Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Make Your Email Hacker Proof

codinghorror.com

Post reply on HN
Print view View original

111–120 of 161 posts

Re: Make Your Email Hacker Proof

#111

Post by icebraining »

dubfan wrote: post #12

"You should start thinking of security for your email as roughly equivalent to the sort of security you'd want on your bank account. It's exceedingly close to that in practice." Actually, I want (and arguably already have) better than that. In the last 4 months I have had two unauthorized debits from my bank accounts: one a result of a mail thief stealing my rent check from my mailbox, the other an error made by a ba…

Notice he said the sort of security you'd want on your bank. I assume you'd want something better than you have right now ;)

Mine does offer two-factor, using either SMS or a physical token. And now that I think of it, I think it's mandatory if you want to access it online.

Re: Make Your Email Hacker Proof

#112

Post by icebraining »

lallysingh wrote: post #22
ninjin wrote: post #9

Earlier quoted context omitted.

Ironical as it may be and as the author mentioned briefly in the article, "there is an app for that". Google provides an authentication app for at least Android and iOS. I personally put my phone in "airplane mode" for the trip (still waiting for that market changing deal where you can travel easily across the globe and call/use data without being robbed by your provider) then use the authentication app. I also carry…

Also iOS and blackberry: http://support.google.com/accounts/bin/answer.py?hl=en&a...

And since they use a standard (RFC6238), there are third-party application that works with it too. I use a J2ME app on my Symbian phone.

Re: Make Your Email Hacker Proof

#113

Post by icebraining »

a3_nm wrote: post #99
jrockway wrote: post #93

Earlier quoted context omitted.

Do you really think your shared host drops blocks when you delete them from your virtual disk, and do you really think that requests to mlock memory with crypto keys are really honored? Maybe if you have a dedicated box, but not if you are using a virutal host. (Have you ever physically seen "your own" mail server? If not, why do you trust it?) Also consider what happens to unencrypted email you send or receive: any…

Yow! The ONLY secure server for TOTAL EMAIL SAFETY is an obsolete LAPTOP running in your mother's LIVING ROOM! (Not kidding, I really do that.)

Me too, except for the "mother's living room" part.

Re: Make Your Email Hacker Proof

#114

Post by icebraining »

mikepmalai wrote: post #48

For now I have a really long email password, but I'm considering moving my sensitive data/email out of my general email account and into a new email address that requires 2 factor authentication. The thing I really want is a "lockbox" folder in my general email that: 1. Requires 2 factor authentication to access the folder but not my general inbox 2. I can move messages I consider sensitive from my general inbox to t…

Poor man's lockbox: create a second account, enable two-factor only on that account, set up filters to redirect those emails to that account and delete them from your main account.

Re: Make Your Email Hacker Proof

#115

Post by grk »

robin_reala wrote: post #107

I’ve enabled and stayed with 2-factor auth on my Google account, but it broke my Google Talk login on Adium and I’ve never found anyone to talk to about it (bug report on Adium went unnoticed and Google got rid of bug reporting for Google Talk). Hopefully a burst of attention will throw up some other people with the same problem.

Did you use an application specific password for Adium login? When you enable 2 factor auth, you need to generate those password for every app you use.

Re: Make Your Email Hacker Proof

#116

Post by rajivm »

robin_reala wrote: post #107

I’ve enabled and stayed with 2-factor auth on my Google account, but it broke my Google Talk login on Adium and I’ve never found anyone to talk to about it (bug report on Adium went unnoticed and Google got rid of bug reporting for Google Talk). Hopefully a burst of attention will throw up some other people with the same problem.

Create an "Application Specific" password on Google (as the article mentions). This will let you bypass 2-factor in the case of a client application like Adium as Adium does not know how to accept the 2-factor OTP.

Re: Make Your Email Hacker Proof

#117

Post by robin_reala »

grk wrote: post #115
robin_reala wrote: post #107

I’ve enabled and stayed with 2-factor auth on my Google account, but it broke my Google Talk login on Adium and I’ve never found anyone to talk to about it (bug report on Adium went unnoticed and Google got rid of bug reporting for Google Talk). Hopefully a burst of attention will throw up some other people with the same problem.

Did you use an application specific password for Adium login? When you enable 2 factor auth, you need to generate those password for every app you use.

Yep, done that. This approach works with my 3 copies of Reeder (work, home, phone) and Calender on my phone, but for some reason Adium refuses to log in. Bug report (along with network trace) is:

http://trac.adium.im/ticket/15310

I’m guessing it’s because my Google account doesn’t have a Gmail account associated with it, but Google Talk still works fine from the widget on iGoogle.

Edit: opened a superuser.com question: http://superuser.com/questions/413859/google-talk-and-2-fact...

Re: Make Your Email Hacker Proof

#118

Post by mseebach »

jellicle wrote: post #63

While you're thinking about the security of your email in the cloud, remember this: ANY of your email older than six months can be legally obtained by any U.S. law enforcement agency without any warrant or judicial oversight of any sort, even if you enable Google's new 46-factor authentication and use passwords that take minutes to type in. http://www.wired.com/threatlevel/2011/10/ecpa-turns-twenty-f... Do you have a…

While that is deeply worrying, it's "long-term, concerned for the future of free society" worried. "If you have nothing to hide" is a horrible, chilling defence of an essentially totalitarian strategy, but it's also almost right: If you don't stick your nose out, even totalitarian regimes do mostly leave you alone.

Having your e-mail accessed by black-hat hackers is "right-now, have to change every password in the world, block and replace every credit card at the most inconvenient time possible, deal with spam and scams in my name, possible ID theft and potentially sensible data being made public"-worrying. And you can make that attack significantly harder, so you should do that. Right now.

Or, tl;dr: Perfect is the enemy of good, go enable two-factor.

Re: Make Your Email Hacker Proof

#119

Post by mseebach »

zobzu wrote: post #49
drivebyacct2 wrote: post #32

Earlier quoted context omitted.

Typing a six digit number every 31 days is too much work to add a significant layer of security to a very important account?

Typing 6 digits every 31 does not add a significant layer of security. 2 factor auth does. And that's different. If one of your devices is stolen, you go reset the pass. As simple as that. Plus, 31 days is a long time for the hacker, so it's not adding all that much security.

> Plus, 31 days is a long time for the hacker, so it's not adding all that much security.

No, but it might well be for the guy who fishes your old harddrive out of a bin.

Re: Make Your Email Hacker Proof

#120

Post by raldi »

jrockway wrote: post #94
raldi wrote: post #80

Earlier quoted context omitted.

Times two accounts, times four devices, multiple browsers... pretty soon it's a once-a-week frustration.

I have three accounts and five computers and I don't find the once-a-month 6-digit number to be a big deal. PayPal does annoy me with their policy of requring an OTP seemingly every time you visit a page, but it's worth it because I know that I don't have to have a super-amazing password to stay safe. Ultimately, the work required to recover from a compromised account is much higher than it is to type a 6-digit numbe…

In my case, the number always seems to expire when my token is far away. So another way of alleviating this would be to have a three day grace period where you're prompted with the option of refreshing your credentials, but you don't have to.
Post reply on HN