[SOLVED] 2factor for Google, how to?

[tis]

Hi,

Google sent in mail: "We’re writing to inform you that starting May 12, 2025, you will be required to use multi-factor authentication (MFA), also known as 2-Step Verification (2SV), to access Google Cloud console, gcloud CLI, and Firebase console...."

So how can I set up 2factor code gen for Google in my Mageia Linux to acces web based area through firefox and mail through thunderbird?

[tis]

I found this, but i think this works different way. (https://wiki.archlinux.org/title/Google_Authenticator)

In otherhand I don't have Google Cloud console, gcloud CLI and Firebase, why i got this message?

[sturmvogel]

In otherhand I don't have Google Cloud console, gcloud CLI and Firebase, why i got this message?

https://cloud.google.com/blog/products/ ... know?hl=en

Dependend ob your usecase, MFA can be as easy as using a mobile number/phone as 2nd factor. This can easily be setup in your Google account -> Security. The possibilities for MFA are explained there.

Or simply use Google Authenticator on your phone. Can also be setup via Google account -> Security easily.

Company accounts or managed accounts may need to use passkeys or other more advanced ways.

[tis]

Ty,

I choose SMS (for simple gaccount), because I don't use smart things... I'm a prehistoric private person, I don't have company things...

I just thought that Linux has an app like "codemanager/generator" linked to some account, that would be usefull for other accounts too.

[doktor5000]

There aren't that many current opensource authenticator apps, and most people will simply use those on their phone. Having the authenticator on the same device as the password kind of defeats the purpose for 2FA.
See FreeOTP+ https://github.com/helloworld1/FreeOTPPlus or aegis https://getaegis.app/ for open source authenticator apps.

Why not simply use the google authenticator ?

[tis]

ty, i'll try...

I can't see how can i generate codes for web-login with google-authenticator...

[sturmvogel]

https://support.google.com/accounts/ans ... 6447?hl=en

[tis]

ty,

but this is not that google auth ((https://wiki.archlinux.org/title/Google_Authenticator)), this runs Android, where u give up ur privacy...

and also not safe because every app can capture the code and auth themself, i think. (same device case mentioned doktor5000) I don't need "nasa security", just a safe enough, so Linux OTP maybe good enough....

Thanks

[tis]

What can u tell about https://flathub.org/setup/Mageia?

i have flatpak installed,

have to add repo:

Code: Select all

flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo

https://flathub.org/apps/com.github.pao ... .OTPClient:
download:

Code: Select all

flatpak install flathub com.github.paolostivanin.OTPClient

and run:

Code: Select all

flatpak run com.github.paolostivanin.OTPClient

(source: https://github.com/paolostivanin/OTPClient)

maybe not I'd like, I'll try.

[tis]

just a fast report about this...

I had a little time, so I've tried, and works.
I tried with flatpack, but it would like to install things I don't think I need, so I've downloaded the source.

I think it was easy to compile, u have to download and compile cotp library too (they made too), and install to /lib64 ( the /usr prefix as they wrote is good ), need to install some develpackage from Mageia and it works well

(Login to google account, add a new "hitelesítő alkalmazás" (authenticator), it gives a qr code, save as image with printscreen, import to OTPClient, next on google screen, enter code... cool... )

[doktor5000]

this runs Android, where u give up ur privacy...

and also not safe because every app can capture the code and auth themself, i think. (same device case mentioned doktor5000) I don't need "nasa security", just a safe enough, so Linux OTP maybe good enough....

Sorry, but you seem to be pretty confused about what security actually means.

In any case, please don't forget to mark the thread as solved, by editing the subject of the first post and prefix it with [SOLVED], thanks in advance.

[tis]

Ty,

sorry, I'm not a hacker or a IT security master, but
- if u save ur device as "reliable device" (not ask 2nd codes always) it will save e.g. a cookie to ur device... other apps can easily read it.
- if u get a message/push pop up on ur phone, every app can capture it...
- OTP is based on an algorithm i think it his harder to capture the currently generate code
- and maybe more interesting the session hacking cases
- ...

I know just a little about these.... sorry

Thanks