1

this is a quick question, but I really want to know this for sure:

If I integrate an option in my site which allows users to log in with their Google account, should I also provide them a function to use a second factor of authentication in my page or should I let Google handle this topic with users Google account?

  • The correct answer depends on what you're trying to protect yourself and your users from, and the hassle you're willing to accept and put on your users by adding "extra security". – knoepfchendruecker Oct 2 '16 at 10:35
  • Yes, but I mean, adding 2FA should not be necessary extra security, as people who want to use it, has it enabled in their Google account configuration. Am I wrong? – José Luis Oct 2 '16 at 10:46
  • Google accounts may choose to "never ask again" for a 2FA authentication on a certain device, so even if 2FA is enabled, it doesn't need to be "really" active. If you need to protect yourself from a compromised google account, you need to perform "some" step of authentication on your behalf. This could be implemented by adding and enforcing 2FA on your website, but will bring some hassle to your users. – knoepfchendruecker Oct 2 '16 at 10:50
  • Sweet, thank you, now I got it. Write it down as an answer so I can set it as correct. – José Luis Oct 2 '16 at 11:05
1

Google accounts may choose to "never ask again" for a 2FA authentication on a "trusted" device, so even if 2FA is enabled for an account, it doesn't need to be "that" much active as your security policy assumes from 2FA.

So if you need to protect yourself from a compromised Google account (even one using Google's 2FA), you'll need to perform "some" extra step of authentication on your behalf. This could be implemented by adding and enforcing your own 2FA on your website, but doing so can also bring some hassle or confusion to your users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.