>provided you own a cell phone.
Well, crap. My only "phone" is my Google Voice number...
Make Your Email Hacker Proof
31–40 of 161 posts
Re: Make Your Email Hacker Proof
#32What I really want is for the second factor to kick on only in suspicious situations, e.g.: * I'm logging in from a computer that I've never logged in from before * I'm searching my mail history for terms like "password" * I'm opening an email that appears to contain a password-reset link * I'm messing with my mail-forwarding options * I'm accessing messages in bulk But I do not want to have to do second factor just…
Typing a six digit number every 31 days is too much work to add a significant layer of security to a very important account?
Re: Make Your Email Hacker Proof
#33Earlier quoted context omitted.
It's in the article, but basically you just generate app-specific passwords for each one, which you can revoke at any time.
So the app-specific passwords are single-factor authentication keys. Why not just skip the two-factor authentication altogether and use a longer password/phrase?
These are revokable, and don't allow access to change your password.
Re: Make Your Email Hacker Proof
#34>provided you own a cell phone. Well, crap. My only "phone" is my Google Voice number...
Two factor auth works fine without a cell phone. You can put a land line in as a backup and of course you should store the extra physical codes somewhere safe as well.
Obviously though, this would be a pain to use without a portable device that can generate the appropriate time-based code.
Re: Make Your Email Hacker Proof
#35This worry seems a bit overblown to me. If your email is that important to you, you should follow these steps: 1. Use a unique , long, random, secure password. 2. Don't tell it to anyone. 3. Use an email service that stores passwords hashed with a salt and a secure hash algorithm. And you will have nothing to worry about. If you are very paranoid or traveling a lot, you can add: 4. Don't log in from insecure devices.…
6. Cross your fingers and hope that you'll never use a machine afflicted with a keylogging trojan.
I was just about to add that.
Re: Make Your Email Hacker Proof
#36This worry seems a bit overblown to me. If your email is that important to you, you should follow these steps: 1. Use a unique , long, random, secure password. 2. Don't tell it to anyone. 3. Use an email service that stores passwords hashed with a salt and a secure hash algorithm. And you will have nothing to worry about. If you are very paranoid or traveling a lot, you can add: 4. Don't log in from insecure devices.…
You should pay attention to how many "non-idiot" users have had their Gmail accounts compromised.
And using two factor auth is easier than remembering a long, truly unique password. (Though if you're not using LastPass, stop what you're doing and go install it. Just freaking do it.)
Re: Make Your Email Hacker Proof
#37Earlier quoted context omitted.
It's in the article, but basically you just generate app-specific passwords for each one, which you can revoke at any time.
The sucky part is that nothing enforces their app-specificness. It would be neat if I could generate a password that only works from my home connection. Or only works for GChat, but not other services.
How would it? If the app were built to send some sort of an identifier with it... well, it might as well use oAuth and then it could use the two-factor sign in anyway.
Re: Make Your Email Hacker Proof
#38Earlier quoted context omitted.
The sucky part is that nothing enforces their app-specificness. It would be neat if I could generate a password that only works from my home connection. Or only works for GChat, but not other services.
How would it? If the app were built to send some sort of an identifier with it... well, it might as well use oAuth and then it could use the two-factor sign in anyway.
That would require Google to use an open protocol like OAuth, and I think their official policy is basically "NIH."'
Re: Make Your Email Hacker Proof
#39Earlier quoted context omitted.
It's in the article, but basically you just generate app-specific passwords for each one, which you can revoke at any time.
The sucky part is that nothing enforces their app-specificness. It would be neat if I could generate a password that only works from my home connection. Or only works for GChat, but not other services.
you can't use an app specific password to login to the gmail web interface and change your password.
so while you could use a compromised application specific password to do horrible things (download all your email and send e-mail as you), you could not use that app specific password to immediately log in to the administration page for your account and lock the legitimate user out...
Re: Make Your Email Hacker Proof
#40Is it really that easy to hack someones gmail account?
I realize phishing and key loggers are easy ways to grab a password, but if you avoid typing your gmail password at public internet kiosks and the like, is it really that easy for someone to get at? Assuming you use a reasonably long and impossible to guess password, the captchas would prevent brute forcing.
An attack targeted specifically at you will inevitably succeed but most of us are not that special.
The article's advice seems far too easy to lock yourself out (losing my wallet with my magic paper codes and my phone could do it). The additional inconvenience does not seem worth it.
Most of us have used physical 2 factor authentication (like RSA SecurID) for banking and work related VPN access. This works well because the provider (your office, your bank) has a vested interest in getting you back into your account if you get locked out. Google, Yahoo, MS, etc. have no such obligation.