11

I am trying to enable two-factor authentication (2FA) on a Google account, but I'm running into a dead end trying to activate it.

I'm using an up-to-date Firefox browser.

When I try to enable 2FA, Google offers me three options:

  • SMS code
  • Security key
  • Google-prompt

I am not looking for SMS-codes (considered deprecated as a security measure) or Google-prompt; I would like a full 2FA solution.

A security key is an option, but apparently, I can't use it because Google doesn't offer WebAuthn (which my browsers support), but offers the older FIDO U2F standard instead. The option to activate a security key just silently fails.

That leaves no options in that list, but to my knowledge, Google also supports TOTP authentication. To activate this Google documents a process where I go to the settings of their Gmail app on an Android or IOS smartphone, but I have neither. I do have a device that supports TOTP authentication: I just need the secret key or the QR-code.

How can I get this TOTP key and activate TOTP 2FA in my Google account?

Improve this question

1 Answer 1

Reset to default
12

TOTP 2FA can only be used as a secondary/backup 2-factor authentication method on Google accounts, and you must set up 2-factor authentication with one of the three supported primary 2FA methods (I suggest using your FIDO U2F security key — see below for instructions on getting that working) prior to being able to set up and use TOTP as a 2FA method with your Google account.

The reason you're having issues using your FIDO U2F security key on Firefox with your Google account is because while credentials registered using the FIDO U2F API can be validated using either the FIDO U2F API or the newer WebAuthn API, the reverse is not true. Google's planned migration to WebAuthn has fallen far behind schedule due to widespread issues with support on Android devices that are not going to be fixed anytime in the near future (many Android devices only support the FIDO U2F API), and while the Firefox developers do have a partial implementation of U2F hidden behind the security.webauth.u2f flag in about:config, said implementation does not currently permit signing operations.

The simple answer for the short term is to perform the initial setup of 2-factor authentication with your FIDO U2F security key on your Google account using a different browser such as Chrome.

In the slightly longer term, if implementation of the changes in this Mozilla bug entry keeps moving forwards, you should see U2F registration support for Google arrive alongside security.webauth.u2f being enabled by default with the release of Firefox 67 or maybe Firefox 68.

Additional reading:

Improve this answer
2
  • 6
    It works. After enabling Google's legacy FIDO U2F method I can indeed enable TOTP. After that, it becomes possible to remove the FIDO U2F method and login using TOTP. Weird.
    – JeroenHoek
    Commented Apr 15, 2019 at 7:14
  • 1
    Thanks for this insight. I've confirmed I can add a phone number for SMS 2FA, then add TOTP 2FA (which then shows as “Default”), and finally remove the SMS 2FA.
    – Quinn Comendant
    Commented Feb 5, 2022 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.