Google LLC today announced that it will start automatically enrolling account users into two-factor authentication.

Announced on World Password Day, the move is pitched by Google as increasing account security by removing “the single biggest threat to online security”: passwords. “They are easy to steal, they’re hard to remember and managing them is tedious,” Mark Risher, Google director of product management, identity and user security, said in a blog post.

Risher noted that although many people believe a password should be as long and complicated as possible, that can increase security risks because users often use the same password on more than one account. “In fact, 66% of Americans admit to using the same password across multiple sites, which makes all those accounts vulnerable if any one falls,” Risher explained.

In the first step of the process, Google will ask users already enrolled in 2FA to confirm their identity by tapping on a Google prompt on their smartphones whenever they sign in. In the second step, Google will start automatically enrolling users in 2FA or as Google calls it “two-step verification” if their accounts are appropriately configured. “Using their mobile device to sign in gives people a safer and more secure authentication experience than passwords alone,” Risher added.

Along with the 2FA announcement, Google also said that it has introduced a new feature in the Password Manager in Chrome called Password Import. As the name suggests, it allows users to import passwords, in this case passwords from third-party sites or other password managers, with support to upload up to 1,000 passwords at a time.

Automatically enrolling account users into 2FA is a sound security step, but the enhancement of Google’s Password Manager may raise some competitive concerns. In providing a now enhanced free password manager built into Chrome, it will compete head-on with dedicated password management services such as Lastpass and 1Password.

Image: EFF Photos/Flickr