Google Advises Gmail Users to Keep Two-Factor Authentication Enabled After Account Hack Report

A user on the Gmail subreddit reported on March 31 that their account had been hacked. The user stated they had changed the account password and generated new recovery codes. In response, another commenter advised disabling two-factor authentication (2FA) to access other recovery options, claiming it provides more flexibility and can be bypassed by hackers anyway.

Other Reddit users challenged this advice, stating that turning off 2FA is not recommended unless an attacker already has access. They emphasized that 2FA, combined with recovery codes, facilitates account recovery without increasing vulnerability. The original commenter also suggested changing passwords every two months to prevent hacks every three or four months.

Security guidelines from the U.S. National Institute of Standards and Technology indicate that routine password changes for uncompromised accounts can introduce risks, such as weaker password selection over time. Experts note that 2FA helps protect against unauthorized access, even if methods like session cookie theft or phishing can sometimes circumvent it.

This incident underscores the importance of layered security for Gmail users, who number in the billions globally.

Google has confirmed that U.S. Gmail account holders can now change their primary email address without losing data, accompanied by related security warnings. In response to account compromise reports, a Gmail spokesperson provided guidance: turn on two-step verification and adopt passkeys; ensure only current phone numbers are associated with accounts; regularly review connected devices; and set up recovery information like a recovery email, phone number, or the recently announced recovery contacts feature.

The stakes involve potential data breaches affecting personal and professional communications for Gmail's extensive user base. Affected users risk unauthorized access to emails, contacts, and linked services. Next steps include monitoring accounts for suspicious activity and following Google's recommendations to strengthen security without disabling protective measures like 2FA.