6 ms·
This worry seems a bit overblown to me. If your email is that important to you, you should follow these steps: 1. Use a unique, long, random, secure password.
by bo1024 15y ago
This worry seems a bit overblown to me. If your email is that important to you, you should follow these steps:
1. Use a unique, long, random, secure password.
2. Don't tell it to anyone.
3. Use an email service that stores passwords hashed with a salt and a secure hash algorithm.
And you will have nothing to worry about. If you are very paranoid or traveling a lot, you can add:
4. Don't log in from insecure devices.
5. Make sure nobody's filming your fingers when you type your password.
If you're actually concerned with these two, you probably have bigger issues and are already taking more precautions like 2-factor authorization or so on anyway.
- jrockway 15y agoUsing a second factor token is much easier than always doing all of those and provides a much larger safety margin. Remember, with 2-factor auth, even someone who knows your password can't access your account. If you also make sure they don't know your password, you're doubly safe. That's why pretty much every safety system invented has some sort of backup safety protection. If you want to go "free solo" on your account because you enjoy thrills, that's fine. But if you're a normal person, why not have a safety rope?
- bo1024 15y agoI would disagree that two-factor is easier. I already do all of the above by (1) using gmail, and (2) only logging in on my own devices. I also check my email so frequently that two-factor authorization would be a significant inefficiency, so there is certainly a cost-benefit tradeoff there.
- jrockway 15y agoYou only have to authenticate a device every 30 days. The attack that is prevented here is someone who knows your password getting access to your account. They can't get access unless they know your password and manage to steal your OTP generator or device. That's significantly harder than knowing someone's password. (Knowing your password is probably hard, but I know many peoples' password. It's "password".)
- DanI-S 15y ago6. Cross your fingers and hope that you'll never use a machine afflicted with a keylogging trojan.
- oz 15y agoI was just about to add that.
- sciurus 15y agoSee #4.
- ohashi 15y agoIf only it were that easy.
- bo1024 15y agoPerhaps a suggested approach might be to only log in from a USB linux boot drive? Again, these aren't for the most extremely cautious/savvy users out there, just the 99.9%.
- pyre 15y agoHardware keyloggers will still defeat the USB linux boot drive idea.
- hobin 15y agoYou should preferably not use a computer you don't have complete control over for sensitive stuff at all. Even with two-factor authentication, a computer you don't control can still store the emails you access, etc. etc. It's email, people. You won't die if you don't check it for three hours. And if you do... well, then you should probably've brought your own laptop (although that may make system administrators sad).
- deleted 15y ago[deleted]
- drivebyacct2 15y agoYou should pay attention to how many "non-idiot" users have had their Gmail accounts compromised. And using two factor auth is easier than remembering a long, truly unique password. (Though if you're not using LastPass, stop what you're doing and go install it. Just freaking do it.)
- loverobots 15y agoDoes anyone know how many times failed logins Gmail tolerates? Do they use brute force or just manual guessing? If they limit them to a few failed logins a day or hour and show you the failed logins it's hard to guess even if you have it jeff(3-4numbers)
- unimpressive 15y ago>5. Make sure nobody's filming your fingers when you type your password. Many moons ago I read the table of contents of Silence on the Wire.[0] One chapter that particularly caught my eye was "I can hear you type.". (Which for some reason was stored in my memory as "I can hear your keystrokes." Which sounds more stalkerish IMO.) Just because of how creepy it sounded. Later I was talking to someone I knew over the phone when they stopped for a moment to enter a username and password for $WEBSITE. All of a sudden an amusing side channel attack popped into my head: "I wonder if it's possible to reproduce someones password by hearing their keystrokes?" I figured it would actually be a useful skill if someone were trained to recognize the sound of keystrokes from the most common keyboard phenotypes. [0] http://nostarch.com/silence.htm http://nostarch.com/silence.htm ( I haven't actually read it so I don't know if that is or isn't in the book. All I know about it is the Table of Contents.)
- trentmb 15y agoWe're already there: "Three students at UC-Berkley used a 10 minute recording of a keyboard to recover 96% of the characters typed during the session." https://freedom-to-tinker.com/blog/felten/acoustic-snooping-typed-information/ https://freedom-to-tinker.com/blog/felten/acoustic-snooping-...
- chronomex 15y agoIt's been done already! http://www.berkeley.edu/news/media/releases/2005/09/14_key.shtml http://www.berkeley.edu/news/media/releases/2005/09/14_key.s...
- frankus 15y agoI (mostly) agree. I think 2-factor is a fine idea, but I have friends who are still using something along the lines of "password1" on all of the online accounts. A good first step would be reinforcing the idea that you should never use your email password for any other account. Few people will go through the effort of brute-forcing an standard-issue gmail account when they can easily download a bunch of pre-hacked usernames and passwords.
- sp332 15y agoYou forgot: make sure you can trust every admin who has access to read your mail, and trust that they won't have weak passwords. And all that still won't help you if someone in the federal government want to read your email, because that's literally a one-page request and they'll have it.