have a nice strong password, why do I need 2FA?
       | 
       | Also, _normal_ people share accounts. This is a known fact. By
       | enforcing 2FA, the provider is preventing the other users of the
       | account access if they don 't have the registered phone or
       | yubikey type device with them.
       | 
       | Of course this is what they WANT. They absolutely want to force a
       | one person, one account system, so that the data collection for
       | advertising isn't muddled by multiple people using the account.
       | 
       | What I would like to see is a separation between the 'logon' and
       | the 'service'. This would be a system where there can be multiple
       | users accessing, say, a shared mailbox. In this way 2FA would not
       | create a barrier for access.
       | 
       | Another good example would be a shared Amazon account that is
       | used by a couple. The account is set up to pull payments from a
       | joint bank account, if 2FA was enforced (and I'm sure it's coming
       | to Amazon), then only one of the couple would be able to use it.
       | 
       | Generationally, older people are used to joint finances, and they
       | are not all dead yet, but are being forced into a usage model
       | dreamt up by someone who has no appreciation that the one person,
       | one account system is not something that fits everyone.
       | 
       | I know my view on this is not in line with the group think on
       | Hacker News, but it's something I feel very strongly about.
       | Providers need to fix the multiple account user problem first,
       | before enforcing 2FA.
       | 
       | Before you just think "Disagree!" and vote me down, why not reply
       | with your viewpoint?
        
         | forty wrote:
         | You can store your 2FA in a password manager, and use it to
         | share it with people.
         | 
         | (I work for Dashlane which supports this, but I'm sure some
         | other PM can also do this)
        
           | mattowen_uk wrote:
           | Password Managers all have the concept of a 'Primary' user,
           | who shares access to passwords etc. with 'Secondary' users.
           | The primary can cut off the secondary at any point, but not
           | the other way around. For couples/groups where everyone has
           | equal standing, this model doesn't work.
           | 
           | Also a lot of 2FAs are based around authenticator apps which
           | can only be installed onto one device at a time.
        
             | forty wrote:
             | It's not the case in Dashlane at least. If you share a
             | password with "full rights", all users have the same access
             | to the password, and can cut off the others at any time.
        
       | t0bia_s wrote:
       | So basically another data harvesting from Google. They want ID
       | scans for YT, mobile phone to login... What else? Selfie for
       | gmail?
       | 
       | Fortunately I do not use anything from google over 2 years, so it
       | is not problem for me, but I cannot imagine frustrations for
       | everyone, that needs their data from google and they are
       | systematically forced to share more and more personal data with
       | them.
        
         | jfrunyon wrote:
         | It's pretty clear that they're only turning it on for people
         | for whom they already have the appropriate data.
         | 
         | You can also use any of the many other 2FA methods they
         | support, like standard TOTP, a security key, or even by simply
         | rotating a sheet of scratch codes.
        
       | margofx wrote:
       | Google's 2FA doesn't make sense. The 2FA bugs sometimes tried to
       | log in to a brand new laptop, and it automatically logged me in
       | without any asking for verification.
        
       | officeplant wrote:
       | Been using google prompt 2-step since they first started offering
       | it a while back. Gotta say its the most painless 2-factor
       | authentication of any account I actively use. Although its a bit
       | clunky to have to open gmail on an iphone to get the prompt when
       | I'm not dailying an android phone for testing reasons.
        
       ___________________________________________________________________
       (page generated 2021-11-03 23:02 UTC)