Has google ditched its authenticator app?

[TwistedHelixis]

Just setting up a new G Suite system and went to add 2FA to my account but the Authenticator app is not an option. I then went to read up on the Google help pages and it is also missing as an option.

 

https://support.google.com/accounts/answer/185839?co=GENIE.Platform%3DAndroid&oco=1

 

 

BTW it is still an option on my older G Suit systems

[DrBeaker]

I'm seeing it on the help still here? https://support.google.com/accounts/answer/1066447?hl=en&ref_topic=2954345

[Arthur]

Does it make any difference if you disable the text and phone call options for 2FA (under Security > Advanced security settings, in the G Suite admin console)?

 

Edit. Also try setting up 2FA via: g.co/2sv

 

 

Btw, if you do get it to appear you may not want to use Google's Authenticator app since it doesn't let you transfer the 2FA codes to another device e.g. when you upgrade your smartphone. Authy (Android/iOS) or OTP Auth (iOS only) can backup/restore the codes however.

Edited April 16, 2019 by Arthur

[TwistedHelixis]

I'm seeing it on the help still here? https://support.google.com/accounts/..._topic=2954345

Thanks, wonder why it has its own tab and is not listed with all the other options???

 

Does it make any difference if you disable the text and phone call options for 2FA (under Security > Advanced security settings, in the G Suite admin console)?

Well that is odd, that section is grayed out. The other section above is fine. See pic

 

BTW my admin account for this domain does already have 2FA using the authenticator app, the issue is for a test teacher account, but that has the same 2FA settings as my admin acc.

[TwistedHelixis]

Found a forum where someone else had the same issue. They were told that some of the 2fA options such as backup codes and the authenticator app can only be setup as a secondary 2FA system. I would need to pick one of the main options first, such as text message or Google prompt, and then select the authentication app in the final menu.

 

This is a bit of an issue if someone is in a rural area and they do not have a phone signal.

 

Does Google Prompt use phone signal or internet?

[Arthur]

They were told that some of the 2FA options such as backup codes and the authenticator app can only be setup as a secondary 2FA system. I would need to pick one of the main options first, such as text message or Google prompt, and then select the authentication app in the final menu.

As of last month, that's not the case any more. See the blog post linked below.

 

Disable SMS or voice codes for 2-Step Verification for more secure accounts

 

What’s changing

We’re adding an option for admins to disable telephony options as 2-Step Verification methods for G Suite accounts in their domain. This option will prevent their users from using SMS and voice codes for 2-factor authentication.

 

Why you’d use it

There are many forms of 2-Step Verification—from text (SMS) message codes, to the Google Authenticator app, to hardware second factors like security keys. And while any second factor will greatly improve the security of your account, we’ve long advocated the use of security keys for those who want the strongest account protection.

 

As awareness of the potential vulnerabilities associated with SMS and voice codes has increased, some admins asked us for more control over the ability to use phone-based 2-Step Verification methods within organizations. The present release does just that - admins get a policy that can enforce the use of multi-factor authentication without permitting SMS and voice verification codes.

 

This new policy gives admins more control over the security methods used in their domain, and increases the security of user accounts and associated data.

 

How users can configure 2-Step Verification once the policy is enforced

Users with the new policy applied will not be able to add SMS or voice based codes as an option - either when enrolling in 2-Step Verification for the first time or later at myaccount.google.com. A user enrolling in 2-Step Verification for the first time will see the screen below. This first provides an option to set up Google Prompt, as well as ‘Choose another option’ which will let them add a Security Key instead.

 

 

Looking at your screenshot you will need to turn on one of the enforcement options in order to modify the "Allowed 2-step verification methods" setting for the OU or group your test teacher account is in.

 

You could choose the "Turn on enforcement from date" option and set the date to a suitable date in the future, and then select the "Any except verification codes via text, phone call" option under allowed methods.

 

 

Does Google Prompt use phone signal or internet?

Internet.

 

https://gsuiteupdates.googleblog.com/2017/07/better-experience-for-sms-2-step-verification.html

 

In February 2017, we revamped Google prompt for 2-Step Verification (2-SV), giving users a better option to keep their accounts safe. In addition to offering 2-SV over an encrypted connection, Google prompt also allows users to block unauthorized access to their account with real-time security information about the login attempt.

 

Overall, this is being done because SMS text message verifications and one-time codes are more susceptible to phishing attempts by attackers. By relying on account authentication instead of SMS, administrators can be sure that their mobile policies will be enforced on the device and authentication is happening through an encrypted connection.

 

Notes:

• The notifications to test Google prompts will be shown only to 2-SV SMS users. Security key users are unaffected by this change.
  
• A data connection is required to use Google prompt.
  
• iOS users will need the Google Search app installed on their phone to use Google prompt.
  
• Enterprise edition domains also have the ability to enforce security keys for more advanced security requirements.
  
• While users may opt out of using phone prompts when shown the promotion, users will receive follow-up notifications to switch after 6 months.
  

 

Also worth mentioning (if you decide to buy security keys) is that admins can add them to accounts on behalf of users now.

Edited April 16, 2019 by Arthur