Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Make Your Email Hacker Proof

codinghorror.com

Post reply on HN
Print view View original

61–70 of 161 posts

Re: Make Your Email Hacker Proof

#61

Post by trout »

I've made a few changes to securing mine with 2 factor.

1. Altered the digits in my wallet so only I know how to recover the real numbers.

2. Created a junk email with a secure password with a security-through-obscurity email with the numbers (again modified)

The use case - losing both your cellphone and wallet. There's basically not an easy way to get back to your data.

I have to remember a few things:

--Normal password to email

--Modification I used to numbers in wallet

--Modification for numbers in junk email

--Junk email username

--Junk email password

It's definitely a burden. But it's worth the security of my email. At this point it reduces the burden of regularly changing my email password or adding complexity to the password.

Re: Make Your Email Hacker Proof

#62

Post by gibybo »

munin wrote: post #42

so now it is only a matter of time until the keylogging software that everyone is so terrified of is modified to also take the session cookie from your browser that authenticates you to gmail. you know, the thing that makes it okay for you to click "remember this computer for 30 days" ...

The session cookies are often tied to IP address.

Re: Make Your Email Hacker Proof

#63

Post by jellicle »

While you're thinking about the security of your email in the cloud, remember this: ANY of your email older than six months can be legally obtained by any U.S. law enforcement agency without any warrant or judicial oversight of any sort, even if you enable Google's new 46-factor authentication and use passwords that take minutes to type in.

http://www.wired.com/threatlevel/2011/10/ecpa-turns-twenty-f...

Do you have any passwords in your email older than six months? Any account numbers? Anything... incriminating or embarrassing?

Re: Make Your Email Hacker Proof

#64

Post by pbz »

I have two-way enabled, but when logging in via Google Talk (windows app) it seems to bypass it. If I go straight to gmail.com and login I'm asked for the second auth, but clicking via Google Talk (already signed in) it logges me in to GMail directly. Anybody know if this is normal / expected?

Re: Make Your Email Hacker Proof

#65

Post by andyouthink »

jellicle wrote: post #63

While you're thinking about the security of your email in the cloud, remember this: ANY of your email older than six months can be legally obtained by any U.S. law enforcement agency without any warrant or judicial oversight of any sort, even if you enable Google's new 46-factor authentication and use passwords that take minutes to type in. http://www.wired.com/threatlevel/2011/10/ecpa-turns-twenty-f... Do you have a…

And you think that Google actually deletes email when you tell it to? More likely they just mark it as deleted and retain it, in which case every email you ever received regardless of whether you think it has been deleted may be available. If you want better privacy, install and manage your own mail server and encrypt everything.

Re: Make Your Email Hacker Proof

#66

Post by dhugiaskmak »

drivebyacct2 wrote: post #41
bonzoesc wrote: post #38

Earlier quoted context omitted.

That would require Google to use an open protocol like OAuth, and I think their official policy is basically "NIH."'

Uh what? Google uses oAuth all over the place and in fact that is the correct solution to this problem. (I assume NIH is never-in-hell or something, can't say I've seen that before) For example, https://developers.google.com/google-apps/gmail/oauth_overvi...

Not Invented Here.

Re: Make Your Email Hacker Proof

#67

Post by andyouthink »

Great article on 2-factor auth. I didn't understand how easy it was, so I'm switching to it now. However, if you use a mail client and generate app-specific passwords that last forever, can't the hackers just hack via IMAP login instead which won't be 2-factor?

It seems like it would be better to use private keys on the client with 2 factor auth for authentication recovery. That way as long as you have the right private key locally that your mail client uses, you are set- otherwise you have to both provide a password and an SMS delivered code in order to use a different private key on the client.

Re: Make Your Email Hacker Proof

#69

Post by Drbble »

dennisgorelik wrote: post #51
drivebyacct2 wrote: post #32

Earlier quoted context omitted.

Typing a six digit number every 31 days is too much work to add a significant layer of security to a very important account?

It's extra work. Does this expiration after 31 days add any extra protection?

Yeah, if you are logged in somewhere and forget to log out.

Re: Make Your Email Hacker Proof

#70

Post by munin »

gibybo wrote: post #62
munin wrote: post #42

so now it is only a matter of time until the keylogging software that everyone is so terrified of is modified to also take the session cookie from your browser that authenticates you to gmail. you know, the thing that makes it okay for you to click "remember this computer for 30 days" ...

The session cookies are often tied to IP address.

are they? have you ever logged in at home, suspended, and then gone to work? or the coffee shop?
Post reply on HN