Google Improves Two-Factor Activation Security

In addition to SMS, Google has finally decided to offer other identity verification methods when enabling two-factor authentication to unlock access to a Google account. Very good news for data security.

Until now, when activating two-factor authentication (2FA) to protect access to a Google account, the search engine only offered to enter a phone number. In return, the user received a code to enter to validate the verification. But we know how insecure SMS are: hackers can intercept messages, SMS are not end-to-end encrypted…

Read SIM card scam: how to prevent your phone number from being hacked?

This will change: during the 2FA security activation process, Google will offer to use its Authenticator app, which generates validation codes, or a Yubikey-type physical key. Both types of 2FA credentials could be used after initial verification; now, they will also be able to validate the user’s identity when activating 2FA.

No longer requiring a phone number will be particularly useful within businesses and organizations, notes Google. But individuals will also be able to benefit from it. Users using a physical key will have the option to create a passkey on the key itself.

Additionally, if a user disables two-factor authentication, the second factor (whether through a backup code, Google Authenticator, or via smartphone) will no longer be automatically removed from the account. This will avoid redoing the entire process when reactivating 2FA. The deployment of these new features began on May 6 and should be visible now.