Google says it will start verifying users with 2FA enabled using a prompt on their phones, and will soon start automatically enabling 2FA for all users
The company is making some changes to encourage more people to adopt a key digital security mechanism. — Lorenzo Franceschi-Bicchierai
VICELorenzo Franceschi-Bicchierai
Context & Ripple Effects
Google had already been moving account verification onto phones, first through a phone-notification login test and later by allowing Android 7.0-or-newer devices to serve as security keys for two-factor authentication. The reported policy change turns that mobile-authentication path from an opt-in security feature into Google’s default account posture.
It also establishes the account-level foundation for Google’s later default passkey prompts, making this an early step in a longer migration away from passwords as the primary login control.
First-order effects
Google users with 2FA enabled will verify sign-ins through phone prompts, while users without 2FA are slated to have the protection enabled automatically.
Google assumes a more active role in setting the security baseline for its account holders rather than leaving two-factor enrollment entirely to user choice.
Second-order effects
Android devices become more central to Google account access because the phone is both the prompt destination and, under Google’s earlier policy, a potential security key.
Users accustomed to phone-prompt verification have a clearer path toward Google’s later passkey-based sign-in flow, reducing the role of passwords in routine account access.
Third-order effects
Google’s account-security design shifts toward platform-managed defaults: the provider chooses stronger authentication settings and uses devices it supports to deliver them.
The subsequent move to default passkey prompts suggests a broader transition from optional add-on authentication to password-light account access, with Google controlling much of the migration path.
The trend: Major platforms are making stronger authentication the default and using device-integrated prompts and passkeys to reduce dependence on passwords.
NEW: Google wants everyone of its users to turn on two-factor authentication. Step 1: Verify users via prompt on their phones. Step 2: Push them to turn on 2FA “We have begun automatically enrolling a small user group” then will expand. https://www.vice.com/...
Google Will Automatically Enroll Users in Two-Factor Authentication Soon 🔒 Google hates passwords, so it's trying to replace them with two-factor authentication #technology #security #2FA by @MarkHachman https://www.pcworld.com/... https://twitter.com/...
Passwords are the single biggest threat to your online security - they're easy to steal, they're hard to remember, and managing them is tedious. 😅 Today on #WorldPasswordDay, see how @Google is making password management easier & safer. https://blog.google/...
Stay secure 🔒 this #WorldPasswordDay by making sure your account is protected with 2️⃣-Step Verification. Learn more about keeping your account secure → https://blog.google/... https://twitter.com/...
Today is #WorldPasswordDay! Someday, we'll get to deprecate this holiday, but until then it's important we give people great tools. Here's a feature update from my @Google colleague @mrisher who is fighting the good fight on keeping Passwords safe. https://blog.google/...
This will have a significant positive impact if it succeeds. For many people their personal email is core to their online identity as it is often used to sign up for most online services, and for those services to send reset password requests to. https://twitter.com/...
This is going to be a challenge for folks at the very low end of technical clue. Elderly folks who can't/don't SMS or even don't have cellphones, for instance. It's a huge security boost but could be a big new digital divide barrier to entry. https://twitter.com/...
If done well - so impactful. Gmail isn't just an incredibly popular email service, it's the center of digital life for millions. Password restoration for dozens of services including finance, social media, shopping, and health. A trove of sensitive personal data spanning years. h…