Has Google enabled two-step verification for all users?

Not for everyone, but for a great many: in February 2022, Google announced that it had automatically turned on two-step verification for more than 150 million accounts and made it mandatory for more than 2 million YouTube creators, and that among enrolled users the number of compromised accounts had dropped by 50% (9to5Google). If two-step verification isn’t on for your account yet, you can turn it on yourself in a few minutes, as we show below.

As you probably know, the biggest security problem is still the use of weak passwords, the same password in several places, or passwords written down on notes and in other places where they can easily be found.

A strong password has at least 12 characters, and length matters more than complexity: a long passphrase that’s easy to remember is harder to crack than a short password full of symbols. You’ll find more tips in the article with basic rules for creating secure passwords.

If the organization’s policy is too strict, users will most likely choose a password that’s hard to remember and write it down somewhere, which opens a security hole. If the policy doesn’t require long passwords, attackers can easily guess or crack them.

Password managers can be used, but even these aren’t completely safe, as the compromise of passwords from more than 29,000 companies showed. Still, a good password manager, protected by a long master password and by two-step verification, remains much safer than reused passwords or passwords written on notes.

An effective method that adds an extra layer of protection is two-step verification. Even if the password is compromised, an attacker also needs the device set up to confirm the sign-in (the code received by text message, the app notification or the security key).

What did Google announce in May 2021?

In May 2021, according to BleepingComputer, Google announced that it planned to turn on two-step verification by default for all properly configured accounts.

The first step was that users who already had two-step verification turned on would be asked to confirm their identity on their phone whenever they signed in to a Google service: they received a notification through which they authorized the sign-in. In the fall of 2021, Google began enrolling accounts automatically, and in February 2022 it announced the results mentioned at the start of this article.

How does two-step verification work?

Two-step verification means confirming access from a second device after the password is entered. A Google account supports several methods, from the weakest to the most secure:

• A code received by text message. It’s better than nothing, but it’s the weakest method: an attacker can take over the phone number through SIM card fraud (SIM swap) or ask for the code through a phishing message.
• A notification on your phone or a code from the Google Authenticator app. These don’t depend on the mobile network and are harder to intercept.
• A security key, over USB or NFC, and passkeys, available for Google accounts since 2023: they replace the password with your fingerprint, face recognition or phone PIN and can’t be used on a fake website, so they resist phishing.

Once turned on, two-step verification makes life much harder for anyone who wants to access your accounts: to compromise a protected account, the attacker also needs access to the device used for confirmation.

How do you turn on two-step verification in your Google account?

1. Go to your Google account, under Security, and open 2-Step Verification (or go directly to the 2-Step Verification enrollment page).
2. Add your phone number or approve the notification on the phone you’re signed in on.
3. Add at least one backup method: the Google Authenticator app, a security key or a passkey.
4. Generate backup codes and keep them somewhere safe, so you don’t lose access to your account if you lose your phone.

What do we recommend for companies?

• Enforce two-step verification for all company accounts. In Google Workspace and Microsoft 365, the administrator can make it mandatory for all users, not just recommended.
• Security keys or passkeys for sensitive accounts: administrators, accounting, management.
• Watch out for notifications you didn’t request. Attackers who have learned a password send notification after notification until the user gets tired and approves one. Never approve a sign-in you didn’t start yourself.
• Close the accounts of people who leave and remove their phones from the confirmation methods.
• Train your team to recognize phishing, because attacks go after exactly these confirmation codes: see what to do so you don’t fall victim to phishing attacks and how to turn on two-step verification (2FA) for Zoom.

For laptops used to work from home, see also mandatory security measures for work laptops used at home.

RezolvIT sets up two-step verification for company accounts, in Google Workspace or Microsoft 365, as part of IT security. If you want to know how well the accounts in your company are protected, we’ll start with a free IT audit.