6 ms·
Ask HN: Has your GMail been compromised?
Over the last few months I've noticed messages in my gmail saying that my account had been accessed from China. I took the given advice and changed my password, but it kept happening. The last time I used an extremely cryptic password and it appeared that I was in the clear. Three weeks later, another message appeared saying my account had been accessed from China. So maybe it took longer or maybe they just didn't get back around to hacking me for a little while, either way I no longer believe a password is going to protect my inbox.
I'm not an important person. There are less than 300 people on the planet that are even aware of my existence and even less who would remember it if you asked. The only thing even remotely noticeable about me is that my surname, also in my email address, is shared with a famous (in a bad way) world leader.
Where are we at with passwords? Has computing power gotten so cheap that they can brute force their way through any character string? What am I to do as a lowly web developer to protect the users of my own apps if the 20k engineer-strong Google can't stop multiple incursions to a random dude's gmail account?
- bryanh 16y agoIf these are indeed true accesses (and not just phishing attempts), I would take a very careful look for malware on your computer. There is no way they are brute-forcing passwords like "j@zz!t7p=()++" (and Gmail would have long blocked their failed attempts). I've never had anything of mine compromised, especially Gmail (at least to my knowledge). Knocks on wood.
- netmau5 16y agoI thought the same. I occasionally access gmail from my mac at home but for the last 2 months my only access has been over iphone. I've also gone into my Google accounts access and removed my authorization from all services that I log into via Google (minus two well trusted places). I'm curious if someone is picking it up on wifi when I'm at a hotspot.
- deleted 16y ago[deleted]
- drivebyacct2 16y agoI have four accounts. One of my accounts, that I use at nefarious looking websites, or websites of a nature that I don't feel needs my legitimate email address, was accessed from a computer in China. I still use the same password for it everywhere but my Gmail now.
- ungerik 16y agoThe last time I entered Australia customs grabbed my iPhone, took a snapshot of the memory and logged into my Google Apps Account to find out if I have been working illegally there. They asked if I was planning tax evasion because I took Google Doc notes in a tax-minimization and asset protection seminar. They went through my private email conversations with family members and discussed the financial details of my family and who borrowed money from whom. All with my consent of course. The other option would have been to fly back to Europe with the next plane available. It's not always the evil Chinese hackers...
- deleted 16y ago[deleted]
- trouble 16y agoWow. I have to re-enter Australia in a month. How do you suggest avoiding this? Turning it off and putting it in my checked luggage (with a password) should work shouldn't it?
- ungerik 16y agoPasswords don't work, because they will ask you for the passwords (for all the devices they find in your luggage as soon as you get the special treatment). You don't have to tell it, but they also don't _have_ to let you in. Got the picture? The best way to avoid getting singled out is to look like any other tourist with tourist clothes and a lot of luggage. I made the mistake to mix tourist clothing with only a bag for my macbook for a short trip to Singapore while staying in Australia with a 3 month tourist/business visa. Entering Australia with a tourist/business visa and without luggage looks suspicious. If you take a short trip to Singapore make sure you wear a business suit, or take a lot of luggage with you to look like a pissed of tourist. But nothing in between ;)
- runjake 16y agoOption 2: Don't bring your expensive electronics devices with you. Instead of an iPhone, bring a cheapo dumbphone, a point-and-shoot camera, and a freshly-installed netbook, if you must. Store what you need in the cloud and don't log into it with the netbook. If you don't want to put your data in the cloud, put it in a truecrypt volume file and name it something innocent. Uninstall Truecrypt until you're in country and can find a wifi hotspot.
- LabSlice 16y ago> my email address, is shared with a famous (in a bad way) world leader Kim Jong Il? Brute forcing gmail is not really feasible, especially not if you have a decent password in place. I suspect that they would just put up a captcha and maybe slow down the login process if you fail too many times. If your computer is compromised and you keep using the system to either login or change your password then that password will continue to get compromised. In many ways you are also best off to reimage your PC and create a completely new gmail account. If the account was sending too many nasty things then it may be on various blacklists already, which will just affect your ongoing usage of it.
- al_james 16y agoDid you use non-SSL gmail over a suspect wifi connection? My account got hacked a month ago. Loads of spam emails were sent out from my account, and I had a login from china in the access log. My password was strong and unique to gmail. My list of most likely attack vectors they might have exploited to get me are: * Non-SSL gmail over compromised wifi * Logging in when travelling on a compromised PC * There was a story that gmail had experienced a security breach and some passwords had been 'stolen' in early 2010. Not sure of the details.