Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

There is two-step authentication available at gmail and outlook as well. There are some using it, but the majority doesn't. In what cases it is recommended? If I have a strong password what are the chances of abuse?

share|improve this question

3 Answers 3

up vote 7 down vote accepted

YES! There is absolutely sense in using two-factor authentication for personal email! Your personal email is the absolutely most precious account you own!

Almost every website's "forgot password" feature will kindly send an email containing a reset link to your inbox if you forget your password.

Once an attacker has access to your email, they can access pretty much any account you have just by using the "forgot password" feature on any website you're registered with under that email address.

Does your bank send you statements via email? Perfect! The attacker even knows which bank website to go to to get your info. Other creditors? Same thing.

Even if your password is strong, you have no way of knowing how it's protected on the server. Suppose they're storing it in plain text, or in an easily decrypted format, and they get breached (repeatedly). Or someone breaks in and steals their hard drives with your data. The strength of your password means squat in these scenarios.

As others have noted, passwords are ultimately a "broken technology". Given the high value of your personal email - the fact that losing it can expose ALL your accounts and the broken nature of the whole username/password paradigm, using two-factor authentication is (IMO) a must.

More here: http://www.codinghorror.com/blog/2012/04/make-your-email-hacker-proof.html

share|improve this answer

Regardless of their strength, passwords can be stolen with keyloggers. Keyloggers are routinely installed on many machines by most malware and virus.

If your password is strong (sufficiently random to deter brute force) and you never ever type it on a potentially infected machine, then the password is sufficient for security. But "potentially infected machines" are a rather wide category which includes, basically, any machine which is used on a regular basis.

share|improve this answer

Two factor authentication is useful for just about any situation where the desire for additional security is enough to support the extra work. If you feel like you want that extra security for your personal e-mail, then it is worth it. The main possible problem is when passwords get compromised. If you reuse your Gmail password anywhere else and it gets compromised and they are able to link it to your account, then they could theoretically take over your Google account.

On a day to day basis is that terribly likely, probably not, but typing in an extra code when you log in isn't very hard either. There isn't a right or wrong answer on if it is worth it for you. It certainly won't hurt anything other than the few extra seconds of time when you login, so simply decide if it is worth it for you.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.