0

I'm a very insecure person, so I made my gmail account's password so long, that I started to question whether or not it's possible for someone to hack it with any given method (It's a passphrase with random numbers and special characters).

Is there still a possible way my account could get hacked? I just want to stay safe (My last account got hacked because it only had a 5 character password). If there is still a way for someone to hack into my gmail account, how do I block that way?

closed as too broad by forest, ThoriumBR, Matthew, Steffen Ullrich, Rory Alsop Sep 15 '18 at 18:41

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Security is always to be considered as a global system and not piece by piece. You can have an arbitrarily long and secure password on your Gmail account but it may be attached to a secondary email for recovery that has itself a poor password. So in the end someone could still get your account even if you believe it has an "uncrackable" password. – Patrick Mevzek Sep 13 '18 at 14:29
  • My secondary email it's attached to is as hella long as my main gmail account, and they're connected to each other. Does that mean I'm safe? – Enqrypted - Deviniled Sep 13 '18 at 19:55
  • If both email address are at the same level of security you are safe for this particular attack of using the secondary email, but you can never say that you are safe against all possible attacks. – Patrick Mevzek Sep 14 '18 at 14:34
  • This page gives some recommandations: support.google.com/accounts/answer/46526?hl=en Google also provides "advanced" protections for sensitive accounts, see landing.google.com/advancedprotection Separately from that Google also entered the market of U2F solutions with hardware keys like Yubico did, with cloud.google.com/security-key – Patrick Mevzek Sep 14 '18 at 14:38
5

Threats:

  • Keylogger (as @MikeScott mentioned) on your PC or mobile device, or that of any other PC or mobile device that you use to access this account
  • Malicious browser extension
  • Malicious mobile app (if you sign into the account through a third-party app, or if your phone is rooted or compromised by a malicious app)
  • Phishing attack (you enter the credentials on what you think is Google's login page, but it isn't)
  • Reusing the password on a malicious site
  • Reusing the password on a site that gets compromised
  • Google gets compromised
  • Malicious app that you approve to have access to your Google account
  • App with access to your Google account gets compromised the attacker uses it to access its users' Google accounts
  • Password stored or transmitted insecurely (written down, sent over an insecure communication channel, etc.)
  • Attacker gains access to accounts needed to recover a "forgotten" password (for example, this might be your phone number, which can be hijacked)
  • Attacker impersonates you (pretending to have forgotten the password) and successfully tricks Google support
  • Password guessed by somebody who figures out how you generated it (unless you actually used a secure random number generator, this is more likely than you might think; humans are terrible at making random phrases or numbers)

Mitigations:

  • MULTI-FACTOR AUTHENTICATION (as @MikeScott mentioned), ideally using a really secure method such as a Yubikey in U2F mode (other methods are still vulnerable to phishing attacks), and ideally not just using SMS (too easy to hijack)
  • Keep your machines (PCs and mobile devices) up to date, both the OS and the apps
  • Don't sign into your account on other peoples' computers or devices
  • Don't ever re-use the password on another site
  • Don't store the password in plain text anywhere (a high-quality password safe app, such as LastPass or 1Password, is fine as long as you have a very good password, and ideally MFA, on the password safe)
  • Before you enter your password anywhere, make sure you expect to need to enter your password there (for example, if you should still be signed in but are being asked for your password, that's a sign you may be seeing a phishing page instead!)
  • Before giving access to any third-party apps (even ones that say they're from Google; sometimes people use sneaky ways to make it look like Google wrote the app when actually they didn't), make sure that the app is from a trusted source and actually needs to access your Google account for some reason (simply verifying your identity / email address is usually safe, actually accessing your email is a danger sign)
  • Don't use any insecure accounts as password recovery methods for your Google account
  • Run a reputable anti-virus (do not ever rely on AV software - they can be bypassed by knowledgeable attackers - but better to have it than not)
  • Be very cautious what browser extensions you use, especially ones that have permission to access "all web sites" (or Google sites in particular, of course)
  • Never share your password with anybody (even if you trust them personally, their computer might be less secure than yours)
  • Practice safe Internet usage in general (don't open unexpected attachments, don't run scripts or programs from shady or pirate sites, don't enable Flash or Java in the browser, etc.)
  • I always check for the green lock that says a page is secure at the top of the browser before logging onto my email account, so I think I'm safe with phishing. – Enqrypted - Deviniled Sep 13 '18 at 19:58
  • 1
    The lock icon merely means you're on a securely encrypted connection. It does NOT mean you're on the connection you think you're on. GOOGLE.COM and G00GLE.COM are both valid domain names, and hypothetically an attacker could register the latter domain, get a TLS certificate for it, and then put up a sign-in form that looks exactly like Google's. Your browser would show the green lock. – CBHacking Sep 14 '18 at 8:25
  • Never thought about that... Alright, I'll keep a lookout. – Enqrypted - Deviniled Sep 14 '18 at 21:18
1

You can still be hacked if someone manages to install a key-logger (either software or hardware) on your computer and capture your password as you type it. You should enable two-factor authentication on your Gmail account to mitigate this.

  • 2FA protects against far more threats than just keyloggers – schroeder Sep 13 '18 at 9:45
1

If you want greater security enable two factor authentication wherever you can. 2FA not only relies on password but on a time changing key that can only be generated with a private key created at the moment of 2FA activation.

If someone manages to get your password he/she still needs to find the private key to generate the 2FA access key.

IMHO Google has great security for email accounts since it identifies if you're accessing from new/different devices or detects something unusual and creates mail warnings to the email addresses you choosed for recovery, that way if someone access' your account you will be notified on another account, making undetected access to your accounts more complicated. Plus having thouse accounts on your phone you will be notified instantly and will be able to act accordingly.

  • "find the private key" or get ahold of the device generating the 2FA code - I'd add that in – schroeder Sep 13 '18 at 9:04
  • @schroeder I tried to be generic here with "find the private key". Getting ahold of the device won't give the key away if the device's card/drive is encrypted and has finger print access so the key still needs to be found, that was the reason for me to be generic since someone concerned about security may have taken extra measures to keep the private key as safe as possible. – YoMismo Sep 13 '18 at 10:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.