11

I have a Gmail account that I also access via an Android smartphone. The mail account could be used to reset passwords for other online accounts, so I want to tighten up the security around this account.

The two-factor authentication Google offers seems like a good idea for that, but I don't see how it could protect against someone gaining access to my phone. The phone still needs to use an application-specific password, which would allow an attacker to access my account.

What strategies exist to defend against such a scenario? The smartphone looks like an obvious weak link in this situation. How can one make it harder for someone to gain access to it to also access the Gmail account?

Improve this question
5
  • 1
    Use a Google Authenticator. Android has the capability to streamlessly interact with the Authenticator in this regard. You also need to make sure you enable a security pin on your phone.
    – Ramhound
    Aug 7, 2012 at 11:51
  • 1
    @Ramhound That still leaves anyone who finds my phone with access to the application-specific password until I notice the missing phone and can disable it.
    – Mad Scientist
    Aug 7, 2012 at 11:52
  • 1
    You cannot recover the password being used to access the Google Mail account just by having access to the phone.
    – Ramhound
    Aug 7, 2012 at 16:51
  • @Ramhound I think the point is that if the phone were unlocked, the attacker could get access to the applications which are already authorized on that phone, and then use the fact that he has access to GMail to reset passwords on other sites.
    – msanford
    Sep 18, 2012 at 14:56
  • Physical access to a mobile, as with any normal computer, will circumvent all security protecting non-encrypted data - given time and expertise. I don't even bother locking my phone; thieves would factory reset or bin a locked phone anyway. Best to treat it with the same anti-pickpocket attitude as a wallet.
    – LateralFractal
    Oct 13, 2014 at 9:09

2 Answers 2

Reset to default
2

You could set screen locking (pattern or password) which will, IMHO, at least slow 'attacker' enough that you can notice missing phone and then remotely erase it, remove keys or whatsoever.

Improve this answer
3
  • 1
    If you rely on the pattern security, make sure to erase the smudge: news.cnet.com/8301-30685_3-57377224-264/…
    – Simon
    Jun 4, 2013 at 17:43
  • Also ensure USB debugging is off, especially if your phone is rooted. The lockscreen can be disabled through adb, and there are many other potential dangers.
    – Torvero
    Jun 4, 2013 at 18:20
  • Unless you're on jellybean or higher, in which case adb won't work until the phone allows it (per computer).
    – Ray Britton
    Jun 5, 2013 at 8:54
1

I don't have any specifics (I don't have an Android phone to hand), but according to this, for Android 4.0+, you can secure the phone so that it will securely wipe itself after n attempts at the PIN. Assuming you set a PIN, this should mitigate brute-force attempts to access the phone, and hence your email.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .