Google 2-Factor Authentication (2FA)

Eureka Union School District will be rolling out a technology called “two-factor authentication” within Google. You may know it by other names like “2FA”, “two-step verification”, or “multi-factor authentication (MFA)”.

What is two-factor authentication?

Two-factor authentication adds a second layer of protection during the login process. Currently, your Google login is tied to “something you know” (your password). Two-factor authentication adds the second layer of “something you have” (typically your smartphone, a temporary code, or absent that, a USB security key). You most likely already have experience using two-factor authentication with an online banking account so enabling it within Google hopefully will not be a new experience.

Why are we implementing two-factor authentication?

Our cyber insurance provider's requirements for our organization are driven by an ongoing review of what security-related best practices are appropriate.  The following changes are motivating factors in our cyber insurance provider requiring North White School Corporation to implement two-factor authentication. Times are changing and hackers are finding new and creative ways to acquire user passwords; they can buy lists of usernames and passwords on the dark web, they can use social engineering and email phishing tactics to steal passwords, they can use something called “dictionary attacks” as a brute force method to guess weak passwords. Adding a second form of verification dramatically decreases the likelihood of your password being compromised.

How often will I need to use two-factor authentication?

Google will require two-factor authentication every time you log in to your PC or Chromebook. Once you authenticate and complete two-factor authentication on your phone or other devices you will have the option to “remember this device”. From that point on Google will not prompt you to perform two-factor authentication on that device unless you clear your browser’s cache, change your password, or if Google suspects that your account has been breached.