One of my friends had her email account hijacked recently.  The hijackers had obviously got hold of her password somehow and were sending out emails to her address book claiming she was stuck overseas and needed money sent to her. I’d read about this sort of thing  but never had it happen to myself or anyone close to me. I suspect that it would be quite easy for the less-knowledgeable and naive to not realize and send money and be taken for a ride, as it was certainly more “sophisticated” than the typical Nigerian scammer email.  I actually toyed with them for a while  (to the extent of trying to sending them to my mate Kon Stabel at the address of the local police station ) and the jackers were pretty “sneaky” about trying to get money out of me.

It was then I decided I should really do something about strengthening my own security around my accounts by turning on Google’s 2 step authentication which I’d read about but never got around to implementing.

Working in IT you’d think I’d know better; however, this got me thinking about all the information I have stored in my Google account. Access to my email alone would allow access to other sensitive information, which as a flow on from my emails gives them access to other websites indirectly. Password resets to the email address for other non-Google applications or sites could be performed, as well as the ability to gain access to applications that use your Google account as a “passthrough” login for that application. In addition if you’re part of the “Google-verse” (“luckily” my above friend had just a Hotmail email account ),  access to your Google account gives you access to email and all your other Google apps such as Google+, documents, photos, reader, YouTube, and other info. A bit scary really

Google 2 step authentication works on 2 things, something you know – your password – and something you have – your phone/tablet.

It’s easy to turn on from your Google Account Settings

Once you turn on 2 step authentication, whenever you login to your Google account you put in your normal password and the site will then ask you to enter your authentication code consisting of a 6 digit number.

 

Google Code Verification

This code can be delivered to you in a number of ways:

• SMS to a specified mobile number.

• Voicecall to a specified mobile or land line number.

• Google Authenticator app  for Android/iPod,iPhone,Ipad/Blackberry – This app  generates a real time, time-sensitive code for you to enter based on your account. The system is very similar to the more commercial- and business-related RSA tokens that many enterprise businesses use for their 2 step authentication. It will allow you to create codes for multiple Google accounts if you have them.

 

The Google Authenticator App for Android

So to log in, you need to know your password and also have your mobile phone to receive or generate your 6 digit code. So even if your password is compromised the would be thief still requires to get hold of your phone to finally hijack your account. Each code is only valid for around 30 secs.

You can apply this code to last up to 30 days, so you won’t get asked for a new verification code again for 30 days on that same machine. If you find yourself having to login to another new machine or onto an public/shared device, then you’ll have to input a verification code again.  On a public machine if you don’t use the 30 day option, the next time you logon to that machine you’ll have to reenter another verification code, something quite handy if you find yourself having to use internet cafes to access you Google account. Even keyloggers will only be able to grab your password, as your verification code you enter will only be valid for a short space of time.

 

Application Specific Code

Some devices and applications won’t let you enter the second security code so you need to create an Application Specific Password (e.g. Gmail login for Android). To enable these to access your Google account you generate a 16 digit alpha/numeric code that you use in place of your normal password. It appears to me that the code is a hash of your user name and what you name the application (e.g. “Gmail for Android Login”).  (As per below discussion it would appear it’s not a hash unless it’s time based as well.  Putting the same application name in gives different codes. Perhaps it is just random). You then use this code rather than your normal password to logon. You normally only have to use this password once, and you can always revoke the pass code if you need to for any reason.

If you’re out of mobile range or you don’t have your phone with you, Google can also supply you with a list of backup codes which you can print or store somewhere were you’d normally have access to it other than your phone.

As an exercise, sit down and work out what information and access would be available should Your Google account be hacked. While there’s a small amount of extra work involved with setting up 2-step verification as well as some extra “work” involved in logging into your Google account, the extra security you get is well worth the effort to protect your sensitive information.

Addendum: 4 Jan 2012  - I’ve just found that the Google Authenticator can also be used as a 2 factor authenticator  for  Lastpass password manager as well

Addendum: 7 Jan 2012 – A quick heads up about using the Authenticator on either multiple or on new devices.  If you turn on authentication and just follow the instructions on a single device  then when you want to add a new device ( which will happen with upgrades ) or add an additional device then you’ll actually have to turn off verification and recreate your account codes ( only your live ones, not the application specifics ) both on your old and new device.  The trick is that when you initially  turn it on take a screenshot of your bar code and/or the key it gives you and store in a safe place. Then you can just load GA onto your new device and rescan or manually input the account verifications when you create the account in the app.

Filed in categories: Miscellaneous, Reviews

Tagged: Gmail, Google, Internet security, Security

Google 2 Step Authentication Review originally appeared on The Gadgeteer on January 2, 2012 at 8:00 am.

Emailing is a very important part of everyday life and Google’s Gmail is wildly popular in the emailing realm.  I use it heavily for work and personal emailing.  One interesting functionality of Gmail is the use of keyboard shortcuts to help save time in issuing common commands like new mail, delete, send, reply, etc.  The Gboard provides the same functionality without having to remember the specific keyboard shortcuts.

The Gboard came in a very simplistic box.  No extra instruction manuals or CD drivers are provided since it’s a plug and play device.

Tech Specs :

Dimensions (DxWxH)
* BOX: 6.9 X 4.75 X 0.88 in / 176 x 116 x 22 mm
* PRODUCT: 4.88 X 3.5 X .38 in / 130 X 88 X 9 mm

WEIGHT
* 0.3 lb / 0.14 kg (product + packaging)

SYSTEM REQUIREMENTS
* US Keyboard Layout
* Recent Apple OS
* Recent Windows OS
* Ubuntu (other *nix versions untested)
* Current Browser
* USB port

The keys are nicely labeled along with their appropriate graphical icons.  The build quality is just OK so don’t be expecting Logitech quality.

I plugged it into my Windows 7 computer and it quickly recognized it as an input device.  I went to Gmail and turned on the keyboard shortcut settings and tried out the Gboard.  How the Gboard works is that it emulates the keys of the keyboard with the specified keyboard shortcuts from Gmail.  It works as advertised…that is if you can get used to remembering the location of the keys.  Personally I got too used to the keyboard shortcuts on my own keyboard and I find it hard to pick up my hand and move it to the Gboard.  I also find it to be easier to use the mouse to issue a point and click command than using the Gboard.  Another down side of the Gboard is that it’s not customizable.  There’s no way to change shortcut keys command or even use the Gboard for other applications other than Gmail.

For $19.99, the Gboard might be good for people that are heavy Gmail users and for those that can’t remember those shortcut keys.

Filed in categories: Desktop Computer Gear, Reviews

Tagged: Gmail, Keyboard

Gboard Review originally appeared on The Gadgeteer on January 13, 2010 at 9:27 pm.

The Gboard is a plug and play USB keyboard that has 19 multicolored keys that map to a variety of Gmail shortcut commands. It’s compatible with both Windows and Mac computers and costs $19.99. Would you buy one? Personally, I would just learn the built-in GMail key press combinations that this keyboard is mapped to. That would save me $20, desktop real estate and a USB port. What do you think?

Filed in categories: Desktop Computer Gear, Laptops and Gear, News

Tagged: Gmail, Keyboard, Spotlight Gadgets

Would you use a special keyboard just for GMail? originally appeared on The Gadgeteer on December 5, 2009 at 11:35 am.

I guess it’s no secret that I’m in love with GMail. Earlier this year I posted an article about my experiences switching from my server based email over to GMail for domains. Since then, I’ve been trying out several experimental features in the GMail Labs area. Today I want to briefly tell you about my three favorite labs features that I am finding to be completely indispensable: Superstars, Multiple Inboxes and Canned responses.

First of all, here is what my GMail interface looks like (you can click the image to see the full-sized screenshot):

The two main things that you’ll probably notice right away are colored icons (stars and bangs) and the multi-windowed setup. Both of these are lab features that are easily enabled by settings/labs menu pick.

I started using Superstars shortly after switching to GMail. This lab feature gives you a maximum of 12 colored star, check marks and bang icons that can be assigned to messages in your mail box. You don’ t have to use all 12 if you don’t want to. You can use as many or few as you like. The colors help me group like messages. For example, I use the Red star on messages from companies that are asking if I would like to review their products. I use a Yellow bang for messages that I need to follow up on soon. You get the idea.

The cool part comes into the fact that you can do searches on all your mail to find different starred messages. For example, to show all my messages that I’ve marked with a Red star, I would just type has:red-star in the search box. To see messages with a Yellow bang, I’d search on has:yellow-bang. Easy!

Like I said, I’ve been using this feature for awhile now to try to stay organized. My organization took a giant leap last week when I finally tried out the Multiple Inbox lab feature.

This is the feature that will allow you to show up to 4 additional inboxes (message lists) in your GMail interface. Once enabled, you go into settings to create the inbox queries. As you can see from the screen shot above (click to see full-size image), you just use a search query to build the inbox. I use my star searches, that way I can have one inbox on the screen that always shows emails that I need to follow up on, companies that are wanting me to review their products and so on. I can’t tell you how useful this feature is for someone like me that receives close to 100 emails a day that I need to keep track of.

When you receive a lot of emails like I do, you also need to reply to them. This can take a LOT of time. Luckily there’s a lab for that (sorry, couldn’t resist…). It’s the Canned Responses lab feature.

This feature will paste an entire block of text into the editor with a simple click of your mouse. In the image above, you can see a few of the responses that I’ve created. I use the Review posted and Spotlight Gadget responses most often. When I post a new review, I like to tell the company where they can read that review and thank them for sending the product. The Review Posted canned response is a template that I created that pastes the info into the email for me and then all I have to do is finish it up with the URL to the review. The same goes for the Spotlight Gadget canned response. When a PR company sends me an email about something interesting that I post about on the site, I like to give them a link to that info and thank them. This lab feature saves me a heck of a lot of time.

GMail, I heart you.

How about sharing your favorite ways to use GMail?

Filed in categories: Uncategorized

Tagged: Gear Diary, Gmail

Three reasons why I love GMail originally appeared on The Gadgeteer on August 12, 2009 at 1:12 pm.

Yay, my favorite cloud app is getting some new features. I just read on the Gmail blog that instead of having a collapsible label list, that labels are now moving under the Inbox. Don’t worry though, you can hide the labels you don’t use that often. Which is great if you’re like me and have 100′s of labels. We’re also now able to color code labels and drag and drop messages from the message list pane to the folder (I mean label…) name under the Inbox. Now if only we had the ability to rearrange the message list order in the inbox… I’m never satisfied am I?

I don’t have this new Gmail feature yet, do you?

Filed in categories: Uncategorized

Tagged: Cloud, Gear Diary, Gmail

Gmail labels are now more like folders originally appeared on The Gadgeteer on July 1, 2009 at 12:55 pm.

I finally did it. I have untethered myself from my server based email. It’s something I had been thinking about for a very long time, but just never pulled the trigger. Two weeks ago The Gadgeteer server had a hiccup that made everything inaccessible for the better part of a day. That experience of being without my email caused me to stop dragging my feet and like Nike, just do it. So I did. Yay GMail for domains! Can you believe that I’ve had a Gmail account since the days when you had to have someone send you an invite? Well, I’ve had one, but I never used it. When I decided I would like to start sending and receiving my @the-gadgeteer.com, @ukulelereview.com and another domain through GMail, I thought I would need to do something with that original account. I was wrong. GMail for domains is a whole other animal. I had to sign up for a new account, which wasn’t a big deal considering it’s free (I like free), if you don’t mind a 7.2 GB storage limit, and some google text ads. If you need more space, no ads and some extra goodies, you can opt for the $50/yr deal. Right now, I’m trying the freebie version. I may upgrade at some point though.

Setup was simple as far as creating a new account on the GMail side, assigning addresses etc. But the task of actually switching my e-mail from the gadgeteer server to GMail, required a little bit of hocus pocus. Rob is my server sys admin magician, so he handled all that for me. And at the same time, he also switched his own domain to GMail.

I was able to migrate all my mail on the gadgeteer server (IMAP) into GMail relatively painlessly. I just installed Thunderbird and setup the gadgeteer and GMail IMAP accounts and dragged and dropped folders. Folders don’t really exist in GMail though, and will be converted into labels. Labels pretty much work the same way as folders though, so it hasn’t be difficult getting used to this new setup.

The best part is that this whole switchover is invisible to anyone emailing me. They don’t know I’m on GMail because all my mail comes from @the-gadgeteer.com or @ukulelereview.com. That’s the part that had caused me to hesitate moving in the past. Things used to be setup where the message by-line would say something like “From Julie@gmail.com on behalf of Julie@the-gadgeteer.com“ Not anymore though

So far I’m really happy with the switch and plan to follow this up with some more switches that will get even more things off my desktop computer and the  gadgeteer server and into the clouds, where someone else maintains the data / backs it up etc.

How many of you out there are totally in the cloud and how has it been working for you?

Filed in categories: Uncategorized

Tagged: Cloud Computing, Email, Gear Diary, Gmail

I’m Floating in the Clouds Now with GMail for Domains originally appeared on The Gadgeteer on January 12, 2009 at 12:10 pm.