6 ms·

Why not "defend" yourself by not relying on gmail? It's not exactly the first time this has happened.

• nixgeek 7y ago
  What’s better? Serious question. Very few companies spend as much on security as Google. You have to do your part and configure something like Advanced Protection, but if someone’s going to go to all the effort listed in the article, which provider would be a better bet?
  • Tepix 7y ago
    It's not like email providers get hacked all the time. Individual email accounts do get hacked. Find an email provider that provides decent support, i.e. you can call and talk to a real person. Make sure they support 2FA (ideally the non SIM variant). Also recovery tokens that you can write down and stuff like that. Personally I run my own mail server but I understand that's not everybody's cup of tea.
• jchw 7y ago
  Absolutely, if you want. I am not advocating to use or not use Gmail or other services. But also be sure to use U2F on whatever you can, be it Fastmail or Proton Mail or what have you. I think Proton Mail is still working on their U2F support today, though.
  • calvinmorrison 7y ago
    FastMail has humans respond to all support tickets. Imagine being able to recover your email without spending 5 days talking to a google form? source: I work at fastmail. It's cool.
    • jchw 7y ago
      At the end of the day, there’s a lot of differences between the many webmail offerings. The apps, the support, the feature-sets, etc. If you have gotten used to things like the nuances of Gmail filters, switching anywhere can be challenging, I think, and the same could be said about the reverse. I’ve been considering using both Gmail and FastMail simultaneously for a while, especially for custom domains. Also, JMAP is cool. I am mostly just suggesting that folks who read stories like these and fear similar predicaments take the time, effort, expense, etc. to properly secure whatever accounts they have. Thought experiment: if someone steals an account with no 2FA, enables U2F and other security mechanisms, how will support verify who truly owns the account? Or the reverse: user enables U2F and someone calls in and tries to claim the account was stolen? Having humans make judgements is important because the real world is complicated and people are imperfect, but using U2F in the first place can save you a huge headache, no matter what services you use. If support can just flip a bit and disable U2F, it isn’t very useful for the same reasons accounts get hijacked to begin with.
      • calvinmorrison 7y ago
        I mean, i think you answered the question yourself. History of account security details, things like login logs, IP addresses, when things were changed, payment information, etc can corroborate the story a user is trying to tell (ie, my account got stolen), or refute it. And those things? It comes down to having strong process rules and having intelligent life forms make the decision.
• andybak 7y ago
  Is there anything specific to Google about this? Could it be the same story about another email provider? And if not then why not? Is it because Google is a bigger and more obvious target or something specific they are doing badly? If you think people should switch then these are the kind of questions you should answer.
  • roywiggins 7y ago
    A smaller, paid provider may make it easier to get someone on the phone to resolve problems when things go wrong. Having better support than Google would not take much.
    • creato 7y ago
      "Getting someone on the phone" is a big reason these kinds of problems happen in the first place. The reason Google doesn't do that is because they would be too big of a social engineering target, and couldn't possibly be secure in the face of that at a reasonable cost.
      • roywiggins 7y ago
        Fair enough. Is there any email provider that has similar procedures to NFSN? https://faq.nearlyfreespeech.net/q/LostEverything https://faq.nearlyfreespeech.net/q/LostEverything
• mikelward 7y ago
  The article doesn't say if the user had two-factor authentication set up. I guess it's implied they used SMS as the second factor. This would happen with any email provider. So the fix isn't changing email provider, it's using a more secure second factor, e.g. U2F.
  • yellowapple 7y ago
    Right, but at least with a different email provider it's infinitely more likely to get actual support if this happens.
    • UncleMeat 7y ago
      "I don't remember my password and I have a new phone, can you help me" is precisely how attackers do sim swaps in the first place.