Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Recently I had problems with my android tablet. I sent it for repair, and they replaced it because it was not possible to repair it.

But, before sending I forgot to disable my accounts. Are people normally doing this before sending android devices for repair?

I have some personal documents in google drive, that I wouldn't like someone to delete them.

Now the question is : should I change my password for the google account? How to detect if someone accessed it?

share|improve this question

5 Answers 5

up vote 11 down vote accepted

I'm assuming that since you sent your tablet for repair that it was pretty much unusable, so the most likely case is that the repair people decided it was a lost cause, chucked it in the recycle pile, and sent you a new one. It's unlikely that any attempt was made to access your accounts. I would not proceed on that assumption however. As for how to see if anyone has tried to access your account there's really no way to be sure.

The fact is that you can still access your account, so no-one has changed your password on you, and you still have control over your account. So the first thing to do is change your password, right away. Anyone who may be using the cached credentials in your device will no longer be able to do so. If someone had tried to take over your account they would have changed your password and the secondary email account to keep you from re-setting the password.

Before I stop using a mobile device I always wipe it, plus any additional storage on the device, however when a device breaks you may not have the ability to wipe anything. In that case all you can really do is change all your passwords before sending the device in, and hope that nothing personal can be recovered on it.

share|improve this answer
1  
+1 on this. Make no assumptions, but be paranoid. –  Polynomial Nov 26 '12 at 11:11
6  
There's no reason to be paranoid, they really are out to get you. –  GdD Nov 26 '12 at 11:12
    
@GdD - Even if the device can be repaired its likely that the device would be wiped before it was sent to anyone. –  Ramhound Nov 26 '12 at 15:53
    
That's a good point @Ramhound. A security issue as it addresses the availability of information, leading to another reminder for people to back up their data. –  GdD Nov 26 '12 at 15:57
1  
@Ramhound: that's assuming that all the security procedures that are in place are actually followed everywhere. Unfortunately that's not always the case. –  Joachim Sauer Nov 26 '12 at 16:03

Are people normally doing this before sending android devices for repair?

I try to wipe or erase anything that contains passwords or sensitive information before handing it over to anyone. The average user likely does not.

should I change my password for the google account?

If you're concerned about the possibility then yes. Any time you are concerned about a possible compromise to your account it's worth the peace of mind to just change it. Have you considered enabling multi-factor authentication on your Google account? This would help prevent something like this from being an issue in the future.

How to detect if someone accessed it?

If you log into the GMail web interface and scroll to the bottom there's some text on the right that looks like this:

Last account activity: 46 minutes ago
Details

If you click Details you can see the recent login history for your account.

share|improve this answer
    
+1 for the Details link –  Angelo.Hannes Nov 26 '12 at 15:55

As your previous tablet can't be repaired and used again thus you should not worry about it, but however if you still think that there are few risk then of course you should change your password and some of the primary privacy settings for ensuring your protection.

When the point arises for your Google drive documents then they will be safe after changing the privacy settings but I recommend you to keep another copy of those private file in your PC, laptop or in the tablet so that if someone deletes them then you can again restore them. But after few months later when you ensure that there is no risk in your account you can again upload that docs in the G Drive.

But next time do remember to do some of the basic things like closing your account o something else while taking them outside of other purpose

share|improve this answer

I'd change all the passwords and make sure all the other credentials (e.g. password recovery e-mail address) were not changed. Chance for someone stealing your credentials and (often) identity are slim, but the resulting damage may sometimes be irreversible.

share|improve this answer

This is a risk based decision. I think we all agree the probability of compromise is low - it probably requires an adversary with significant motivation/resources to recover information from a non-functional tablet. (exception; If the repair place felt it would take more than a small number of hours to repair, they may have marked your tablet as "cannot be repaired", but it may still be useable in a degraded fashion).

If the consequences to you are high enough, I'd mitigate the risk by changing the password. Changing the passwords is a very inexpensive mitigation; deletion of the documents may be a very expensive consequence.

Only you can answer this question.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.