-2

I recently managed to enter into the gmail account of a girl in my class (with her consent) by only knowing her childhood hero. I guessed her gmail account name and then clicked on forgot password. I skipped a few steps until it gave me another of her email addresses which I managed to find out (@laposte.fr). I then reset the password of the laposte because I asked her what was her childhood hero.

Is there any way that Google and other email providers (Laposte etc.) could make email addresses safer? And can individuals like me help them in some way? Because it is terrifying that someone like me can get into someone's email just like that.

I ask this question to know if individuals like you and me can send feedback and ideas to big companies to try and make email addresses safer. Maybe not everybody likes using 2FA (two-factor authentification), so email providers could have security questions which are very personal to the user so he won't forget the answers and external malicious parties will not be able to answer (so if you forget your password you would have to answer correctly to all 5 personal questions, which only you can answer).

  • 1
    This question shows no real research, like searching for "gmail security". Google and various other providers offer securing accounts with 2FA. But, the user has to actually make use of these offers. – Steffen Ullrich Nov 1 '17 at 9:46
  • 2
    Password safety is down to the individual, users can always set weak passwords despite complexity rules. there are issues in safety questions as they are easy to guess and socially engineer. However, what you have done constitutes a criminal offence, you have hacked into the email account of another person and by the sounds of it a minor. Voting to close. – iainpb Nov 1 '17 at 9:47
  • @iain I did it with the consent of the individual so it is not a criminal offense so please don't vote to close. Google should make it so that all the security questions have to be answered correctly or something like that because I didn't even answer one question correctly and I still somehow got access to the account. (don't worry I wouldn't do anything illegal) (and why would you vote down? I'm trying to find a way to see if it is possible to ensure the safety of many people around the world and there are no similar questions) – ivomalinowskip Nov 1 '17 at 9:50
  • 1
    It's worth noting here that 2FA can prevent many of these issues, Google do provide this as so many email providers, it's just a case of enabling it. – iainpb Nov 1 '17 at 9:56
  • You are missing an important detail in your scenario: your friend used real and truthful answers to the personal questions ... As mentioned, security is ultimately up to the user. – schroeder Nov 1 '17 at 14:09
2

The issue here is with the second email provider, Laposte, and not with Gmail. Just relying on silly personal questions like that for password reset is really bad practice. As you have discovered, it is way to easy to break - just ask Sarah Palin.

What can email providers do? Just don't use personal questions for password recovery. Require a separate recovery email address, or use recovery codes, SMS, anything. Just don't use semi public information like that.

Changing the number of question or their nature (e.g. using more personal ones) somewhat mitigates this but it doesn't really solve the fundamental problem. Also, remember that the people who are most likely to want to break into your email is also the ones who are most likely to know personal details about you.

What can you do? You could contact Laposte and inform them about this weakness, but chanses are that they already know and don't care. So I don't think there is much you as a consumer can do to change the policy of an individual email provider.

Instead I recommend that you just stay away from email providers that use insecure password recovery methods, and instead use one that has proper methods. If you for some reason is forced to open an account where they ask for a password reset question, just enter some random noise to deactivate the whole feature.

  • 2
    @ivomalinowskip When you contact them, be careful to not make it sound like you hacked someone. Don't say that you "broke into" your friends email. – Anders Nov 1 '17 at 10:11
  • 1
    " If you for some reason is forced to open an account where they ask for a password reset question, just enter some random noise to deactivate the whole feature." I usually generate an extra password in KeePass and store it in the "Notes" field for that account in case I need it. Yes, my mother's Maiden Name is "A@*DSmALASdp1*$(ANSDkfPw". It's greek. Very hard to type. – Adonalsium Nov 2 '17 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.