How-To

How To Enable Two Factor Auth for Google Accounts and Why You Should

By Steve Krause

Updated November 15, 2023

In this day and age of Malware bots and 0 day exploits, adding two factor authentication to your email accounts is no longer optional in my opinion. Here’s the simple process for enabling Google’s 2-Step Verification feature to your account.

There are very few things that could happen in my life that would be worse than having my personal email accounts compromised. Not only is it a significant invasion of privacy, but it’s also just the start of what could lead to a complete privacy meltdown of my life. I say this because once someone gains access to an email account, the attacker could use it to unlock other accounts using the “I forgot my password” feature common on most sites, including my personal blogs, Paypal accounts, online banking, Dropbox and of course all of the data sitting in my Google Apps accounts (Inbox, Calendar, Contacts, etc…).

The team over at Google showed they understood this problem and implemented a Groovy security feature to help protect against it called 2 Step Verification (also known as two-factor authentication). We did a full write-up of the security feature over a year ago; however, in light of all the security events on the net recently — I think it’s time we revisit Google’s 2-Step Verification in an attempt to remind everyone to get it enabled ASAP.

Before Enabling Google 2-Step Verification

A few things to note before we enable Google’s 2-step verification on your account.

1. Enabling 2-step verification will break email being delivered to your mobile device or Email Client via iMap or any other application like forum.groovypost.com, which uses Google to authenticate you. Google allows you to create a one-off or application-specific password for these apps/services. Only takes a few seconds to do, but FYI.
2. It’s important to set up a backup phone/device after enabling 2-step verification to prevent locking yourself out of your account. A backup phone can be set up to send TXT message codes or codes via a voice phone call. The process is simple but very important. Don’t skip this step.
3. After 2-step Verification has been enabled on your account, download and install the Google Authenticator App for your mobile. This will save you cash since you won’t need Google to send you text messages any longer.
4. That’s it. Continue forward and enable some delicious, groovy Google security goodness right now.

How To Enable Google 2-Step Verification

Login into your Gmail account and click your username at the top. This will open a context menu. Click Account under your name.

Note – If you’re a Google Apps user, your System Administrator will need to enable 2-Step Authorization in the Admin console before the feature will be available for your account.

Click Security.

Under 2-step verification, Click Edit.

Sign in again when prompted (they make you log in again for security reasons).

Get out your Mobile Phone and Click Start setup >>.

Enter your Phone number and Click Send Code (note – do not use your Google Voice number. You need a mobile phone).

Google will send you a 6-digit TXT message to your phone. Enter it and click Verify.

By default, Google will trust the computer you’re currently using and not require the use of the 2-step verification from it for 30 days. I’m actually OK with this since my laptop never leaves me at any time, and I have a solid AV solution installed, so I’m 99% confident I don’t have any malware installed.

For maximum security, however, feel free to uncheck it. However, getting started, I recommend just keeping with the default.

Many applications on the net use your Google account to log in. However, they don’t have an interface to ask for the 2-step verification code. The same goes for Mobile devices like my iPhone since email is delivered in real-time. In these cases, Google allows you to create passwords for these devices. I’ll cover this in more detail later, so forge ahead by clicking Create passwords or clicking Do this later to set them up later.

All done. 2-step verification for your Google Account is now enabled.

Note: Before you continue and test things out, I HIGHLY recommend you set up a backup phone just in case you lose your phone and need to log in to your account. Just click the Add a phone number link as shown above, and it will walk you through the simple process.

To test things out, log out of your Google account by clicking your username and Sign out.

When logging in, you will notice that after entering your Google username and password, Google will send your mobile phone a TXT message with a new six-digit code and prompt you to enter it. Note, if you prefer not to have Google send you text messages, download and install the Google Authenticator app for your Android or iPhone Mobile. It’s free and simple to use.

Enter the code and click Verify.

In this day and age of Malware bots and 0-day exploits, adding two-factor authentication to your email accounts is no longer optional, in my opinion. Although a bit inconvenient, it’s definitely better to spend a few minutes a day to keep your account and digital life secure than working weeks or even years cleaning up from an account compromise.