Feeds

Google Apps tap mobiles for beefier log-in security

Cell phone as security token

High performance access to file storage

Google is tapping user cell phones to provide an extra level of sign-in security for Google Apps, its suite of online business applications.

On Monday, the company announced that it's now offering what it calls two-step verification. When the new tool is turned on and you log in to your Google Apps account, it requires not only a password but a separate verification code pulled from your mobile phone. "This makes it much more likely that you’re the only one accessing your data," the company said in a blog post. "Even if someone has stolen your password, they'll need more than that to access your account."

The verification code is sent to your mobile phone via SMS, voice call, or an application that's available for Android handsets, BlackBerries, and iPhones. The service is available today for free on the Premier, Education, and Government editions of Google Apps, and users of the free Standard edition will have access "in the months ahead."

Administrators must activate the tool from the Admin Control Panel, and individual users can then set it up via the Accounts tab on their Gmail settings page. If you like, you can turn the service off for certain "trusted computers" (i.e. your work desktop) but leave it on whenever your account is accessed from other machines. "You can...indicate when you're using a computer you trust and don't want to be asked for a verification code from that machine in the future," the company said.

Google also plans to roll the service out across individual Google accounts (i.e. regular accounts for non-Google Apps users) in the coming months.

In an effort to encourage other outfits to adopt similar services, Google has based its two verification on the Initiative for Open Authentication (OATH) standard (not to be confused with OAuth), and it has open sourced its verification code mobile application – Google Authenticator – so that others can customize it as they see fit. ®

High performance access to file storage

More from The Register

next story
Android engineer: We DIDN'T copy Apple OR follow Samsung's orders
Veep testifies for Samsung during Apple patent trial
Windows 8.1, which you probably haven't upgraded to yet, ALREADY OBSOLETE
Pre-Update versions of new Windows version will no longer support patches
Microsoft lobs pre-release Windows Phone 8.1 at devs who dare
App makers can load it before anyone else, but if they do they're stuck with it
Batten down the hatches, Ubuntu 14.04 LTS due in TWO DAYS
Admins dab straining server brows in advance of Trusty Tahr's long-term support landing
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Half of Twitter's 'active users' are SILENT STALKERS
Nearly 50% have NEVER tweeted a word
Windows XP still has 27 per cent market share on its deathbed
Windows 7 making some gains on XP Death Day
Internet-of-stuff startup dumps NoSQL for ... SQL?
NoSQL taste great at first but lacks proper nutrients, says startup cloud whiz
US taxman blows Win XP deadline, must now spend millions on custom support
Gov't IT likened to 'a Model T with a lot of things on top of it'
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.