Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Make Your Email Hacker Proof

codinghorror.com

Post reply on HN
Print view View original

81–90 of 161 posts

Re: Make Your Email Hacker Proof

#81

Post by frankus »

bo1024 wrote: post #7

This worry seems a bit overblown to me. If your email is that important to you, you should follow these steps: 1. Use a unique , long, random, secure password. 2. Don't tell it to anyone. 3. Use an email service that stores passwords hashed with a salt and a secure hash algorithm. And you will have nothing to worry about. If you are very paranoid or traveling a lot, you can add: 4. Don't log in from insecure devices.…

I (mostly) agree. I think 2-factor is a fine idea, but I have friends who are still using something along the lines of "password1" on all of the online accounts.

A good first step would be reinforcing the idea that you should never use your email password for any other account. Few people will go through the effort of brute-forcing an standard-issue gmail account when they can easily download a bunch of pre-hacked usernames and passwords.

Re: Make Your Email Hacker Proof

#82

Post by ricardobeat »

karterk wrote: post #54
loverobots wrote: post #45

(You can check the "remember me for 30 days on this device" checkbox so you don't have to do this every time.) No thanks. Google remembers a lot more than "this device," more like everything I do within that device thanks Search cookies, Adsense, Analytics on millions of sites and who knows what else

I always have my gmail logged-in in a separate browser and I don't use that for any other browsing.

Could just open an incognito/private window.

Re: Make Your Email Hacker Proof

#83

Post by abraham »

raldi wrote: post #80
drivebyacct2 wrote: post #32

Earlier quoted context omitted.

Typing a six digit number every 31 days is too much work to add a significant layer of security to a very important account?

Times two accounts, times four devices, multiple browsers... pretty soon it's a once-a-week frustration.

Use it as a mental improvement exercise to help improve your short term memory.

Re: Make Your Email Hacker Proof

#84

Post by abraham »

trout wrote: post #61

I've made a few changes to securing mine with 2 factor. 1. Altered the digits in my wallet so only I know how to recover the real numbers. 2. Created a junk email with a secure password with a security-through-obscurity email with the numbers (again modified) The use case - losing both your cellphone and wallet. There's basically not an easy way to get back to your data. I have to remember a few things: --Normal pass…

The good thing about the recovery numbers is they are still no good without your password. So someone would have to both get your password and steal your wallet to gain access.

Re: Make Your Email Hacker Proof

#85

Post by abraham »

munin wrote: post #70
gibybo wrote: post #62

Earlier quoted context omitted.

The session cookies are often tied to IP address.

are they? have you ever logged in at home, suspended, and then gone to work? or the coffee shop?

Google might compare browser/OS entropy as well as IPs.

https://www.eff.org/deeplinks/2010/01/primer-information-the...

Re: Make Your Email Hacker Proof

#86

Post by abraham »

ricardobeat wrote: post #82
karterk wrote: post #54

Earlier quoted context omitted.

I always have my gmail logged-in in a separate browser and I don't use that for any other browsing.

Could just open an incognito/private window.

You can also use profiles in Chrome: https://support.google.com/chrome/bin/answer.py?hl=en&an...

Re: Make Your Email Hacker Proof

#87

Post by jwilliams »

gabaix wrote: post #2

What happens when you travel abroad and your phone does not work? I am wondering if Gmail could implement security questions to avoid cases where the 2-step verification works against the user

When I'm travelling and expect to be using dodgy internet connections & cafes -- I set up a separate email account and forward my email to it. If that account gets hacked, I just turn off the forward.

Re: Make Your Email Hacker Proof

#88

Post by brazzy »

That cell phone you use for receiving the verification codes? It better not be a smartphone you also use to access GMail, or your 2-factor just became 1-factor, at least to any malware on that phone...

Re: Make Your Email Hacker Proof

#90

Post by bo1024 »

DanI-S wrote: post #23
bo1024 wrote: post #7

This worry seems a bit overblown to me. If your email is that important to you, you should follow these steps: 1. Use a unique , long, random, secure password. 2. Don't tell it to anyone. 3. Use an email service that stores passwords hashed with a salt and a secure hash algorithm. And you will have nothing to worry about. If you are very paranoid or traveling a lot, you can add: 4. Don't log in from insecure devices.…

6. Cross your fingers and hope that you'll never use a machine afflicted with a keylogging trojan.

Perhaps a suggested approach might be to only log in from a USB linux boot drive?

Again, these aren't for the most extremely cautious/savvy users out there, just the 99.9%.

Post reply on HN