Does Google's 2-factor authentication only care about the mobile phone number?

July 21, 2012 6:25 PM

I have a question about Google's 2-factor authentication and upgrading to a new device. Can you help?

I have Google 2-factor authentication enabled for my primary Gmail account.

I qualify for a new smartphone upgrade. Can I upgrade to a new handheld device without worrying about getting locked out of my Google account? Does Google's 2-factor authentication only care about the mobile phone number, or does it also care about trusting the mobile device?

Background:

Once a month (or sometimes more), Google asks me to enter a code sent to my smartphone (I don't do texting so Google actually phones me up, in order to authenticate my account.

If I do not have my phone, I'm pretty screwed.

So, I have a smartphone, a primary computer, and two other laptops associated with my Gmail account for 2-factor authentication.

The smartphone (with its phone number) and computer are trusted devices.

Does Google's 2-factor authentication only care about the mobile phone number, or does it also care about trusting the mobile device?

posted by KokuRyu to Computers & Internet (12 answers total)

I'm confused about the question. Is it whether they will give you the codes at all after you get a new phone? Google will send the code to the phone number you specified, it doesn't know what's on the other end of that.

If you have a smartphone you can get the smartphone app (that's the android version, since you didn't say what type of phone you have, I know there's an iPhone version, don't know about other mobile OSes but I assume they exist too) that will generate the codes instead of texting or calling you. You can also print out backup codes that you keep in your wallet or whatever in case you don't have access to your phone when you need to sign in somewhere.
posted by brainmouse at 6:40 PM on July 21, 2012

In case you're asking the other question that your phrasing can mean -- it doesn't associate authentication with a phone number, only with a device. Actually, even less than that -- if you are authenticated via Chrome on your computer, you are not also authenticated via Firefox, etc (and clearing cookies will clear your authentication). And different google apps sometimes need to be authenticated separately. So you will have to re-authenticate yourself on your new phone when you get a new phone even if you keep the phone number.
posted by brainmouse at 6:43 PM on July 21, 2012

If you're asking about google calling your phone, you're fine - that part of authentication will still work. It's connected to the number, not the device, so as long as you can answer whatever phone is attached to the number, you're set.

If you're asking about using your phone with your google account (gmail, google play, etc.), assuming that you're talking about an android phone, you will need to authenticate that device (I assume you use device-specific passwords, if you don't, consider it!) separately. You will be able to do that just as easily as the first time you signed into your device, from your computer or whatever.
posted by R a c h e l at 7:15 PM on July 21, 2012

Response by poster: Oh, sorry for the confusion...

I have 2-factor enabled. The code is sent to a phone number. I want to change the handset associated with that number (including SIM card).

Will getting a new mobile device cause problems?

The mobile telephone number associated with the account is a key part of 2-factor authentication.
posted by KokuRyu at 7:16 PM on July 21, 2012

OK, then no, you're fine. I just got a new phone, swapped the SIM card, it started sending the messages to the new phone, no problem. It cares about the phone number, not the device. If you're at all nervous though, printing out a set of backup codes before you do anything will give you some peace of mind, and setting up the app on your new phone instead of having them call you will just be easier moving forward.
posted by brainmouse at 7:22 PM on July 21, 2012

Response by poster: If I upgrade to a new device, do I need to retain the same SIM card?

I wasn't aware of an app, either.
posted by KokuRyu at 7:34 PM on July 21, 2012

Nope, it only knows the phone number. That's the only information that it has. Just your phone number. Any facts about what's on the other end of that phone number are irrelevant, as far as Google is concerned. See my first answer for a link to the app on Android, though this link explains how to set it up on Android, iPhone, and Blackberry,
posted by brainmouse at 7:37 PM on July 21, 2012 [1 favorite]

herrdoktor's advice is good if you already were authenticating via an app instead of via a phone number -- and turning off Authenticator is another good idea if you're nervous, but since you're currently authenticating via a phone number, it will continue to work with a new phone without you doing anything.
posted by brainmouse at 7:52 PM on July 21, 2012 [1 favorite]

You could conceivably need a new SIM, by the way, but they will take your SIM and clone your personal information to it; additionally SIM can contain a small number of contacts and such-- that will get carried along the cloning process.

Google again will not know the difference-- it sends you an SMS, which does not offer any info about the sending device, nor return any info about the receiver.
posted by Sunburnt at 12:46 AM on July 22, 2012

Response by poster: In my case I have disabled SMS (I'm trying to save money, and Canadian mobile contracts are expensive) so Google phones me instead.
posted by KokuRyu at 7:06 AM on July 22, 2012

You could just turn it off.
posted by flabdablet at 10:27 AM on July 22, 2012

Response by poster: Just as a follow-up, is it an Android phone you're using? And do you use the Google Authenticator app?

The phone in question was an HTC Hero - an Android phone. I had never heard of the authenticator app, and, generally speaking, one of the reasons why I wanted to upgrade to a new phone was that the Hero really could not handle most contemporary apps.

I also have texts disabled (I need to save money any way I can), so Google would phone me up with a code.

I did have a list of backup codes printed out.

Anyway, I simply disabled Google 2FA on my account, and went out and got a new phone - a HTC One X. I'm very happy with it! I have not yet had a chance to turn 2FA back on, but I will check out the authenticator app.

Thanks for the advice.

This is a useful thread, as I will be out of the country for about 3 months starting in September, and was wondering how I would handle 2FA.

Since the codes seem to work regardless of telephone (I won't be able to receive calls) this is a lifesaver thread!
posted by KokuRyu at 11:37 AM on July 23, 2012