Securing my Firebase account

Question

I use a firebase database to store users locations in it (by using GeoFire).

Except for this parameter, everything else in the database does not include any information.

My problem is that I cannot encrypt the coordinates since the GeoFire won't manage to query the data.

My question is more general than how to encrypt data.

Firebase is basically connected to my google account which means that if someone hacks my google account he has access to my database.

Yes, I use 2 auth steps for my google account however I'm wondering what are the steps that I need to do in order to maximize the security before I publish my app.

I changed all of the security rules in my database but it all worth nothing if someone just hacks my google account and changes everything.

So I'm asking how I can secure this firebase account that I will only be able to sign in to the database from my computer for example or to make sure that even if someone hacks my google account he won't be able to get into the firebase database.

Answer 1

Well ... besides using a security-token (e.g. YubiKey) as the 2nd factor:

Google does offer an advanced-Security Program for activists, journalists, etc which would fit perfectly with your needs. https://landing.google.com/advancedprotection/

But you do need to buy two hardware-security keys, because one is always needed when logging in at another location. And the other one if you ever happen to lose your first one. Maybe because without any pre-configured security-token you might not be able to change any settings etc.?

I would buy at least two. YubiCo does offer several options, where the cheapest is already everything you need for U2F. Set up both and place your 1st key on your (actual) keychain and your 2nd one in a safe at a 3rd-party (your grandma's house or your bank).