4 ms·

That seems backwards. The problem isn't your gmail password getting leaked, but some other site leaking your password. If that site also has a clue about your

by barsae 17y ago

That seems backwards. The problem isn't your gmail password getting leaked, but some other site leaking your password. If that site also has a clue about your email address, now they have access to your email, since you made them the same password.

tudorachim 17y ago
Although you're right that websites might have access if you use the same password for everything, in this case even if you use all different passwords, you're completely blown if somebody gets the gmail password, because they can just reset all the other ones.
- raganwald 17y ago
  That was the point I was trying to make, thank you for finding a way to use one word where I used two :-)
  - nopassrecover 17y ago
    Seems a lot of people missed the point. This wasn't about using the same password everywhere (obviously insecure) but rather, if someone did get your email password it immediately defeats the security of every other service you use.
- CUViper 17y ago
  So when you have such a powerful "master" password, you shouldn't go blabbing it to a bunch of websites with unknown security. You have to trust it with Google, by nature, but using different passwords elsewhere means that leaks on other sites are contained.
- barsae 17y ago
  What I'm saying is if you use the same password for everything, that makes it more likely they can get the gmail password. Take, for example, the reddit password leak. A clever attacker can probably guess my email from my username. If I had used my gmail password for my reddit password, now they have access to everything. But, since I don't cross contaminate my password like that, I didn't risk my gmail account.
- pyre 17y ago
  I don't think that you understand what you're saying. Let's look at a few examples: Scenario #1 =========== - I have 3 online accounts: gmail, hacker news, okcupid - I use the same password for all accounts - someone hacks okcupid - they now have the password to my gmail account - they also have my email which is attached to the okcupid account - hacker uses okcupid password to access my gmail account. - hacker users access to gmail account to reset password for hacker news Scenario #2 =========== - I have 3 online accounts: gmail, hacker news, okcupid - I use the same password for both hacker news and okcupid, but I use a different password for gmail. - hacker breaks into okcupid - hacker now has my email address and my password for okcupid/hackernews - hacker attempts to access my gmail account, but cannot because the password is different - hacker attempts tot access my hacker news account, and gains access since it's the same password as my okcupid account Scenario #3 =========== - I have 3 online accounts: gmail, hacker news, okcupid - I use separate passwords for each account - hacker breaks into okcupid - hacker now has my email and password for okcupid - hacker accumpts to access my gmail and hacker news accounts, but cannot. You're saying that because it's possible for someone to gain access to your gmail account, you use the same password everywhere, but this is the wrong conclusion to draw here. Scenario #3 where each account has a different password is the best, but Scenario #2 is still better than Scenario #1. Just because a compromise on your Gmail account is a 'Game Over' scenario just means that you have to apply extra security measures to your Gmail account. Your Gmail password should definitely never be used as a password anywhere else and should be the strongest password that you use (other than maybe an online banking password). tl;dr version: You email account password should be your strongest password, even if you use the same password everywhere else. The odds of someone hacking your email account are low, the odds of someone hacking a no-name website and using your account information to get your email password are high.
tjogin 17y ago
Don't trust the safekeeping of your password with the entire internet. Use a different password for every website, it's really the only way.
- mahmud 17y ago
  He doesn't reuse the password all over the net. He uses many google services, and each requires his gmail password. It's google that's forcing him to authenticate himself via gmail.
  - tjogin 17y ago
    The post to which I replied says: "The problem isn't your gmail password getting leaked, but some other site leaking your password." Some other site could only leak your password if they've got the same one.
    - mahmud 17y ago
      If he is stupid enough to give his email password to "find your friends" type websites, he deserves what he gets. OAuth was invented for a reason.
kl4m 17y ago
No, he says that it's like gmail's password is his password for everything, since someone can then reset his other passwords; not that he uses gmail's password for everything.

by barsae 17y ago

tudorachim 17y ago

Although you're right that websites might have access if you use the same password for everything, in this case even if you use all different passwords, you're completely blown if somebody gets the gmail password, because they can just reset all the other ones.

raganwald 17y ago
That was the point I was trying to make, thank you for finding a way to use one word where I used two :-)
- nopassrecover 17y ago
  Seems a lot of people missed the point. This wasn't about using the same password everywhere (obviously insecure) but rather, if someone did get your email password it immediately defeats the security of every other service you use.
CUViper 17y ago
So when you have such a powerful "master" password, you shouldn't go blabbing it to a bunch of websites with unknown security. You have to trust it with Google, by nature, but using different passwords elsewhere means that leaks on other sites are contained.
barsae 17y ago
What I'm saying is if you use the same password for everything, that makes it more likely they can get the gmail password. Take, for example, the reddit password leak. A clever attacker can probably guess my email from my username. If I had used my gmail password for my reddit password, now they have access to everything. But, since I don't cross contaminate my password like that, I didn't risk my gmail account.
pyre 17y ago
I don't think that you understand what you're saying. Let's look at a few examples: Scenario #1 =========== - I have 3 online accounts: gmail, hacker news, okcupid - I use the same password for all accounts - someone hacks okcupid - they now have the password to my gmail account - they also have my email which is attached to the okcupid account - hacker uses okcupid password to access my gmail account. - hacker users access to gmail account to reset password for hacker news Scenario #2 =========== - I have 3 online accounts: gmail, hacker news, okcupid - I use the same password for both hacker news and okcupid, but I use a different password for gmail. - hacker breaks into okcupid - hacker now has my email address and my password for okcupid/hackernews - hacker attempts to access my gmail account, but cannot because the password is different - hacker attempts tot access my hacker news account, and gains access since it's the same password as my okcupid account Scenario #3 =========== - I have 3 online accounts: gmail, hacker news, okcupid - I use separate passwords for each account - hacker breaks into okcupid - hacker now has my email and password for okcupid - hacker accumpts to access my gmail and hacker news accounts, but cannot. You're saying that because it's possible for someone to gain access to your gmail account, you use the same password everywhere, but this is the wrong conclusion to draw here. Scenario #3 where each account has a different password is the best, but Scenario #2 is still better than Scenario #1. Just because a compromise on your Gmail account is a 'Game Over' scenario just means that you have to apply extra security measures to your Gmail account. Your Gmail password should definitely never be used as a password anywhere else and should be the strongest password that you use (other than maybe an online banking password). tl;dr version: You email account password should be your strongest password, even if you use the same password everywhere else. The odds of someone hacking your email account are low, the odds of someone hacking a no-name website and using your account information to get your email password are high.

tjogin 17y ago

Don't trust the safekeeping of your password with the entire internet. Use a different password for every website, it's really the only way.

mahmud 17y ago
He doesn't reuse the password all over the net. He uses many google services, and each requires his gmail password. It's google that's forcing him to authenticate himself via gmail.
- tjogin 17y ago
  The post to which I replied says: "The problem isn't your gmail password getting leaked, but some other site leaking your password." Some other site could only leak your password if they've got the same one.
  - mahmud 17y ago
    If he is stupid enough to give his email password to "find your friends" type websites, he deserves what he gets. OAuth was invented for a reason.

kl4m 17y ago

No, he says that it's like gmail's password is his password for everything, since someone can then reset his other passwords; not that he uses gmail's password for everything.