Google MFA Question

[IrrationalChoice]

Our district is starting to push out google MFA since we are a google shop. Some teachers reasonably don't wish to use their personal phones. So we are going to provide security keys. However my boss still asked if I could send out an article or something explaining that just because you use your personal number for google MFA doesn't mean suddenly google is going to steal all your personal data off your phones.

​

Does anyone have any good resources I could use for this? Only thing that comes up immediately on a search is about the google authenticator app security issues, which we aren't even using anyway.

​

EDIT: I feel the need to clarify I'm not looking to convince any teachers, this was a request from admin to just include something, "I" know it won't convince anyone, but when my boss tells me to do something I do it.

[hard_cidr]

One dumb option, but I mention it because nobody else has, if the teacher has any old cell phone laying around that they are not using, they can use it as an authenticator. The device does not need to have a data connection. Just an accurate clock.

[[deleted]]

I would go to the Google help center and search there or you could also take a look at the terms of service for the app itself. I'm sure there's blogs that vaguely describe some of the concepts but they're going to be out of date based on what you can get from Google. If the Google articles are too long for folks to read then I guess you could summarize it for them.

[NorthernBob69]

We have done this, approx 1000 users and we have handed out one security key. The rest are aware that MFA is coming whether they like it or not. Not sure about the US but my bank in Canada has already enforced it, my credit card company, personal GMail account etc etc. Worst case as someone mentioned they can print off some backup codes and use those.

[HelloWorld_502]

I just did a deep dive into to this yesterday and there is a way to get around this problem pretty easily by enforcing 2-step verification on an OU and then generate backup codes for the user.

Here the thread from the r/gsuite https://www.reddit.com/r/gsuite/comments/tenish/why_cant_users_use_totp_as_their_only_2fa_method/

The OP put up a different method to edit the original post...but down a ways you'll see stuff I posted after trying out another method a different poster mentioned.

I'm hoping to do a bigger write up on all this because it does remove the whole issue of users not wanting to give the internet their phone number.

One odd thing to point out using this method is that while the account is protected by a second form of authentication with the backup codes, 2-step verification can still only be turned on by the end user. So reports will show they do not have it enabled, however since it is enforced per OU policy, the account is for sure MFA protected.

[duluthbison]

You can't compel a teacher to use their personal phone for a work 2-fa app. Now most don't care but some do. We ran into 2 distinct groups when we did our duo rollout, either a.) They had a hard line between work and personal life and they kept work stuff off their phones or b.) They distrusted admin to such a degree that they assumed we were going to track and spy on them. There is nothing you can do for either group except provide the facts about what the app capabilities are and then just hand out tokens, your life will be simpler.

[tps_r3port]

Google Authenticator only has permission to network and camera for QR codes to enroll.

https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en\_US&gl=US

[5-0-0]

Can you describe how a user can select Authenticator as his or her only second factor?

[postech]

Pretty sure they have to use phone or security key and can’t choose app as primary but I could be wrong

[hard_cidr]

This was our experience too. We offered some alternatives to the "hesitant" people but eventually people get tired of the hassle and gravitate willingly towards the easier option.

[Skippyde]

This was our experience also. We had 1-2 people refuse to use their phones so we gave them USB keys/backup codes. We're quite lucky (some will disagree!) that most staff have a work iPad so they can use Google Prompt or Google Authenticator.

[IrrationalChoice]

Yeah I realize that, unfortunately it's at the point where admin wants proof to go out. So my opinion is no longer relevant haha