Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Make Your Email Hacker Proof

codinghorror.com

Post reply on HN
Print view View original

91–100 of 161 posts

Re: Make Your Email Hacker Proof

#91

Post by jrockway »

brazzy wrote: post #88

That cell phone you use for receiving the verification codes? It better not be a smartphone you also use to access GMail, or your 2-factor just became 1-factor, at least to any malware on that phone...

Your phone should never know your password; you log into Gmail from your phone using an application-specific password. If your phone is infected with malware and you don't trust it anymore, you deauthorize it and your account is safe.

2 factor authentication is an amazingly simple solution to a large number of complex problems.

Re: Make Your Email Hacker Proof

#93

Post by jrockway »

andyouthink wrote: post #65
jellicle wrote: post #63

While you're thinking about the security of your email in the cloud, remember this: ANY of your email older than six months can be legally obtained by any U.S. law enforcement agency without any warrant or judicial oversight of any sort, even if you enable Google's new 46-factor authentication and use passwords that take minutes to type in. http://www.wired.com/threatlevel/2011/10/ecpa-turns-twenty-f... Do you have a…

And you think that Google actually deletes email when you tell it to? More likely they just mark it as deleted and retain it, in which case every email you ever received regardless of whether you think it has been deleted may be available. If you want better privacy, install and manage your own mail server and encrypt everything.

Do you really think your shared host drops blocks when you delete them from your virtual disk, and do you really think that requests to mlock memory with crypto keys are really honored? Maybe if you have a dedicated box, but not if you are using a virutal host. (Have you ever physically seen "your own" mail server? If not, why do you trust it?)

Also consider what happens to unencrypted email you send or receive: any upstream servers can be subpoenaed, as can the person on the other end. Encrypted mail only works when it's encrypted end-to-end and your adversary cannot seize the sending or receiving computer. I imagine that people who encrypt their received email end up in court because their sender was not so careful. Do you trust every person that will ever mail you to keep your secrets safe? Why?

Ultimately, if the government is your enemy, you need to take a lot more precautions than "don't use Gmail".

Re: Make Your Email Hacker Proof

#94

Post by jrockway »

raldi wrote: post #80
drivebyacct2 wrote: post #32

Earlier quoted context omitted.

Typing a six digit number every 31 days is too much work to add a significant layer of security to a very important account?

Times two accounts, times four devices, multiple browsers... pretty soon it's a once-a-week frustration.

I have three accounts and five computers and I don't find the once-a-month 6-digit number to be a big deal. PayPal does annoy me with their policy of requring an OTP seemingly every time you visit a page, but it's worth it because I know that I don't have to have a super-amazing password to stay safe. Ultimately, the work required to recover from a compromised account is much higher than it is to type a 6-digit number every month, so I consider it a good trade-off.

Re: Make Your Email Hacker Proof

#95

Post by jrockway »

bo1024 wrote: post #7

This worry seems a bit overblown to me. If your email is that important to you, you should follow these steps: 1. Use a unique , long, random, secure password. 2. Don't tell it to anyone. 3. Use an email service that stores passwords hashed with a salt and a secure hash algorithm. And you will have nothing to worry about. If you are very paranoid or traveling a lot, you can add: 4. Don't log in from insecure devices.…

Using a second factor token is much easier than always doing all of those and provides a much larger safety margin. Remember, with 2-factor auth, even someone who knows your password can't access your account. If you also make sure they don't know your password, you're doubly safe. That's why pretty much every safety system invented has some sort of backup safety protection. If you want to go "free solo" on your account because you enjoy thrills, that's fine. But if you're a normal person, why not have a safety rope?

Re: Make Your Email Hacker Proof

#96

Post by smiler »

my8bird wrote: post #71

While I like 2 step authentication I wish Google would get rid of SMS password reset. With this enabled all a person needs is your phone to gain access to your account. Given that police can grab you phone whenever you are stopped this means they can "hack" your account at the same time. Another example could be a cleaning person at a hotel finding your phone. Just two examples off the top of my head. Basically, SMS…

As long as you have a pin lock on your phone, the cleaning person nor the police will be able to do anything with your phone.

Re: Make Your Email Hacker Proof

#97

Post by alanbyrne »

jbredeche wrote: post #6

I put a copy of the single-use backup verification codes into an alternate dropbox account I have (that isn't linked to my primary email address). Figured if I'm somewhere with enough internet access to get to gmail, I'll be able to get to dropbox.com and get the codes.

I've done a similar thing but put them on my colo server. Hopefully getting SSH access in an internet cafe doesn't work out to be too hard.

Re: Make Your Email Hacker Proof

#98

Post by alanbyrne »

bigiain wrote: post #78
velshin wrote: post #40

Is it really that easy to hack someones gmail account? I realize phishing and key loggers are easy ways to grab a password, but if you avoid typing your gmail password at public internet kiosks and the like, is it really that easy for someone to get at? Assuming you use a reasonably long and impossible to guess password, the captchas would prevent brute forcing. An attack targeted specifically at you will inevitably…

A _startlingly_ large number of people are (still) re-using passwords across multiple sites. The Gawker/Sony(/PerlMonks for me) compromises revealed a _lot_ of email addresses and passwords, some significant portion of which almost certainly allowed attackers access not only to the specific website that was attacked, but also to the email service of the exposed user. I'm pretty sure none of Jeff's advice helps you ag…

My name is Alan Byrne, I work in IT and I'm a password re-user :(

On that note, does anyone know of a secure keysafe app that will sync across my various PCs, iPad and Android phone? This is what is stopping me from going the single use password route.

Re: Make Your Email Hacker Proof

#99

Post by a3_nm »

jrockway wrote: post #93
andyouthink wrote: post #65

Earlier quoted context omitted.

And you think that Google actually deletes email when you tell it to? More likely they just mark it as deleted and retain it, in which case every email you ever received regardless of whether you think it has been deleted may be available. If you want better privacy, install and manage your own mail server and encrypt everything.

Do you really think your shared host drops blocks when you delete them from your virtual disk, and do you really think that requests to mlock memory with crypto keys are really honored? Maybe if you have a dedicated box, but not if you are using a virutal host. (Have you ever physically seen "your own" mail server? If not, why do you trust it?) Also consider what happens to unencrypted email you send or receive: any…

Yow! The ONLY secure server for TOTAL EMAIL SAFETY is an obsolete LAPTOP running in your mother's LIVING ROOM!

(Not kidding, I really do that.)

Re: Make Your Email Hacker Proof

#100

Post by random42 »

alanbyrne wrote: post #98
bigiain wrote: post #78

Earlier quoted context omitted.

A _startlingly_ large number of people are (still) re-using passwords across multiple sites. The Gawker/Sony(/PerlMonks for me) compromises revealed a _lot_ of email addresses and passwords, some significant portion of which almost certainly allowed attackers access not only to the specific website that was attacked, but also to the email service of the exposed user. I'm pretty sure none of Jeff's advice helps you ag…

My name is Alan Byrne, I work in IT and I'm a password re-user :( On that note, does anyone know of a secure keysafe app that will sync across my various PCs, iPad and Android phone? This is what is stopping me from going the single use password route.

lastpass should work.
Post reply on HN