3

Background

I have a "main" Gmail account, which I set to keep logged in, on my laptop. This "main" Gmail account is important, because it's the email address I used to sign up for many other services (and, so, if I forget my password on these other services, I get the password reset link sent to this Gmail account).

I have a phone. I do not keep myself logged into my main Gmail account on my phone. I rarely log into my main Gmail account on my phone; but whenever I do, I only stay logged on for a few minutes, and then I log back out.

I have a secondary Gmail account, which I list as a recovery email address for my "main" Gmail account. My secondary Gmail account's password is written in a safe physical place (not in my wallet or backpack). I rarely log into this secondary account. (This secondary email has my phone number as a recovery phone number, but as I explain below, I'm thinking that this might be unsafe?).

Is it better to not use a recovery phone number?

My main concern is to keep my "main" Gmail account secure, even if I lose my laptop and my phone at the same time. (I tend to keep both in my backpack, instead of keeping my phone in my pocket).

Is it a bad idea add to my phone number as a recovery phone number to my "main" Gmail account?

That is, I'm thinking it would be a bad idea, because if I lost my backpack, then anyone who found my backpack could gain permanent access to my Gmail account in a way that I could not prevent:

  • even if I act quickly and use a different device (ie, one that I didn't lose) to force my main account to log off of the stolen laptop, the person who found my backpack would still see that my main Gmail account is used on this laptop (ie because when they open up google, they see google accounts "added" to the Chrome browser as account options for logging in). Then, they could use my phone to "recover" my main Gmail account.

  • and then, even if I use my secondary Gmail account as a recovery option for my main Gmail account, I'm thinking that the attacker owning my phone to "recover" my main Gmail account would trump me using my secondary Gmail account to recover my main Gmail account.

However, I'm thinking that it's harder for an attacker if I have no recovery phone number on my main Gmail account. Then, in order to get access to my main account, the attacker would first need to get access to my secondary account using my phone.

And finally, I'm thinking that if I have no recovery phone number on either account, then my main account is safe from an attacker, even if they have both my phone and my laptop.

Question

What is the best plan for me to protect my main Gmail account, even if I lose both my laptop and my phone?

  • Is the best plan to not have a recovery phone number on either my main or secondary Gmail account? (ie, is it true that if I choose this option, then an attacker could not get permanent access to my main Gmail account, even if they owned my lost laptop and lost phone?) What are the drawbacks of this plan? What other plans might I consider?

1 Answer 1

-1

Laptop

If you use proper password on your laptop, then guessing it can take millions of years. The more realistic scenario would be to shut your laptop down, extract disk, read it in some other system. If your file system is not encrypted, then the attacker may read cookies and try to restore your session. If your laptop was stolen by some occasional people, not by some prepared attacker, it may take several days, until somebody get access to the data on your disk. You will have a lot of time to reset password.

Phone

If it is not some special agency, the chances to unlock your phone for occasional people are very low. You will have a lot of time to reset password.

When phone is needed?

Now suppose somebody has noticed the password you have typed, e.g. by recording you on smartphone during login. If they want to use your password, Google will see that IP or device has changed and will request confirmation and can send a request to your smartphone. You will just tell Google it was not you and the attacker will not be allowed to log in, or if logged it, will be logged out. Where as without phone the attacker would get normal access to your account.

TLDR

Your assumptions about compromising your account via stolen laptop ad phone are not quite correct. The problems without having any phone attached to the account can be more serious than in case of having it attached. That's why I would suggest to attach a phone to the account.

8
  • I'd like to point out that phones are extremely insecure. Android(but iOS too) forces you to use your password/pin to access your phone once in a while, and 99% of people use a very short PIN. It's extremely easy to shouldersurf the PIN if you happen to access your phone in public (plus everyone have cameras so filming you is not that hard). In other words someone that targets you can easily get your PIN, then steal the backpack with both. It is then possible to reset the Google account password knowing only the PIN that unlocks the phone, and with that it is a total account compromise
    – Bakuriu
    Commented Aug 9, 2023 at 19:02
  • And this is not just theoretical. If you search only there are multiple stories of people forgetting the phone in a starbucks and having their google/Apple accounts fully compromised in a matter of minutes.
    – Bakuriu
    Commented Aug 9, 2023 at 19:03
  • This is not true. PIN unlocks the smartphone, not the account. Even if the attacker sees the PIN, it does not help, because the attacker doesn't have access to the smartphone.
    – mentallurg
    Commented Aug 9, 2023 at 20:30
  • You CAN reset your google account password if you know the PIN of the phone and have access to the phone. On your smartphone go to the settings > google account > security > password when asked for a password click under "forgot password" Then select "Confirm using block screen" or similar and that let's you use the PIN to reset the account password
    – Bakuriu
    Commented Aug 10, 2023 at 15:52
  • So if I shouldersurf someone entering a PIN (which is easy) and steal their phone in a matter of few minutes you can take over the google account completely. As I said: this is not theoretical. It is happening now. E.g. youtube.com/watch?v=QUYODQB_2wQ
    – Bakuriu
    Commented Aug 10, 2023 at 15:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .