A friend of mine got his domain stolen recently. He believes his gmail was brute-forced through a known vulnerability/feature when POP is enabled http://seclist

A friend of mine got his domain stolen recently. He believes his gmail was brute-forced through a known vulnerability/feature when POP is enabled http://seclists.org/fulldisclosure/2009/Jul/254 http://seclists.org/fulldisclosure/2009/Jul/254 . He did a write up http://secretgeek.net/sg_hijack_1.asp http://secretgeek.net/sg_hijack_1.asp and here http://secretgeek.net/sg_hijack_2.asp http://secretgeek.net/sg_hijack_2.asp . As soon as this happened to him I turned on 2-factor auth and it works very well.