Many people use Gmail and may be exposed to two-factor authentication, which is mainly focused on protecting users’ information. There are several security implications when it comes to using an SMS for Gmail authentication verification. Receiving an SMS is far from ideal and a safe method, especially when answering sensitive questions to reveal one’s identity.
Gmail is moving away from SMS authentication
The spokesperson of Gmail announced the plans of Gmail to move away from SMS authentication, just like the company wants to move away from using passwords. Instead of using passwords, the use of passkeys will be implemented. The very first mail conversation with Google started focused on moving away from SMS messages as a way for authentication but should rather be replaced with QR codes. These codes would reduce the impact of rampant, global SMS abuse.
Currently, Google uses SMS authentication for two main reasons, and these reasons are security and abuse control. The spokesperson stated that the reason for this is to identify that the person they are dealing with is the same person as before. This is done while the latter continues to make sure that fraudsters do not abuse Google’s services. This happened before, shared by Google, when criminals created thousands of Gmail accounts with the aim to distribute spam and malware.
The reasons why Gmail ends SMS authentication
As mentioned before SMS messages comes with various challenges that can put users and their private information at risk. The major security challenges can have major consequences as stated by Gmail’s spokesperson, Ross Richendrfer, and his colleague at Google, Kimberly Samra. People do not always have access to the device the code is send to and therefore it can be phished. These SMS messages are depending on the security practices of the user’s carrier.
According to Richendrfer, a fraudster may easily trick a person into getting hold of someone’s phone number, and just like that the security value of an SMS will go away. Traffic Pumping is one relatively new scam that Google has observed over the past few years. It is also called artificial traffic inflation and toll fraud. This basically means that fraudsters try to get online service providers to originate a big amount of SMS messages to numbers they control. As they do this they will get paid every time one of these messages is delivered.
Gmail goes from SMS to QR codes
If you are already making use of other methods to protect your Gmail account, like Google 2FA code app, Google prompts or passkeys, and if those methods work for you – then you do not have to worry about this new method. However, it is essential to share it for those who do not know about it yet, especially because there are so many people still using the SMS method.
As stated by Richendrfer, over the next few months, users will be reimagining how they verify phone numbers. This new process will work as follow; instead of entering your number and receiving a 6-digit code as users generally do, you will now see a QR code displayed on your screen, which you need to scan with the camera app on your phone.
There are several benefits that comes with QR codes authentication, and it can be threefold:
- Reducing the phishing risk of Gmail: Prevents users from being tricked into sharing their security codes with a threat actor. Mainly, since there will be no code to share.
- Removing reliance: In most cases, this is for Google users on their phone carrier for anti-abuse protections.
- Helps reduce the impact of rampant, global SMS abuse.
Readers should note that this information is an exclusive from Forbes.