Forum Moderators: open

Message Too Old, No Replies

Gmail forcing me to use 2FA in text message format

         

CrimsonGirl

10:02 pm on Jul 21, 2022 (gmt 0)

10+ Year Member



I've had a Gmail account since early days - 2004 or 2005. A few weeks ago I logged in and they made me change my password. I had a long, difficult-to-guess password, but hadn't changed it in a while. So while I thought it odd that Google would force this change, I wasn't too upset.

About a week later they got me really mad, however. They sent me a message saying they were forcing me to start using 2FA by text message. I know 2FA is recommended for security purposes (I use it for banking) but I didn't think Google would force it on me. This is only for my main Gmail account, not the minor ones. And they didn't give me the option of using Google Authenticator or receiving a phone call; it has to be a text message.

Gmail is free, so I shouldn't complain, but this will be a hassle. I'm not someone who brings her phone everywhere, and even when it is handy, this will slow me down.

Seriously thinking about switching email providers. I recently opened an AOL email account. No drama there.

Wilburforce

10:53 pm on Jul 21, 2022 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



I'm not sure how much this will affect you in practice, as although my gmail account uses 2FA, you can enable specific devices and browsers to bypass it, so unless you;re logging into gmail from other people's devices (including internet cafes) - where, arguably, 2FA should be enabled - you're not going to need your phone if you've already cleared your iPad.

However, Google is definitely ramping up security in all areas, not all of it unnecessarily in my view (and 2FA also helps Google limit the number of hackers and spammers using gmail as the email equivalent of a burner phone). If the security of your own emails isn't a major concern to you, then switching providers might offer some relief, at least temporarily.

engine

7:32 am on Jul 22, 2022 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



I'm a supporter of 2FA, but forcing text messages can be problematic because of the delays experienced in processing the message and delivery.
Authenticator would seem a better option, imho.

Protect your email: So much bad can be done when it's hijacked.

Wilburforce

9:20 am on Jul 22, 2022 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



delays experienced in processing the message


Yes, text-only can be troublesome. NHS is text-only, and I had a day a few weeks back where the online dialogue kept timing out before the text arrived.

However, G allows several 2FA alternatives (under 2-Step Verification settings - I assume my account is like any other), including device-recognition, voice-message (to the same or another number), backup codes, Authenticator app, and Security Key. There is also (top-right) a Turn Off button for anyone who already has their Security Paranoia turned off (which, for better or worse, I don't). It doesn't look to me like a policy designed to make the bona-fide user's life difficult.

The main drawback is that all of the On features assume access to the device, the app, the codes, or whatever else, which won't be the case if you are signing in as a guest on a third party device or network - where 2FA would be of the greatest benefit - without any of your own devices with you.

There is an obvious trade-off between having Instant Easy Access to Everything and having an open door to criminals, spies and disreputable journalists. 2FA isn't a perfect solution, but it is largely effective, and I have many online accounts that have implemented it. I certainly find it less trouble than biometrics that don't recognise me in strong sunlight or with a cut finger, or (when my phone-screen cracked) having one corner of the pattern inaccessible.

Robert Charlton

12:49 pm on Aug 12, 2022 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



I'm not someone who brings her phone everywhere, and even when it is handy, this will slow me down.

Ditto. It's not just Gmail, though. I'm finding that many telephone systems of large enterprises (like my health plan, or the DMV) are using text messages to notify callers when it's their turn, so they can retain their place in line. Otherwise, you wait on hold for 45 minutes.

The social engineers are assuming that everybody is always plugged in, and texting is the way many vital messages are starting to be sent. .

I can see this getting more complex as well, as Google has begun to call out Apple for not adhering to the industry standards on texting. On Thursday I received a "News From Google" keyword newsletter, which had this dramatic subject line...
"Bad news: Texting is broken"

There are several links provided in the newsletter, which feed into a social media campaign. This on Twitter provides the best overview I found...

[twitter.com...]
It’s time for Apple to fix texting.
Texting between iPhones and Android is broken. It’s time for Apple to fix green and blue bubbles, and texting for everyone