When I log into Gmail with 2 factor authentication, I enter my username and password and get taken to a page asking me to enter a security code sent to a phone. If I enter a backup code into this form Gmail recognizes that I entered a backup code and says:

It looks like you entered a backup code. Click "Try another way to sign in" and select the backup code option.

Is there a security reason for Gmail to require me to go to a separate page to enter a backup code? The only reason I can think of is so that someone doesn't accidentally use the last backup code and get locked out, but it's hard to believe someone could enter a backup code without realizing it.

  • Does the backup page also request other verification details? Things like date of birth, or phone number? – Matthew Feb 13 '17 at 17:15
  • @Matthew No. The forms on both pages have a single text field to enter a code and that's it. – Reinstate Monica Feb 13 '17 at 17:16
  • it's hard to believe someone could enter a backup code without realizing it well the other possibility (someone intentionally entered backup code into form asking for security code sent to your phone) seems to me even less likely. – Cthulhu Feb 13 '17 at 17:23
  • Given Google's scale, it's entirely possible that the recovery codes are processed by a completely different internal method, and they want to avoid passing them around internally. Hard to be sure though... – Matthew Feb 13 '17 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.