<story><title>Hacked Gmail Account</title><url>http://www.multitasked.net/2011/jun/27/hacked-gmail-google-account/</url><text></text></story><parent_chain><item><author>raldi</author><text>What I&apos;d like is one-factor for my typical &quot;log in and check mail, write back to a few people&quot; use case, and two-factor or a second password that kicks in when I (or a bad guy) tries to:&lt;p&gt;* Log in from a computer that&apos;s never used this account before&lt;p&gt;* Set up a forward&lt;p&gt;* Make a mass mailing&lt;p&gt;* Change the password&lt;p&gt;* Do extensive searching or searching for suspicious terms (&quot;password&quot;, &quot;credit card&quot;, etc)&lt;p&gt;* Export a large amount of mail&lt;p&gt;...and other such things. That way, I don&apos;t have to be inconvenienced by constantly having to use the second factor, but would still survive a stolen laptop, keylogged passord, or sniffed cookie with a contained amount of damage.</text></item></parent_chain><comment><author>trout</author><text>I&apos;ve been on it since the first day they would let me, and I couldn&apos;t be a larger fan. I know how vulnerable I would be if I lost control of my email account, and it&apos;s scary.  I don&apos;t trust the recovery options with google because they&apos;re useless if someone gets your password and changes it.&lt;p&gt;I lost my phone skiing, used an application to find it, and realized someone else had the phone already.  Without two factor authentication I would have had to change my gmail password, update it everywhere, and type the wrong password in for the next 2 weeks.  Revoking the application was simple and made me feel better about the situation.  This was huge for me.&lt;p&gt;I would recommend everyone who keeps a fancy phone with them nearly 24/7 to enable 2 factor authentication.&lt;p&gt;What it&apos;s like to use:
-Once every 30 days I have to put the code in.
-I keep a paper copy of the 10 backup codes on me.  I&apos;ve had to use 2 of these for when my phone was dead or lost and I was logging on to a new browser.  
-I&apos;ve also emailed these codes to an account that is totally unaffiliated and has no link to my google account.
-I have about 3 other applications I had to set up the application passwords for.  This was less painful than I expected.&lt;p&gt;The real risk is when you&apos;re in a worst case scenario - without your wallet, without your phone, and every online email you have is compromised.&lt;p&gt;Even if someone does manage to get through the 2 factor authentication, there&apos;s a pretty good chance they won&apos;t disable it or clear out the emergency codes.</text></comment>
<story><title>Hacked Gmail Account</title><url>http://www.multitasked.net/2011/jun/27/hacked-gmail-google-account/</url><text></text></story><parent_chain><item><author>raldi</author><text>What I&apos;d like is one-factor for my typical &quot;log in and check mail, write back to a few people&quot; use case, and two-factor or a second password that kicks in when I (or a bad guy) tries to:&lt;p&gt;* Log in from a computer that&apos;s never used this account before&lt;p&gt;* Set up a forward&lt;p&gt;* Make a mass mailing&lt;p&gt;* Change the password&lt;p&gt;* Do extensive searching or searching for suspicious terms (&quot;password&quot;, &quot;credit card&quot;, etc)&lt;p&gt;* Export a large amount of mail&lt;p&gt;...and other such things. That way, I don&apos;t have to be inconvenienced by constantly having to use the second factor, but would still survive a stolen laptop, keylogged passord, or sniffed cookie with a contained amount of damage.</text></item></parent_chain><comment><author>plasma</author><text>Agreed; I got half way through setting up Google&apos;s 2 factor but then was told I had to use it for every login, instead of say when I was logging in from a different IP or doing some big change.</text></comment>