It’s Google to make the internet a safer place-by default.

Two-factor authentication (2FA) adds a huge level of security to your applications, but only if it is turned on. By the end of 2021, Google plans to replace more than 150 million Google users and force 2 million YouTubers to enable setup. 2FA has been available through Google for years, and in 2018 only 10% of the accounts used it. People just don’t seem to bother with everything that isn’t included by default. Google rival Apple knows this, so it has been aggressive in automatically selecting users for new security and privacy features.

“As Google found when they enforced two-factor authorization for their employees and high-value goals, account compromises due to phishing effectively evaporate when two-factor authentication is enabled,” Bobby DeSimone, the founder and CEO of Pomerium, a security service that also enforces two-factor authentication, told Lifewire by email.

“Google’s default two-factor authentication is a commendable step forward in spreading this success to wider Gmail users. In particular, it encourages the use of even more powerful two-factor methods, such as device keys, by default.”

What is 2FA?

Two-factor authentication (2FA), also called two-step authentication (2SV) or one-time passwords (OTP), is an additional way to authenticate when you log in to your account. You’ve almost certainly used it before. When you enter a password, the site requires a temporary code that you receive via SMS or generated in an application such as Google Authenticator, 1Password, Authy, and more. This code is only suitable for one use and expires after a short time.

The problem is that it’s usually available as an optional extra, which means most people don’t bother to turn it on. After all, if you’re happy to use your dog’s birthday as a password for all your accounts, then why would you care?

By imposing 2FA on its users, Google seriously upgrade their security. And it won’t even be too strenuous to use. Google’s implementation requires only one more touch – no need to copy and paste numeric codes.

“2SV has been at the core of Google’s own security practices, and today, with Google’s call, we allow our users to operate smoothly, requiring a simple touch of your mobile device to prove you really want to sign in,” wrote Google’s AbdelKarim Mardini and Guemmy Kim va blog post.

The power of the default settings

We rarely try to change the default settings. Even so-called powerful users leave many settings alone. If the photo editing app exports JPGs, then we use JPGs. After all, whoever made the app probably knows more about it than we do, right?

What about when the password-free Wi-Fi routers opened? We could provide a password, but who bothered?

“The vast majority of security issues do not stem from systems or technology, but from behavior Nobel Prize in Economic Research how strong the default settings are in “encouraging” people’s behavior, “says DeSimone.” We’re excited that companies like Google and Apple are “encouraging” their customers to use more powerful authentication methods. “

Recently, Apple added all sorts of privacy features to iOS 14 and iOS 15, and many of these were turned on by default. Transparency of application trackingfor example, it allows iPhone and iPad users to prevent apps from tracking over the Internet. Although these apps are not blocked by default, the blocking box is enabled, which means it has to ask you every time the app wants to follow you. And of course, most users will reject this.

Another illustration of the power of default settings is Google Search. Almost no one changes the search engine in their browser, even though it has been easy for some time. This default value is so valuable that Google pays Apple an estimates $ 15 billion a year, just to keep the default search in Safari.

If that doesn’t show how strong the default values ​​are, I don’t know what it does.