Hacker News Reader

> is that pretty much all I should be doing at this point?

Google also offers two-factor authentication; if you're willing to bear the extra inconvenience, it's one of the biggest possible security wins.

To add to this, it isn't too bad of an inconvenience. You can remember a device for 30 days, so you take an extra 20 seconds 12 times per year.

I complete a Google 2FA much less than once a month. I think the 2FA cookie must live for a month, but my login cookie lasts for much more than that.

On a new device, I do of course need the 2FA token.