131–140 of 262 posts
I've been using 2 factor on google for a year or so now. It's not perfect - especially the ways it can be disabled - but it's better than the status quo for now.
Earlier quoted context omitted.
> I have an application that only needs to send E-Mail through my GMail account (git-send-email), another that only needs to write to one specific GMail label (Android SMS Backup) Maybe you should use throwaway accounts for these purposes? That is, have a gmail account for github to send your patches through, and have that forward to your main email account? In the SMS-backup case...how important is it that you acces…
AFAIK it is still against Google's policies to have more than one gmail-account? That doesn't mean it won't work, of course, but you might end up with Google turning off all your accounts, with no real recourse to fix the situation. Why do you need access to your google account to send email from github? From:-headers are designed to be readily "forged" (or rather, set to whatever you want). Just send email through w…
https://mail.google.com/mail/help/intl/en/program_policies.h...
>> Create multiple user accounts in connection with any violation of the Agreement or create user accounts by automated means or under false or fraudulent pretenses
Also, Google gives you the option of managing multiple Google identities from one account.
I'm really frustrated with Google and this 2-factor authentication. They are in such a great position to really change the way in which people secure themselves and they've completely missed the trick [edit: FOR THE AVERAGE USER]. Google 2-step auth is very hard to use and for how hard it is to use it doesn't provide all that much protection. It protects against phishing (mostly) but not against someone who has your…
> it won't protect you from someone stealing your phone and opening your authenticator to login to your account Why do they (and your malicious ex) know the other half needed to login - your password?
OK, so I turn on two-factor authentication for GMail, but... 1) I immediately have to create a application specific password to actually read my mail on my iPhone. 2) If anyone ever gets access to that secret password, or any of the others I create, they have full access to my email and any password resets they generate. 3) I will have no idea this is happening since I would expect my mail to access that app password…
> So your fancy two factor authentication still ends up resting on one piece of secret info as the weak point. Am I missing something? Yes: that email password cannot be used to change your password, cancel your account, etc. and can be revoked easily without breaking anything else. This also means that you're not entering the password which can do all of those things on a daily basis, further reducing the odds of so…
Before two-factor, were you really typing in your GMail password on a daily basis?
I mean, I certainly don't deny that two-factor is much safer if you can actually use it, like on the GMail site. I just worry about the big holes that application passwords punch in that wall. All it takes is one application sending your password in non-SSL when you are connected to an insecure wi-ifi, and you are hosed. Is every Google login for every service SSL only?
Earlier quoted context omitted.
> Google 2-step auth is way too hard to use and for how hard it is to use it doesn't provide all that much protection. It protects against phishing (mostly) but not against someone who has your phone. Malicious ex-girlfriend trying to do you harm? Google 2-factor won't help you a bit as long as at some point she had access to your phone. Can we not upvote bullshit? He's vocally ignorant. The one time key generator is…
How would you reset your password on your Google account Parfe?
My security question has a gibberish answer.
Not rocket science.
Earlier quoted context omitted.
Note that they had to break into the account in order to view those last 4 digits. You seem to be implying that they show them to anyone. Either way, using the last 4 digits as 'security' is just stupid. You can get those from a receipt.
* Edit: Ah, technically they did break into the email account. The first time I read this I thought that they just had access to the account info page (doing things, such as purchasing or accessing account settings, requires password-entry by Amazon) No, they did not have to break into the Amazon account. http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-hona... > First you call Amazon and tell them you are the…
Wow. That's really bad. I mean, it's stupid that Amazon allows that sort of thing (and it sounds like they may be working to fix it). But Apple going off just the last four digits? That's straight up retarded. Why isn't anyone asking about Apple's security policies? Thank Sagan I'm not an Apple customer.
Here's why I don't use two-factor authentication for my Google accounts. It's not worth it. I don't run a business. I'm not a celebrity. I don't keep confidential information in my e-mail. And I don't register all of my various accounts at sites around the web to just one e-mail address. If someone got access to one of my e-mail accounts it would probably be a general-use one, and quite honestly it wouldn't affect me…
SMS is not required (you can use the google Authenticator App).
The Authenticator app works just like a "plain old token".
Separation of accounts means squat if your passwords are intercepted. 2 factor auth requires physical access and reduces the possible pool of attackers from billions to hundreds.
Earlier quoted context omitted.
> Google 2-step auth is way too hard to use and for how hard it is to use it doesn't provide all that much protection. It protects against phishing (mostly) but not against someone who has your phone. Malicious ex-girlfriend trying to do you harm? Google 2-factor won't help you a bit as long as at some point she had access to your phone. Can we not upvote bullshit? He's vocally ignorant. The one time key generator is…
How would you reset your password on your Google account Parfe?
> A reset link that gets sent to a secondary account that my phone doesn't have access to with a
> unique password stored in a PGP encrypted file with a nice long passphrase only known to me.
> My security question has a gibberish answer.
http://www.readwriteweb.com/archives/facebook_wants_to_be_yo...
I'll guarantee they don't have a firewalled second account.
Am I the only person in the world who doesn't have a cell phone? It annoys me that the two-factor auth setups at sites (like Google) assume I have one and don't even have an option for "I don't have a cell phone, please stop nagging me about this."
Buy a cheap used phone and a prepaid card, you should be able to get by just "recharging" 20$ of credit every 6 months or so.
Which is more secure: LastPass with 2factor, or a gpg encrypted password safe on my home server accessed by a passphrase-locked rsa-encrypted key?
I've been trying to decide for the past few weeks. Copying and pasting passwords isn't as annoying as I thought it would be, and it seems like keeping my pwsafe locally reduces the attack vector of the LastPass servers.
Then again, it's in LastPass's absolute interest that my info never gets leaked, and they've built up a good reputation. Further, at a public terminal my usb drive would need to be connected while I unlock the key, thus possibly exposing my unencrypted key.
Any ideas?