Simplifying account security
Google prides itself in being a leader in account security
Google has invested heavily in security infrastructure, building industry-leading features to protect billions of users worldwide, as evidenced by the diverse security ecosystem. From Security Checkup to 2-Step Verification, Titan Security Keys to Advanced Protection Program – Google offers a comprehensive suite of security tools designed to keep accounts safe.
Google's Security Paradox
Google offers industry-leading security features, but users struggle to understand and adopt them, making the ability to improve a user's account security overwhelming for most users.
Unclear hierarchy
While Security Checkup provided tailored recommendations, the "Recent security events" card appeared inconsistently and offered no actionable insights.
Fragmented core features
Account access controls were split into two confusing sections: "Signing in to Google" and "Ways we can verify it's you." These appeared competitive rather than complementary.
No clear narrative
Users couldn't easily understand what to prioritize or how the features connected to their overall account security.
The Security Settings tab before the redesign
User insights reinforce the concern
Feeling vulnerable
"You never really know; you always have a feeling that there is somebody out there who could hack you or something."
Overwhelming complexity
"[Account security] feels like work. Kind of like 'Inception' – you click on that, you then go deeper. I don't feel that I can go into it any further, because I'd get lost."
Confusing language
"I'd have to just give up. When I read all these words, I don't really understand what I'm reading. There's lots of words."
Ensuring users are Secure by Default
Google was preparing to auto-enroll all 2SV-capable accounts as part of a 'Secure by Default' initiative. This meant 4 billion users – the general population – would soon be automatically enrolled in 2-Step Verification.
How might we...
Make security simple
Prepare users for Secure by Default
The goal
With engineering focused on authentication infrastructure and 2-Step Verification enrollment, I led a UX initiative to simplify how users understand and manage these foundational security features.
Provide Google users with a simple approach to their Security Settings, clarifying our obscure security offerings with a clear authentication focus.
How you sign in to Google
More visual emphasis on Security Checkup, providing tailored security recommendations
Combined recovery options and authentication methods into one "How you sign in" card
"More sign-in options" CTA will lead to contextual education page
Pushing boundaries with educational content
I championed this page design based on user research showing people wanted more context and education around security features. The mocks use placeholder images to rapidly validate information architecture with stakeholders before investing in detailed graphics. Working with my UX writing partner, I organized authentication methods by priority – most secure, convenient, and backup options – while prioritizing security over convenience despite technical complexity.
A landing page for users to explore and learn more about the multitude of sign in options available
Minimum recommended methods for 2SV to be highlighted above
The page was also designed with progressive disclosure to reduce cognitive load and encourage user engagement. When expanded, each section provides short summaries about the value of each method, plus educational links.
"Learn more" links open educational wizards that I previously designed for Google's Advanced Protection Program enrollment flow.
Educational wizards offer delightful educational moments within users' existing journeys, proven to enhance user trust compared to traditional Help Center articles that navigate users away and cause significant drop-off. My goal was to leverage these educational components across various security experiences to build a comprehensive system, repurposing proven patterns that keep users engaged in their current flow rather than losing them to external documentation.
The P0: 2SV Onboarding Entrypoint
After socializing this concept across various PMs and engineering leads, it was overwhelmingly clear to the team and to leadership, the user benefit that these changes would provide. With Secure by Default's timeline quickly approaching, we knew that we needed to launch something quickly.
I collaborated with product and engineering partners to define a P0 MVP focused on the 2SV onboarding entry point – the core of my redesigned Security Settings tab. Together, we outlined a phased approach to incrementally roll out the guided experience and improve users' security states.
P0 project outcomes
1-month post launch
25% increase in 2SV adoption
40% lift in users adding sign in methods