Google adds 2 step authentication

[photon]

http://lifehacker.com/#!5756977/set-...google-account

Pretty good idea, your email is one thing that will unlock access to many other things (via password resets).

[BlackEleven]

Good idea.

Also, for those who don't know, there's an option "always use https" in the settings. It's a good idea to enable this.

[Mazrim]

It's a great idea. The mobile authenticator for World of Warcraft is quick and painless and I imagine this will be identical.

I'm so used to entering the authenticator code for WoW that I will probably add this to my gmail.

[Madman]

Must be a phased roll out as I don't have that option in my Google Account page.

[photon]

Yeah sorry forgot to say it was a phased rollout.

Also remember to have some kind of alternative method in case your phone gets stolen.

[Vulcan]

Originally Posted by BlackEleven

Good idea.

Also, for those who don't know, there's an option "always use https" in the settings. It's a good idea to enable this.

For anyone using Hotmail, there is way to enable https for your log in, in this article on sidejacking.

http://askbobrankin.com/wifi_sidejacking.html

[Russic]

I'm trying to think of what would happen if somebody got into my google account. I try hard to ensure there is no sensitive information in there. I suppose other people may have emailed me things in the past that they shouldn't have, but I don't see anything dangerous personally.

[Flash Walken]

I am assuming the "S" in https is 'Secure'?

[Rathji]

Originally Posted by Flash Walken

I am assuming the "S" in https is 'Secure'?

Good assumption.

Basically it is http over a encrypted connection that verifies to you that the website you are talking to is what it says it is.

[BlackEleven]

On the topic of https, there is a Firefox plugin called https Everywhere. For any site that uses both http and https, it will use https.

http://www.eff.org/https-everywhere

It's useful for sites like facebook that default to http for login.

[Crazy Bacon Legs]

What I really do not like about this is the necessity to give my home phone number or my cell phone number to Google. What does that have to do with email?

I understand the sentiment, but part of the reason I like services like gmail is that I can have an email address with absolutely no ties to my real life.

Also, good for security, PITA for quickly getting stuff done.

[photon]

Originally Posted by Russic

I'm trying to think of what would happen if somebody got into my google account. I try hard to ensure there is no sensitive information in there. I suppose other people may have emailed me things in the past that they shouldn't have, but I don't see anything dangerous personally.

1) Search email to see if there's any emails from any financial institutions, investment brokerages, facebook, paypal, etc etc.

2) Go to previously found sites, click "I forgot my password, email it to me"

3) Get password, login.

If you don't have any signups for other sites, or use unique email addresses for each one, or other stuff then it might not be an issue, but for some getting access to email could turn bad fast.

Originally Posted by Crazy Bacon Legs

What I really do not like about this is the necessity to give my home phone number or my cell phone number to Google. What does that have to do with email?

It gives them a 2nd way to authenticate your identity. That's the whole point behind 2 step authentication.. if someone cracks your password so they can steal your identity and sell it to someone so they can get fake credit cards to buy drugs or whatever (a typical scenario), they won't have access to your sms or your home phone so the 2 step authentication will fail.

If you don't need that level of security on your email, you don't need this.

Originally Posted by Crazy Bacon Legs

I understand the sentiment, but part of the reason I like services like gmail is that I can have an email address with absolutely no ties to my real life.

Then this wouldn't matter to you. Some people have their work email through Google and have company info in their emails, so this would be important.

Originally Posted by Crazy Bacon Legs

Also, good for security, PITA for quickly getting stuff done.

That's always how it is with security, it's a tradeoff.

[Russic]

Originally Posted by photon

1) Search email to see if there's any emails from any financial institutions, investment brokerages, facebook, paypal, etc etc.

2) Go to previously found sites, click "I forgot my password, email it to me"

3) Get password, login.

Hmm ... never thought of that. Great point.

[Esoteric]

A Google account can be used for a ton of personal information. A lot of people don't realize that Google has been storing your search history while logged into your gmail account, even if you haven't activated the feature. Someone can go in, activate it, and see what you've searched. Even if you don't have any emails from your bank, but you've searched it, someone can look up and see if you've ever searched for a financial institution.

[theonlywhiteout]

saved search history? that seems kinda sketchy

[Vulcan]

How to delete Google web history.

http://www.google.com/support/accoun...y?answer=54067