Google Enables '2-Step Verification' as Default

Google is switching on two-factor authentication by default for 150 million users. It's also making it mandatory for two million people who upload videos to YouTube.

The system means no longer relying on passwords as the only way to control access to account. Instead it adds a second method such as getting a security code on a particular phone.

Two-Factor versus "Two-Step" Verification

Google calls the concept two-step verification, though that doesn't really describe it properly. The more commonly used "two factor" term refers to the idea of combining different types of authentication and identification such as "something you know" (the password) and "something you have" (the phone or a USB security key).

The way two-factor authentication works is usually designed as a compromise between convenience and security. For example, a common set-up is that a password is enough to access an account from the user's home computer. An attempted log-in from a PC in another location will trigger the security code.

Tap To Confirm

Although Google strongly encourages two-factor authentication on its account, it appears it is disappointed by the proportion of people who've taken it up. That's why it's now making it the default option for some users, meaning they'll have to actively disable it if they want. (Source: theregister.com)

Google says it has chosen the 150 million users by looking for "Google accounts that have the proper backup mechanisms in place to make a seamless transition to 2SV." (Source: blog.google)

That appears to mean people who have an Android phone on which they use their Google account. In this case the secondary check won't be a code sent by text message but rather an on-screen prompt that simply requires a tap.

YouTubers Get No Option

Two-step verification / two-factor authentication will also become mandatory for the two million YouTube users who are enrolled in the site's partner program. That means they are entitled to a proportion of revenue from ads shown before or beside their videos.

While making the security mandatory is a strong step, Google's logic appears to be that security breaches of such accounts could be particularly serious. For example, an attacker could change account settings to siphon off revenue payments, or use the account to distribute malicious videos to a large in-build audience.

What's Your Opinion?

Do you use two-factor authentication on any accounts? Is Google right to make it the default for many users? Are you happy with the balance of convenience and security on your online accounts?