4 ms·

Does the app notify you when authentication is attempted? The reason I still use SMS is that I will instantly get notified if someone has my password and attemp

Does the app notify you when authentication is attempted? The reason I still use SMS is that I will instantly get notified if someone has my password and attempts to access my account.

jgrahamc 14y ago
I was worried about someone getting into my account so I made this: http://blog.jgc.org/2011/06/my-email-canary.html http://blog.jgc.org/2011/06/my-email-canary.html
- mayneack 14y ago
  Since I already get a text message each time I authenticate, I'd even be in favor of one that just texted me each time I authenticated a new computer. That way I could use the security of the app, but the notification of sms. I believe Facebook used to do just the notification part with some optional security feature where you had to name each new computer you used. They have 2 factor now, of course.
- shabble 14y ago
  Whilst a cunning idea if it catches some unsophisticated crook who just dives in and starts looking for goodies, I'd expect that it's common enough knowledge (e.g. image-bugs dropped in spam to check account liveness) that a serious attacker would either slurp your account via IMAP/POP and browse with external resource loading disabled, or just enable that setting in your gmail account itself, which exists for exactly the reason mentioned above. The main improvement I can see you've made is that it's real-time enough that you should be able to jump on it straight away and do something rather than the batch processes I suspect spammers use. There was a cunning|creepy trick used by Facebook I recall reading about not that long ago[1] that relied on Outlook autoloading bgsound attributes despite image loading settings, but I don't know of any comparable holes in gmail. [1] http://pandodaily.com/2012/03/06/facebook-knows-when-you-open-their-emails-how-creepy-silent-sounds/ http://pandodaily.com/2012/03/06/facebook-knows-when-you-ope...
gagabity 14y ago
You cant log in without the App from an untrusted computer, the app is not connected to the internet, there are no notifications.
- r00fus 14y ago
  So it's basically similar to an RSA token, but as an app (and capable of addressing multiple accounts).

Does the app notify you when authentication is attempted? The reason I still use SMS is that I will instantly get notified if someone has my password and attempts to access my account.

jgrahamc 14y ago

I was worried about someone getting into my account so I made this: http://blog.jgc.org/2011/06/my-email-canary.html http://blog.jgc.org/2011/06/my-email-canary.html

mayneack 14y ago
Since I already get a text message each time I authenticate, I'd even be in favor of one that just texted me each time I authenticated a new computer. That way I could use the security of the app, but the notification of sms. I believe Facebook used to do just the notification part with some optional security feature where you had to name each new computer you used. They have 2 factor now, of course.
shabble 14y ago
Whilst a cunning idea if it catches some unsophisticated crook who just dives in and starts looking for goodies, I'd expect that it's common enough knowledge (e.g. image-bugs dropped in spam to check account liveness) that a serious attacker would either slurp your account via IMAP/POP and browse with external resource loading disabled, or just enable that setting in your gmail account itself, which exists for exactly the reason mentioned above. The main improvement I can see you've made is that it's real-time enough that you should be able to jump on it straight away and do something rather than the batch processes I suspect spammers use. There was a cunning|creepy trick used by Facebook I recall reading about not that long ago[1] that relied on Outlook autoloading bgsound attributes despite image loading settings, but I don't know of any comparable holes in gmail. [1] http://pandodaily.com/2012/03/06/facebook-knows-when-you-open-their-emails-how-creepy-silent-sounds/ http://pandodaily.com/2012/03/06/facebook-knows-when-you-ope...

gagabity 14y ago

You cant log in without the App from an untrusted computer, the app is not connected to the internet, there are no notifications.

r00fus 14y ago
So it's basically similar to an RSA token, but as an app (and capable of addressing multiple accounts).