Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Make Your Email Hacker Proof

codinghorror.com

Post reply on HN
Print view View original

41–50 of 161 posts

Re: Make Your Email Hacker Proof

#41

Post by drivebyacct2 »

bonzoesc wrote: post #38
drivebyacct2 wrote: post #37

Earlier quoted context omitted.

How would it? If the app were built to send some sort of an identifier with it... well, it might as well use oAuth and then it could use the two-factor sign in anyway.

That would require Google to use an open protocol like OAuth, and I think their official policy is basically "NIH."'

Uh what? Google uses oAuth all over the place and in fact that is the correct solution to this problem. (I assume NIH is never-in-hell or something, can't say I've seen that before)

For example, https://developers.google.com/google-apps/gmail/oauth_overvi...

Re: Make Your Email Hacker Proof

#42

Post by munin »

so now it is only a matter of time until the keylogging software that everyone is so terrified of is modified to also take the session cookie from your browser that authenticates you to gmail. you know, the thing that makes it okay for you to click "remember this computer for 30 days" ...

Re: Make Your Email Hacker Proof

#43

Post by unimpressive »

bo1024 wrote: post #7

This worry seems a bit overblown to me. If your email is that important to you, you should follow these steps: 1. Use a unique , long, random, secure password. 2. Don't tell it to anyone. 3. Use an email service that stores passwords hashed with a salt and a secure hash algorithm. And you will have nothing to worry about. If you are very paranoid or traveling a lot, you can add: 4. Don't log in from insecure devices.…

>5. Make sure nobody's filming your fingers when you type your password.

Many moons ago I read the table of contents of Silence on the Wire.[0] One chapter that particularly caught my eye was "I can hear you type.". (Which for some reason was stored in my memory as "I can hear your keystrokes." Which sounds more stalkerish IMO.) Just because of how creepy it sounded. Later I was talking to someone I knew over the phone when they stopped for a moment to enter a username and password for $WEBSITE.

All of a sudden an amusing side channel attack popped into my head:

"I wonder if it's possible to reproduce someones password by hearing their keystrokes?" I figured it would actually be a useful skill if someone were trained to recognize the sound of keystrokes from the most common keyboard phenotypes.

[0] http://nostarch.com/silence.htm (

I haven't actually read it so I don't know if that is or isn't in the book. All I know about it is the Table of Contents.)

Re: Make Your Email Hacker Proof

#45

Post by loverobots »

(You can check the "remember me for 30 days on this device" checkbox so you don't have to do this every time.)

No thanks. Google remembers a lot more than "this device," more like everything I do within that device thanks Search cookies, Adsense, Analytics on millions of sites and who knows what else

Re: Make Your Email Hacker Proof

#46

Post by loverobots »

drivebyacct2 wrote: post #32
raldi wrote: post #4

What I really want is for the second factor to kick on only in suspicious situations, e.g.: * I'm logging in from a computer that I've never logged in from before * I'm searching my mail history for terms like "password" * I'm opening an email that appears to contain a password-reset link * I'm messing with my mail-forwarding options * I'm accessing messages in bulk But I do not want to have to do second factor just…

Typing a six digit number every 31 days is too much work to add a significant layer of security to a very important account?

You should clear those cookies quite often. Just saying

Re: Make Your Email Hacker Proof

#47

Post by loverobots »

drivebyacct2 wrote: post #36
bo1024 wrote: post #7

This worry seems a bit overblown to me. If your email is that important to you, you should follow these steps: 1. Use a unique , long, random, secure password. 2. Don't tell it to anyone. 3. Use an email service that stores passwords hashed with a salt and a secure hash algorithm. And you will have nothing to worry about. If you are very paranoid or traveling a lot, you can add: 4. Don't log in from insecure devices.…

You should pay attention to how many "non-idiot" users have had their Gmail accounts compromised. And using two factor auth is easier than remembering a long, truly unique password. (Though if you're not using LastPass, stop what you're doing and go install it. Just freaking do it.)

Does anyone know how many times failed logins Gmail tolerates? Do they use brute force or just manual guessing?

If they limit them to a few failed logins a day or hour and show you the failed logins it's hard to guess even if you have it jeff(3-4numbers)

Re: Make Your Email Hacker Proof

#48

Post by mikepmalai »

For now I have a really long email password, but I'm considering moving my sensitive data/email out of my general email account and into a new email address that requires 2 factor authentication.

The thing I really want is a "lockbox" folder in my general email that:

1. Requires 2 factor authentication to access the folder but not my general inbox

2. I can move messages I consider sensitive from my general inbox to the lockbox folder

3. Will automatically sends emails from my banks, etc. into the folder with an email showing just the subject line in my general inbox

Re: Make Your Email Hacker Proof

#49

Post by zobzu »

drivebyacct2 wrote: post #32
raldi wrote: post #4

What I really want is for the second factor to kick on only in suspicious situations, e.g.: * I'm logging in from a computer that I've never logged in from before * I'm searching my mail history for terms like "password" * I'm opening an email that appears to contain a password-reset link * I'm messing with my mail-forwarding options * I'm accessing messages in bulk But I do not want to have to do second factor just…

Typing a six digit number every 31 days is too much work to add a significant layer of security to a very important account?

Typing 6 digits every 31 does not add a significant layer of security. 2 factor auth does. And that's different.

If one of your devices is stolen, you go reset the pass. As simple as that.

Plus, 31 days is a long time for the hacker, so it's not adding all that much security.

Re: Make Your Email Hacker Proof

#50

Post by eli »

munin wrote: post #39
eli wrote: post #18

Earlier quoted context omitted.

The sucky part is that nothing enforces their app-specificness. It would be neat if I could generate a password that only works from my home connection. Or only works for GChat, but not other services.

you can't use an app specific password to login to the gmail web interface and change your password. so while you could use a compromised application specific password to do horrible things (download all your email and send e-mail as you), you could not use that app specific password to immediately log in to the administration page for your account and lock the legitimate user out...

Really? I could have sworn I tried and it worked just like a full login. I signed up for two-factor very early so perhaps that was fixed along the way. Neat!
Post reply on HN