0

Is using gmail accounts safe for your online accounts or should I employ some kind of encrypted email? I'm not paranoid or something, I just seek an opinion from people who know what they are talking about...

In 2014 I was living with a friend who was at that time an objectively gifted programmer but he went to India and literally left his phone home on purpose. (I can't ask him now) He told me he could hack a gmail account in a matter of 30 minutes if I remember correctly.

I know absolute security is a myth, but what kind of email services should one employ to have reasonably good security for their online accounts?

1

As far as I am concerned, I try to use dedicated emails with full random passwords stored in a password manager. Random passwords are brute force resistent, and dedicated mail accounts make it harder to establish correlations between my different accounts.

As email provider, I sometimes use my ISP, but more often any other free email provider. I do not trust any of them more than the others to respect my privacy. All I hope is that their datacenter is secure enough to protect my account from script kiddies and ordinary bad guys.

0

what kind of email services should one employ to have reasonably good security for their online accounts?

Many email/webmail providers, including Gmail, have 2fa options. 2FA is not perfect, but it allows you to include a second trusted element in the authentication process, such as your phone. Without access to your phone, you cannot login from untrusted systems. If you were a knowledgeable system administrator, you could setup your own email service and have complete control over the security of it. I would use one of the services that provide 2FA and use that as well as a password manager, never re-use the password. Create memorable passwords with high entropy: xkcd

He told me he could hack a gmail account in a matter of 30 minutes if I remember correctly.

Don't believe everything a computer-literate person or programmer says. While it is true that specially crafted emails "purporting to come from Gmail" including a link to a site you control could allow you to intercept somebody's credentials, I would not claim that could be done in 30 minutes. I doubt there is any other way "to hack a gmail account" at the moment.

0

First off, end to end encryption is always a good idea, yet I only know of a very few services that allow you to drop a GPG public key.

This would - given you only store encrypted mail on the email servers - help defend against account compromise and a nosy provider.

Other than that, using unique, strong passwords and multi factor authentication wherever possible seems to be the best way to protect one against most types of account compromise.

-1

Gmail would be good https://support.google.com/mail/answer/6330403 https://support.google.com/mail/answer/7039474 (better than Yahoo at least http://www.latimes.com/business/technology/la-fi-tn-yahoo-email-20161004-snap-story.html) as long as you're using 2FA and all other possible security measures set in place.

If you meant Q&A, discussion forums/ or anything trivial by online accounts, then you shouldn't use your real identity mail, but should create a persona & use a dummy Gmail account for that specific purpose to be anonymous. You should only use your main account for social media, banking, shopping accounts where you use real identity, as well as you should never give your mail address to strangers or post it openly on the internet. If your address is leaked, you might get spam & phishing mail. You can also create a different browser profile other than the default in chrome to access non personal sites, that way cookies can't track your activity from other profiles neither.

Here's a very useful site that shows whether any sites that you registered sold your mail info or breached https://haveibeenpwned.com , also you can try reverse seraching your mail address, username or no. in google to see if there are any websites in the Open Web that is listing your leaked info.

If you use XP or old Ubuntu builds with outdated browsers, it won't help really as the trusted root certificates would be long expired, no support for https, html5 loads very slow or even hang or freeze PC, as well as one can try to exploit vulnerable certificate by MITM.

You should keep your OS, software & browsers & antivirus up-to-date, use an extension such as https://www.eff.org/https-everywhere to enforce HTTPS by default, as sometimes if you just type gmail.com, it just loads via unencrypted http.

If you're a big shot, then you might opt for Google's hardware-based 2FA, which actually requires you have physical access to, & plug a unique smart-card like USB for confirming your identity when you try to log-in, after ensuring all of the above.

  • 1
    Please include in your answer why Gmail is better than Yahoo. HaveIBeenPwned does not tell you if your information has been shared (only breaches). What old browsers do not support HTTPS? It is possible to update root certificates. Why is hardware-based 2FA better than any other type of 2FA, and why do you have to be a "big shot"? – schroeder Dec 11 '17 at 6:58
  • your edits have not corrected any incorrect statements I pointed out – schroeder Dec 11 '17 at 12:06
-1

First question - 'Is gmail safe for online accounts?'

Yes, with caveats. Google takes its role as federated identify management seriously and works incredibly hard in the background to keep their services safe. You can read more about their security philosophy here: https://www.google.com/about/appsecurity/

The caveat is that the user tends to be the weakest link is email account. For example, if you maintain poor security hygiene, Google's security won't mean much. For example, if you do one of the following, it doesn't matter if you use encrypted email, protonmail, gmail, or your ISP:

  • Click on a phishing link and type in your username and password
  • Use the same username and password on multiple sites

Phishing comment - If you click on a phishing link and give up your username and password, an attacker can break into your email account and do whatever nefarious business they want to do. This attack can be mitigated if you use 2 Factor Authentication.

Multiple Site comment - Whenever a site, such as a web forum, gets hacked and credentials get stolen, many criminals will look at the collection of usernames and passwords (usernames tend to be email addresses) and go to the email provider and try out the username and password. If you use the same password on your email account as you do throughout the web, then if those other sites get popped your email account is at risk. This can be mitigated by following what Serge wrote above about using a password manager.

Second - 'Hacking gmail in 30 minutes'. I doubt he has 0-days at his disposal to use on Google, though if he does Zerodium would pay him handsomely. More likely he did a lateral attack, like sniffing unencrypted traffic or phishing his friends. (Or, like the mob, taking a wrench to someone's knees for the un/pw). It's an unlikely comment.

Third - 'What email services?' - This is asking the wrong question. Google, for now, is a good company with a lot of talented security professionals working to keep things secure. Are they the best? I don't know how to judge 'best', but they are good. This is like asking what Toothpaste to use to keep your teeth clean? It's not about the toothpaste, it's about the brush and your hygiene. Likewise, it's not about gmail vs yahoo vs your ISP, it's about your personal security hygiene (as mentioned above)

Hope that helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.