I have a Gmail account that I also access via an Android smartphone. The mail account could be used to reset passwords for other online accounts, so I want to tighten up the security around this account.

The two-factor authentication Google offers seems like a good idea for that, but I don't see how it could protect against someone gaining access to my phone. The phone still needs to use an application-specific password, which would allow an attacker to access my account.

What strategies exist to defend against such a scenario? The smartphone looks like an obvious weak link in this situation. How can one make it harder for someone to gain access to it to also access the Gmail account?

  • 1
    Use a Google Authenticator. Android has the capability to streamlessly interact with the Authenticator in this regard. You also need to make sure you enable a security pin on your phone. – Ramhound Aug 7 '12 at 11:51
  • 1
    @Ramhound That still leaves anyone who finds my phone with access to the application-specific password until I notice the missing phone and can disable it. – Mad Scientist Aug 7 '12 at 11:52
  • 1
    You cannot recover the password being used to access the Google Mail account just by having access to the phone. – Ramhound Aug 7 '12 at 16:51
  • @Ramhound I think the point is that if the phone were unlocked, the attacker could get access to the applications which are already authorized on that phone, and then use the fact that he has access to GMail to reset passwords on other sites. – msanford Sep 18 '12 at 14:56
  • Physical access to a mobile, as with any normal computer, will circumvent all security protecting non-encrypted data - given time and expertise. I don't even bother locking my phone; thieves would factory reset or bin a locked phone anyway. Best to treat it with the same anti-pickpocket attitude as a wallet. – LateralFractal Oct 13 '14 at 9:09

You could set screen locking (pattern or password) which will, IMHO, at least slow 'attacker' enough that you can notice missing phone and then remotely erase it, remove keys or whatsoever.

  • 1
    If you rely on the pattern security, make sure to erase the smudge: news.cnet.com/8301-30685_3-57377224-264/… – Simon Jun 4 '13 at 17:43
  • Also ensure USB debugging is off, especially if your phone is rooted. The lockscreen can be disabled through adb, and there are many other potential dangers. – Torvero Jun 4 '13 at 18:20
  • Unless you're on jellybean or higher, in which case adb won't work until the phone allows it (per computer). – Ray Britton Jun 5 '13 at 8:54

I don't have any specifics (I don't have an Android phone to hand), but according to this, for Android 4.0+, you can secure the phone so that it will securely wipe itself after n attempts at the PIN. Assuming you set a PIN, this should mitigate brute-force attempts to access the phone, and hence your email.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.