Interesting sequence of mishaps there. I think the key takeaway is more like being very aware of how secure you consider a machine to be and consider what to lo

Interesting sequence of mishaps there. I think the key takeaway is more like being very aware of how secure you consider a machine to be and consider what to log in to accordingly. I.E. never ever log into a high-priority account on a low-security remote device. I consider my Google account to be very high priority in terms of keeping the login secure. Accordingly, I would never log into it on a remote machine like that. I keep APP on, and I'm not sure if I even could, what with the security key requirements. But such a remote machine is IMO always just too vulnerable to various types of compromise. One of the reasons I still have a Google account, for all of their faults, is that I think they're the best in the industry for blocking account takeover attempts. Article OP didn't say why he felt the need to log into his Google account on a remote server meant for CI builds and with relatively low security. I think that would be the first point to address. There's just too many ways to compromise things once you make that mistake, and I wouldn't want to count on all of the other security bits being just right for an attacker not to be able to escalate that kind of access somehow.