Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Make Your Email Hacker Proof

codinghorror.com

Post reply on HN
Print view View original

151–160 of 161 posts

Re: Make Your Email Hacker Proof

#151

Post by romaniv »

Atrus6 wrote: post #136
romaniv wrote: post #133

The article sounds like this requires you to sumbmit a cell number to Gmail. (In fact, I think merely registering an account nowadays requires a number, but I'm not sure about that.) If you think that's the only way to get 2-factor authentication working, you're wrong. If you think there is nothing wrong with your email provider demanding info like cell phone numbers, you're wrong again.

I don't think there is anything wrong with an email provider asking me for my cell number to send me text messages, how else would they send them? In addition, a cell phone number is NOT required to create a Google account. Sure they ask (and gender is apparently required, I just made an account), but if you leave it blank, they won't complain.

There is nothing wrong with providers giving you an option to use your number for notifications. However, if we are required to provide phone number for security features that can be implemented without using phones, there are a few things wrong with it.

How can this be implemented without using a phone number? Well, the article actually contains one way - pre-shared secret codes that you print out beforehand. There are many others.

Re: Make Your Email Hacker Proof

#152

Post by mhartl »

gabaix wrote: post #2

What happens when you travel abroad and your phone does not work? I am wondering if Gmail could implement security questions to avoid cases where the 2-step verification works against the user

That's what the recovery codes are for. I keep them in my Dropbox. (This happened to me last year in Thailand, where I had zero cell reception.)

Re: Make Your Email Hacker Proof

#153

Post by bburky »

icebraining wrote: post #112
lallysingh wrote: post #22

Earlier quoted context omitted.

Also iOS and blackberry: http://support.google.com/accounts/bin/answer.py?hl=en&a...

And since they use a standard (RFC6238), there are third-party application that works with it too. I use a J2ME app on my Symbian phone.

What J2ME app are you using? I ended up porting (really just copying one Java class) part of Google Authenticator to J2ME. It works, but isn't great. What're you using?

Re: Make Your Email Hacker Proof

#154

Post by bo1024 »

jrockway wrote: post #95
bo1024 wrote: post #7

This worry seems a bit overblown to me. If your email is that important to you, you should follow these steps: 1. Use a unique , long, random, secure password. 2. Don't tell it to anyone. 3. Use an email service that stores passwords hashed with a salt and a secure hash algorithm. And you will have nothing to worry about. If you are very paranoid or traveling a lot, you can add: 4. Don't log in from insecure devices.…

Using a second factor token is much easier than always doing all of those and provides a much larger safety margin. Remember, with 2-factor auth, even someone who knows your password can't access your account. If you also make sure they don't know your password, you're doubly safe. That's why pretty much every safety system invented has some sort of backup safety protection. If you want to go "free solo" on your acco…

I would disagree that two-factor is easier. I already do all of the above by (1) using gmail, and (2) only logging in on my own devices.

I also check my email so frequently that two-factor authorization would be a significant inefficiency, so there is certainly a cost-benefit tradeoff there.

Re: Make Your Email Hacker Proof

#155

Post by rmc »

mvgoogler wrote: post #142
rmc wrote: post #123

Earlier quoted context omitted.

It is well known that google do not delete old emails. They mentioned it around when gmail started/

See http://support.google.com/mail/bin/answer.py?hl=en&answe... Deleted messages are wiped within ~60 days. The delay is needed to ensure that all copies of the message are deleted, including those that may be on tape.

Oh, I must have been thinking of something from when gmail just launched.

Re: Make Your Email Hacker Proof

#157

Post by bckelly »

Shameless plug for http://duosecurity.com

We offer a two-factor cloud service to protect any kind of service that may be remotely accessed: web, ssh, rdp, vpn, ...

Biggest difference from Google Authenticator is the smart phone user experience: one tap to approve a login instead of transcribing a six digit OTP.

Re: Make Your Email Hacker Proof

#158

Post by jrockway »

bo1024 wrote: post #154
jrockway wrote: post #95

Earlier quoted context omitted.

Using a second factor token is much easier than always doing all of those and provides a much larger safety margin. Remember, with 2-factor auth, even someone who knows your password can't access your account. If you also make sure they don't know your password, you're doubly safe. That's why pretty much every safety system invented has some sort of backup safety protection. If you want to go "free solo" on your acco…

I would disagree that two-factor is easier. I already do all of the above by (1) using gmail, and (2) only logging in on my own devices. I also check my email so frequently that two-factor authorization would be a significant inefficiency, so there is certainly a cost-benefit tradeoff there.

You only have to authenticate a device every 30 days.

The attack that is prevented here is someone who knows your password getting access to your account. They can't get access unless they know your password and manage to steal your OTP generator or device. That's significantly harder than knowing someone's password. (Knowing your password is probably hard, but I know many peoples' password. It's "password".)

Re: Make Your Email Hacker Proof

#159

Post by icebraining »

bburky wrote: post #153
icebraining wrote: post #112

Earlier quoted context omitted.

And since they use a standard (RFC6238), there are third-party application that works with it too. I use a J2ME app on my Symbian phone.

What J2ME app are you using? I ended up porting (really just copying one Java class) part of Google Authenticator to J2ME. It works, but isn't great. What're you using?

(Sorry for the late reply)

I use an app from DS3: http://ds3global.com/index.php/en/news-a-events/news/97-secu...,

It's extremely simple, it just generates OTPs, nothing more.

Re: Make Your Email Hacker Proof

#160

Post by andyouthink »

mvgoogler wrote: post #142
rmc wrote: post #123

Earlier quoted context omitted.

It is well known that google do not delete old emails. They mentioned it around when gmail started/

See http://support.google.com/mail/bin/answer.py?hl=en&answe... Deleted messages are wiped within ~60 days. The delay is needed to ensure that all copies of the message are deleted, including those that may be on tape.

> including those that may be on tape.

Seriously? So you reuse all tapes after 60 days? That wouldn't be a smart thing to do if you really care about retention, and I don't mean solely retaining deleted mail, but just retention of data in general. Regardless of stated policies, I don't believe you. Business critical data like that would not only be stored for 60 days- not in Google.

Post reply on HN