Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

What is the advantage of Google forcing me to keep me cellphone on, working and with me at all times? It just seems like this will prevent me from using my account some time in the future when I don't have my phone and I'll want to login. It's a huge drawback of the authentication relying on the cellphone for sending and checking verification codes. Why must I now have me phone to keep secure?

share|improve this question
add comment

2 Answers 2

What is the advantage of Google forcing me to keep me cellphone on, working and with me at all times

The point being if your password is stolen/compromised, there's an additional step required before it can be accessed by the attacker.

keep me cellphone on, working and with me at all times

when I don't have my phone and I'll want to login

Why must I now have me phone to keep secure?

You have a misconception that your phone is a must - no, it's not. It's not a must to have your cellphone with you all the time. Google offers 10, 1-time backup codes, which can be regenerated, that you can refer to enter the codes if you don't have your cellphone.

Why must I now have me phone to keep secure?

Again, you don't have to. It's for additional safety. By all means, don't use 2-factor authentication. Just don't come crying & blaming Google for not offering more stringent security mechanisms if your account gets compromised

share|improve this answer
add comment

Using two-step authentication with the Google Authenticator app is kind of like using an RSA key or other security token for logging in. It adds an additional layer of security to your account, augmenting the "something you know" portion (password) with a "something you have" (cellphone) option as well. It is not required, but the use of this code makes it much harder for someone to gain access to your account.

In reality, you don't have to use the cell phone every time you want to access your account. When logging in from a computer that you consider "safe" (for example, your home or work computer) you can log in using the phone code and then check the box that says "Don't ask again for this computer." From then on, you should only need your normal password. (This is per browser though, and I think they still do random "re-enter the code" checks every month or so.)

If you utilize an email program, like Mozilla Thunderbird or Microsoft Outlook, then you don't need the phone either. In your settings, under the two-step section, there is a link for managing application-specific passwords. You use these when first setting up the connection via the application, and Google generates a random password for you to enter on setup. You have to make sure to save the password in your mail program, but you won't be asked to enter it anymore unless you reset your program.

Finally, as Sathya mentioned, Google provides a printable set of backup codes that you can keep somewhere safe in the event that you lose your phone. If your phone can no longer provide you the code (because it's broken, lost, or otherwise compromised) then you can use one of these codes to get access to your account so you can remove the two-step security or add in a different phone.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.