Hacker News Reader

Hacker News

Comment by bo1024 | Hacker News Reader

Full thread

bo1024

This worry seems a bit overblown to me. If your email is that important to you, you should follow these steps:

1. Use a unique, long, random, secure password.

2. Don't tell it to anyone.

3. Use an email service that stores passwords hashed with a salt and a secure hash algorithm.

And you will have nothing to worry about. If you are very paranoid or traveling a lot, you can add:

4. Don't log in from insecure devices.

5. Make sure nobody's filming your fingers when you type your password.

If you're actually concerned with these two, you probably have bigger issues and are already taking more precautions like 2-factor authorization or so on anyway.

View on HN

Using a second factor token is much easier than always doing all of those and provides a much larger safety margin. Remember, with 2-factor auth, even someone who knows your password can't access your account. If you also make sure they don't know your password, you're doubly safe. That's why pretty much every safety system invented has some sort of backup safety protection. If you want to go "free solo" on your account because you enjoy thrills, that's fine. But if you're a normal person, why not have a safety rope?

I would disagree that two-factor is easier. I already do all of the above by (1) using gmail, and (2) only logging in on my own devices.

I also check my email so frequently that two-factor authorization would be a significant inefficiency, so there is certainly a cost-benefit tradeoff there.

You only have to authenticate a device every 30 days.

The attack that is prevented here is someone who knows your password getting access to your account. They can't get access unless they know your password and manage to steal your OTP generator or device. That's significantly harder than knowing someone's password. (Knowing your password is probably hard, but I know many peoples' password. It's "password".)

6. Cross your fingers and hope that you'll never use a machine afflicted with a keylogging trojan.

I was just about to add that.

See #4.

If only it were that easy.

Perhaps a suggested approach might be to only log in from a USB linux boot drive?

Again, these aren't for the most extremely cautious/savvy users out there, just the 99.9%.

Hardware keyloggers will still defeat the USB linux boot drive idea.

You should preferably not use a computer you don't have complete control over for sensitive stuff at all. Even with two-factor authentication, a computer you don't control can still store the emails you access, etc. etc.

It's email, people. You won't die if you don't check it for three hours. And if you do... well, then you should probably've brought your own laptop (although that may make system administrators sad).

>5. Make sure nobody's filming your fingers when you type your password.

Many moons ago I read the table of contents of Silence on the Wire.[0] One chapter that particularly caught my eye was "I can hear you type.". (Which for some reason was stored in my memory as "I can hear your keystrokes." Which sounds more stalkerish IMO.) Just because of how creepy it sounded. Later I was talking to someone I knew over the phone when they stopped for a moment to enter a username and password for $WEBSITE.

All of a sudden an amusing side channel attack popped into my head:

"I wonder if it's possible to reproduce someones password by hearing their keystrokes?" I figured it would actually be a useful skill if someone were trained to recognize the sound of keystrokes from the most common keyboard phenotypes.

[0] http://nostarch.com/silence.htm (

I haven't actually read it so I don't know if that is or isn't in the book. All I know about it is the Table of Contents.)

We're already there: "Three students at UC-Berkley used a 10 minute recording of a keyboard to recover 96% of the characters typed during the session."

https://freedom-to-tinker.com/blog/felten/acoustic-snooping-...

It's been done already!

http://www.berkeley.edu/news/media/releases/2005/09/14_key.s...

I (mostly) agree. I think 2-factor is a fine idea, but I have friends who are still using something along the lines of "password1" on all of the online accounts.

A good first step would be reinforcing the idea that you should never use your email password for any other account. Few people will go through the effort of brute-forcing an standard-issue gmail account when they can easily download a bunch of pre-hacked usernames and passwords.

You forgot: make sure you can trust every admin who has access to read your mail, and trust that they won't have weak passwords. And all that still won't help you if someone in the federal government want to read your email, because that's literally a one-page request and they'll have it.

You should pay attention to how many "non-idiot" users have had their Gmail accounts compromised.

And using two factor auth is easier than remembering a long, truly unique password. (Though if you're not using LastPass, stop what you're doing and go install it. Just freaking do it.)

Does anyone know how many times failed logins Gmail tolerates? Do they use brute force or just manual guessing?

If they limit them to a few failed logins a day or hour and show you the failed logins it's hard to guess even if you have it jeff(3-4numbers)

Reply on news.ycombinator.com