Google two-factor authentication

We have just enabled Google two-factor authentication after a recent hack of a gmail attack took over one of our  gmail accounts.  We won’t bother with a how-to as this information is easy to get from googling around.  This is more about the side effects and ramifications of going this route.  Google is now a part of our life in the cloud.  Our private data is worth protecting. Two factor authentication makes Google a lot more secure, at the price of complexity.

Here’s a short list of what is affected

  1. Home computer:  this is where the change was started – on the home computer gmail account.
  2. Android cell phone gmail ( I created a “gmail on android” application password.  The  xyl did not need to do this – ??)
  3. laptop computer – macbook – on login gmail sent a one time key to my cell.
  4. work computer – at work I can’t bring in a cell phone so I had google create 10 one-time keys and we’ll use one there.

Once a device is known to the GMAIL service up in the cloud, the service will log you in automatically for 30 days.  After that it will ask for two-factor authentication to renew service.  In effect you must authenticate once a month.

Two factor authentication requires you to know your password AND to be in possession of information that only you can have (i.e. something you know and something you “have”).  What you have is one of the following: 1) a cell phone to receive one-time login keys,  2)a land-line or other phone # to get phone call, or 3) a list of ten eight digit “one-time codes”.  The case of #3 is intresting – what you get is in effect 10 one time decryption keys, one of the most secure crypto keys possible, but since they can be used only once, are for special situations. Examples, you are using mom’s computer and her phone doesn’t work and you don’t have cell reception to receive a key by text.  Another case is work, where I won’t have access to my cell phone. 

There is also a google app (Google Authenticator)  that once set up will deliver keys that change every minute.  Google did their homework on the crypto aspect – impressive.

Welcome fans, to Google Network Stadium, and world series of network security!




Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: