Few Gmail Users Enable Two-Factor Authentication

Few Gmail Users Enable Two-Factor Authentication

Cybersecurity is an ongoing problem, with critical flaws and weaknesses ranging from ongoing research into how best to break fundamental aspects of CPU architectures to users perennial terrible choice of passwords. All in all, it’s not a cheerful situation, and new data from Google doesn’t exactly improve things.

In a presentation at Usenix’s Enigma 2018 security conference, Google engineer Grzegorz Milka revealed that less than 10 percent of Gmail users have two-factor authentication enabled and just 12 percent have a password manager installed on their browsers. Given the high-profile security failures of password managers, including LastPass, I can’t exactly blame people for not using them — it’s not as if they’ve got great reputations — but using password managers is one way to create strong passwords that have less chance of being cracked.

The Register notes that this actually squares up with what the majority of its readers thought, with 82 percent correctly picking the 10 percent or less figure. Milka’s response as to why Google didn’t require two-factor authentication is telling.

“The answer is usability,” Milka told The Reg. “It’s about how many people would we drive out if we force them to use additional security.”

Image by The Register
Image by The Register

This response echoes Marissa Mayer’s reasoning for why two-factor security authentication or additional security measures weren’t deployed at Yahoo, and we saw how well that turned out. It became the largest known hack in history, as far as how many accounts were compromised.

It’s genuinely tempting to write something along the lines of “It’s hard to blame Google.” Customers don’t generally care about security until they’re the ones being breached. Making two-factor authentication mandatory could result in some users moving to other platforms. But in the wake of Yahoo’s breach, I can’t make that argument.

First, it’d be hypocritical to slam Yahoo’s failure to protect its users, then champion Google’s refusal to do the same thing. But second, humans are terrible at evaluating risks and often take chances they shouldn’t. They also routinely undervalue data. Extra hard drives are dirt cheap and easily purchased. Backup software solutions are highly advanced and easy to use. And yet, most people don’t make regular backups of their own data. They certainly don’t take adequate steps to protect their own online information.

Google should enable two-factor authentication by default, with an option to disable it should people not want it. It’s the right thing to do for people who don’t otherwise understand why the feature is so important. But given that the company is unlikely to do so, we strongly recommend you take the step yourself.

Continue reading

Google Rolls Out Redesigned Gmail

The new design is rolling out now, and you can give it a shot in a few clicks.

The Moon May Have Once Had a Magma Ocean Beneath the Surface

An inter-university team suggests that the moon's mantle was once a tumultuous sea of magma.

Google Removes Gendered Pronouns From Gmail’s Smart Compose Feature

Google's Smart Compose feature doesn't try to predict the gender of the person you're emailing, because the company hasn't figured out how to actually predict it with complete accuracy. Smart move.

Hackers Use Phishing Emails to Harvest Two-Factor Gmail Codes

Conventional wisdom says that adding two-factor authentication (2FA) will keep your accounts safe from most phishing scams, but a new wave of sophisticated automated attacks is reminding us it isn't infallible.