Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Make Your Email Hacker Proof

codinghorror.com

Post reply on HN
Print view View original

21–30 of 161 posts

Re: Make Your Email Hacker Proof

#21

Post by rickyc091 »

phwd wrote: post #8

> Hey, This Sounds Like a Pain! Yes, because it is a pain. Try going on a vacation, you know the one where you don't use cell roaming. SMS is out, so then one must find a Wifi hotspot to use one of the smartphone time based tokens (edit: seems the token don't need a network connection, could have fooled me). And those time based tokens go out of wack if your phone didn't sync the timezone properly to match Google's s…

Assuming you were able to use half the backup codes, since you have internet access you can always generate a new batch. I've been using 2 pass since it came out and it's honestly not that bad for the sense of security. Some banks are already using this system.

Re: Make Your Email Hacker Proof

#22

Post by lallysingh »

ninjin wrote: post #9
gabaix wrote: post #2

What happens when you travel abroad and your phone does not work? I am wondering if Gmail could implement security questions to avoid cases where the 2-step verification works against the user

Ironical as it may be and as the author mentioned briefly in the article, "there is an app for that". Google provides an authentication app for at least Android and iOS. I personally put my phone in "airplane mode" for the trip (still waiting for that market changing deal where you can travel easily across the globe and call/use data without being robbed by your provider) then use the authentication app. I also carry…

Also iOS and blackberry:

http://support.google.com/accounts/bin/answer.py?hl=en&a...

Re: Make Your Email Hacker Proof

#23

Post by DanI-S »

bo1024 wrote: post #7

This worry seems a bit overblown to me. If your email is that important to you, you should follow these steps: 1. Use a unique , long, random, secure password. 2. Don't tell it to anyone. 3. Use an email service that stores passwords hashed with a salt and a secure hash algorithm. And you will have nothing to worry about. If you are very paranoid or traveling a lot, you can add: 4. Don't log in from insecure devices.…

6. Cross your fingers and hope that you'll never use a machine afflicted with a keylogging trojan.

Re: Make Your Email Hacker Proof

#24

Post by [deleted] »

raldi wrote: post #4

What I really want is for the second factor to kick on only in suspicious situations, e.g.: * I'm logging in from a computer that I've never logged in from before * I'm searching my mail history for terms like "password" * I'm opening an email that appears to contain a password-reset link * I'm messing with my mail-forwarding options * I'm accessing messages in bulk But I do not want to have to do second factor just…

[deleted]

Re: Make Your Email Hacker Proof

#25

Post by [deleted] »

bo1024 wrote: post #7

This worry seems a bit overblown to me. If your email is that important to you, you should follow these steps: 1. Use a unique , long, random, secure password. 2. Don't tell it to anyone. 3. Use an email service that stores passwords hashed with a salt and a secure hash algorithm. And you will have nothing to worry about. If you are very paranoid or traveling a lot, you can add: 4. Don't log in from insecure devices.…

[deleted]

Re: Make Your Email Hacker Proof

#26

Post by sliverstorm »

fetchmail is very handy for this sort of problem. Regularly pull and remove your mail from your webmail account. Then you can manage it locally the same way you would all your other archives.

Not foolproof, of course, but it improves matters. Also note I don't present this as a solution for John Everyman, but rather the sorts of folks who might be reading Coding Horror.

Re: Make Your Email Hacker Proof

#27

Post by rdl »

The thing I hate about Google Authenticator is when you use a google authenticator protected gmail account for other google services. Google has a bunch of things where they don't yet support 2fa, so sometimes you enter the wrong password.

It would be good if you had a dedicated-to-email google account, definitely. As it is, I use it for a gmail account I use with all my google services, and it's a real pain -- especially because the gmail password itself is a long random string, and sometimes I need to enter that on a mobile or other device.

I'd really like better user credential management using something like OneID (public keys, challenge-response auth), but people have tried that in the past and haven't been terribly successful getting it adopted. It might work better on a mobile OS, so maybe next-gen Apple iOS keystore could do something like this.

Re: Make Your Email Hacker Proof

#28

Post by reedlaw »

JangoSteve wrote: post #15
kghose wrote: post #5

What happens for IMAP accounts? e.g through Mail.app or Thunderbird?

It's in the article, but basically you just generate app-specific passwords for each one, which you can revoke at any time.

So the app-specific passwords are single-factor authentication keys. Why not just skip the two-factor authentication altogether and use a longer password/phrase?

Re: Make Your Email Hacker Proof

#30

Post by beej71 »

rickyc091 wrote: post #21
phwd wrote: post #8

> Hey, This Sounds Like a Pain! Yes, because it is a pain. Try going on a vacation, you know the one where you don't use cell roaming. SMS is out, so then one must find a Wifi hotspot to use one of the smartphone time based tokens (edit: seems the token don't need a network connection, could have fooled me). And those time based tokens go out of wack if your phone didn't sync the timezone properly to match Google's s…

Assuming you were able to use half the backup codes, since you have internet access you can always generate a new batch. I've been using 2 pass since it came out and it's honestly not that bad for the sense of security. Some banks are already using this system.

Can we trust the screen the new codes are being displayed on? :-)
Post reply on HN