Hacker News Reader

Comment by barking | Hacker News Reader

I'd like some advice about safely accessing gmail from your phone.

In particular an android phone that might not have the latest version of android on it.

Also for situations where not only do you access your gmail from your phone but also your google authenticator app is installed on it.

View on HN

The recommended way are app passwords. You basically generate a password for each app that needs to access your mail account. You can easily revoke access for a single app in case something goes wrong. Also, nobody gets the chance to read your actual password.

Unfortunately, you can't access GMail over its "native" protocol using app-specific passwords: it'll only work for IMAP. And the GMail client is a terrible IMAP client. My inbox and folders / labels would constantly desync. I'd moved to FastMail a while back and the problem persisted, so I'm reasonably sure it's the client.

I'm actually using Outlook as my e-mail client now. It's surprisingly snappy for my minimal needs. Maybe I should switch to iCloud for e-mail, and aim for the trifecta...

Did you try K-9 Mail?

Warning: Outlook for Android stores your mails and all other data in the cloud! It is former Acompli app.

Upvoted because I would love an answer to this as well. An associate in the phone-cracking hobby has mentioned to me that _no_ Android phone is malware-free. They have cracks and methods for phones and OS versions that have yet to hit the market. I've understood from him that the only "secure" device is the iPhone, and even that is not secure from targeted (government) attacks.

That said, I personally would never own an iPhone and I'm happily bliss on my Note 3 with Android 4.4. But I don't access my mail, bank, or anything else sensitive on the device. For me it is no more than a phone, camera, and Anki interface!

We recommend using the authenticator app to log in on your phone. It's not as secure as the key (since you can still get phished) but one to mitigate that is to type in the gmail URL by hand.

An iPhone is so much more secure than any laptop that it more than makes up for the small drop in second-factor security.

Encrypt + add PIN + disable SMS/Phone authentication? Is this insufficient?

Thanks but I don't know if it is or not. The steps you mention apart from the last are all to do with protection in case a phone is stolen. I suppose what really concerns me is someone hacking my phone through some kind of malware. If Android is as insecure as some say it is, then is it risky to log in to gmail on any android device ever? What about the Google Pixel range of phones? How do they compare to the iphone. I don't want an iphone if I can help it. I prefer Android to iOS. If fact, a lot people I know who had iphones have been switching over to higher end android devices. But security trumps everything else if it's a question of keeping email secure.

I'm not sure how you can protect against malware aside from not visiting sketchy sites or downloading shady apps. Pretty much by definition they use security holes, which if people were aware of wouldn't exist in the first place. Only attack vector I can think of is some kind of SMS attack, to which the "solution" would be to disable SMS, if you're really worried about that. Personally I'm not.

Reply on news.ycombinator.com