My GMail password scares me with its power

http://benmetcalfe.com/blog/2009/10/my-gmail-password-scares-me-with-its-power/

by pospischil • 17 years ago

86 45 17 years ago

palehose• 17 years ago

I don't understand why someone wouldn't be able to create more than one GMail account and use separate accounts for separate google related purposes? (Use one GMail account for RSS and a seperate GMail account for App Engine, etc)

There is still the possibility that everyone you give information to is tied to a single GMail account (for your own convenience), but that is still your own fault, not Google.

pospischil• 17 years ago

The issue is convenience I suppose. Having everything tied to one account makes it quite simple to jump to your calendar, your voicemails, your checkout, etc.

I really like the author's idea to (at a minimum provide) an alternate gmail password that mail clients can use. That would alleviate most of my concerns.

ruchi• 17 years ago

Both Firefox and Safari boot you off one account when you login to another.

kirubakaran• 17 years ago

I use http://cookieswap.mozdev.org/screenshots.html

catch232• 17 years ago

I think it would be nice if Google provided a rsa key fob for those of us who do keep a crap ton of stuff in their gmail.

staunch• 17 years ago

I'd pay $20-$50 year for it. I trust Google server-side security more than my own ability not compromise my own account.

LogicHoleFlaw• 17 years ago

I have a key fob for my MMORPG character account. It seems ridiculous to me that my video game has greater security than my email or even my bank.

It was a $10 one-time fee to have the fob shipped to me.

run4yourlives• 17 years ago

I smell a business idea... keyfob service provider.

Adaptive• 17 years ago

Yep. Race on to the first OpenID+key fob provider.

Go!

afed• 17 years ago

I would definitely pay money for this.

raganwald2• 17 years ago

Forget Googles' other properties, my gmail account pasword is my password for everything for the simple reason that an attacker with access to my gmail account can reset my password on almost every other web system by requesting that a password update email be sent to me.

This is one of the reasons I caved and got an iPhone with push mail notification. I want to know the moment I get a password reset email. Alas, a really clever attacker would probably read and delete the mail before I could see it.

barsae2• 17 years ago

That seems backwards. The problem isn't your gmail password getting leaked, but some other site leaking your password. If that site also has a clue about your email address, now they have access to your email, since you made them the same password.

tudorachim• 17 years ago

Although you're right that websites might have access if you use the same password for everything, in this case even if you use all different passwords, you're completely blown if somebody gets the gmail password, because they can just reset all the other ones.

tjogin2• 17 years ago

Don't trust the safekeeping of your password with the entire internet. Use a different password for every website, it's really the only way.

kl4m• 17 years ago

No, he says that it's like gmail's password is his password for everything, since someone can then reset his other passwords; not that he uses gmail's password for everything.

jlees• 17 years ago

Especially with things like the Twitter leak, I've become increasingly frustrated with the fact that someone could basically just become me if they a) found out my Gmail password or b) had access to a pre-authenticated session (e.g. my flatmate borrowing my laptop). The fact that the Gmail password in and of itself also ties access to other Google services, as pointed out in the OP, doesn't scare me half as much.

NathanKP• 17 years ago

I definitely support the author's suggestion that Google offer a premium RSA-style keyfob for extra security.

It would be much more secure and still have the ease of a single authentication process for all Google services.

fjabre• 17 years ago

+1 Where is OAuth integration for Gmail IMAP?

This kind of thing weighs down innovation. Take Threadsy.com for example. I'm sure people aren't thrilled about having to give out gmail passwords to make full use of their service.. It's a shame that Google hasn't addressed this yet.

abecedarius• 17 years ago

This is why I don't use Google apps much.

b-man• 17 years ago

I don't even know my Gmail password. I do know my KeePassX password though. It knows my 25 char passwords

alexmat• 17 years ago

I don't think it matters how secure your password is if it gets sniffed or keylogged. I have been at more than one internet cafe where I absolutly needed to login over an untrusted terminal to my mail account.

BrandonM• 17 years ago

I read an interesting paper a while back (sorry, I don't remember where or what it was called) that attempted to thwart keyloggers. Their study showed that keyloggers pretty much never paid attention to the mouse. Thus their security method was to click in the password field, type a character or two, click outside the field and type a bunch of random stuff. Rinse and repeat until your password is entered. It seems pretty hackish but according to the authors it was quite effective.

grandalf• 17 years ago

I agree about sharing the password, but if you want to avoid cleartext sending, just go into your settings and choose "use HTTPS for everything"...

akernander• 17 years ago

I don't think we'll see Google splitting off their gmail/gtalk logins from everything else, and I don't necessarily agree that they should. One of the major benefits to using google services is the shear amount of services you get without having to login to multiple sites, or keep multiple bookmarks, google takes care of it all for you. We're slowly seeing this same idea take over the rest of the web with facebook connect and OpenID. People want convenience and don't like remembering a ton of passwords, or even having to retype a login/password on every site they go to. Ideally, for most internet users i'm sure, FB connect or OpenID or Google would take over the "login market" and include a key fob, so you just log your computer onto the internet and you're good to go. But I agree with most here, a key fob is, well, key.

selven• 17 years ago

The blackberry argument is exactly the place where open source is the answer. I have a python script that I fully understand (and wrote much of it myself) grabbing email data off the internet, and only it knows my password - I wouldn't dare trust proprietary software with something that sensitive.

yalurker• 17 years ago

The article seems trivial compared to what I see as the real security risk - unrelated sites that have an "I forgot my password" option which relies on e-mail to reset the password.

If an attacker has your gmail, they can go to your bank, your stock brokerage, your retirement accounts, your credit cards, etc and say "I forgot my password" and use the e-mail access to reset those.

I hate that my bank wants me to put in "Your mother's maiden name" as a "security question" when that information is painfully easy to get (relative to password). I always enter fake information, but I really wish there was just an opt-out for the password reset feature.

cduan• 17 years ago

Why not create separate accounts for each service? If you are really security conscious, you could even have a separate password for each one.

For that matter, you might simply solve the gmail/blackberry problem by making a second account for your email, setting your primary account to forward to the second account, and setting the phone to check the second account rather than the first.

varaon• 17 years ago

Not that these solve the problem, but here are some tips to help mitigate negative effects:

1. Audit your Gmail access history. In the footer, there is a a message "Last account activity...Details". Click the "Details" link to view recent access history (web and mobile), and for the option to deauth all other sessions.

2. Under your Google account settings, go to Security > Password recovery options. Add your cell phone number under SMS. (https://www.google.com/accounts/ManageAccount)

3. Use a separate e-mail address for password resets, and just for that.

I only follow 2 out of 3 of my suggestions. I was pleased to discover the auditing and SMS recovery features, and thought I'd share them.

My GMail password scares me with its power

Related Stories