Don't use SMS, use the Google Authenticator app. It's available on every mobile platform and implements open, RFC-specified OTP algorithms. And obviously works with Google's 2-factor implementation.
Edit: forgot to mention, also open-source.
Edit: forgot to mention, also open-source.
* Use a backup code. Learn more
* Send to your backup phone number ending in ##
* I cannot access any of my phones Learn more
So yes, if someone gets my phone, they can then gain access to my Google account. Grrrrr...
If someone gets your wallet, they can use your credit cards to gain access to your credit. You cancel the credit cards. Move on with your life.
Your phone already matters as much as your wallet now - that's just reality. Secure your phone as best you can. Use full-disk encryption wherever backups are stored. Don't give your phone to people you can't trust. Change your password if you lose it or it gets stolen. Move on.
These are tools to solve problems, not shrines to worship.
Only if they also know your password. That's why it's called "two factor authentication". Simply compromising your password is not enough. They also have to capture your phone.
Now, if you're stupid enough to write your password on the back of your phone.... you deserve everything that's coming to you.
I'm not trying to defend their stupid choice of offering option #2, but rather trying to offer a solution to your current problem.
If my phone becomes unavailable (eg lost/ stolen/ dropped in a toilet) then I need a backup option to login. The backup options Google provides are: * Use a backup code * Use a backup phone number * None of the above, I still need help!
1. The backup codes are suggested to be printed and stored in a wallet; however you can put them anywhere you like.
2. The backup phone number can be somebody else's number. Your best friend, your partner, whatever.
3. If you still can't get a backup code, the third option is to go through Google's support team and recovery process. Selecting this option results in an advisory message stating the process could take from 3 to 5 days.
These options appear to be very sensible to me.
I'm pretty sure the backup phone number is someone else's phone, not yours. I use my wife's phone number.
If you lose your phone (and thus access to the Google Authenticator app), you can send a code to the backup phone (for example, my wife's phone) allowing you to login.