If you still don't have two-factor authentication on your Google account, don’t be surprised if the company requires you to adopt it.
Google saw a notable decrease in password-based account hijackings after it automatically enrolled 150 million users into what it calls two-step verification (2SV), so it now plans to auto-enroll even more accounts. "In 2022, we’ll continue our 2SV auto enrollments, make signing in even more seamless," the company wrote in a blog post.
Google didn’t say which users will get the two-factor push, but after it expanded the 2SV adoption to 150 million users, "we have seen a 50% decrease in accounts being compromised compared to those not enrolled,” the company said.
Two-factor authentication adds an extra step to the login process. This means if a hacker gets a hold of your password, it won’t be enough to break into your account. Instead, under many two-factor authentication processes, the hacker will also need access to your smartphone.
Google didn’t say if the company’s 2SV system is stymying all hijacking attempts. But the company said the 50% decrease in hijackings “speaks volumes to how effective having a second form of verification can be in protecting your data and personal information.”
Indeed, security experts in general recommend every user should activate two-factor authentication on their most important accounts. But that said, the security safeguard isn’t always convenient or flawless, especially SMS-based two-factor authentication.
In Google’s case, the company has been trying to make two-factor authentication convenient by issuing a login prompt to the account holder’s smartphone after the correct password is successfully entered. Tapping the word "yes" on the prompt will then complete the login process.
Google added: “We are actively working on technologies that provide a secure, seamless sign-in experience and eliminate reliance on passwords—as passwords are often involved in data breaches, phishing attempts, are hard to remember, and a pain to constantly update.” (For example, the company already allows users to secure their accounts with a hardware-based security key.)
If you're not a fan of 2SV auto-enrollment, you'll be able to opt out. "Users who will be auto enrolled will receive a notice 7 days prior to the day they will be automatically enrolled," Guemmy Kim, director of product management at Google, told us. "At this stage, users can opt out if they want to. However, we encourage everyone to learn more about 2SV and how important it is in helping to protect our accounts, especially as passwords become more vulnerable to hacking."
Kim also indicated 2SV will only be rolled out to users with a recovery email and phone number registered with their accounts. "We’ve already enrolled users that we deem to be early adopters and whose accounts were 2SV ready," she said while adding: "There is a lot of educating that needs to happen with 2SV and we want users to understand what it is and why it’s beneficial."