{"id":1092,"date":"2012-03-02T12:31:03","date_gmt":"2012-03-02T12:31:03","guid":{"rendered":"http:\/\/andyparkes.co.uk\/blog\/index.php\/2012\/03\/02\/protecting-your-gmail-account-with-two-factor-authentication\/"},"modified":"2012-03-02T12:58:50","modified_gmt":"2012-03-02T12:58:50","slug":"protecting-your-gmail-account-with-two-factor-authentication","status":"publish","type":"post","link":"https:\/\/andyparkes.co.uk\/blog\/index.php\/2012\/03\/02\/protecting-your-gmail-account-with-two-factor-authentication\/","title":{"rendered":"Protecting Your Gmail Account with Two Factor Authentication."},"content":{"rendered":"

It\u2019s not always obvious but your email account is one of the most important things you have on the Internet. (Jeff Attwood wrote a really good post about this back in 2008<\/a>!)<\/p>\n

Your email account is like the keys to the city because when you sign up for just about any service on the Internet they\u2019ll ask you for your email address. If you forget your login details guess where they\u2019ll send your password reminder?<\/p>\n

This means if someone can get access to your email account getting into anything else is pretty simple. Also consider that email accounts now give us gigabytes of storage so we rarely delete emails meaning it\u2019s not difficult to browse through old messages and figure out what accounts to target.<\/p>\n

\"Thanks<\/a><\/p>\n

So why <\/strong>is it a big deal? Your money<\/strong> and your identity<\/strong>!<\/p>\n

If you pay for stuff online it\u2019s highly likely you\u2019ll be using something like PayPal.<\/p>\n

Once this person has your email address resetting the passwords to those other services is a bit of a doddle and they are free to do whatever they want with your cash! Yes you may eventually realise what\u2019s going on and cancel the card but how long will that take and how much inconvenience will it cause?<\/p>\n

\"image\"<\/a>On top of all this your Gmail account password can also be used in lots of other places like Google Docs, YouTube, Google Reader.<\/p>\n

More and more websites are allowing you to sign in with credentials from other websites.<\/p>\n

So what to do?<\/p>\n

First make sure you\u2019ve got a good password..that goes without saying. If you want an additional layer of security you should think about activating two factor authentication for your Google account.<\/p>\n

What\u2019s two factor authentication?<\/em><\/p>\n

To login to a website at the moment all you have is something you know.<\/strong><\/p>\n

The problem with that is if someone else knows the same thing you can\u2019t do much about it.<\/p>\n

Two Factor Authentication means that as well as something you know <\/strong>you also rely on something you have<\/strong>.<\/p>\n

\"image\"<\/a>If you\u2019ve worked in a large enough company you\u2019ll have already seen this in action with something like a SecurID from RSA<\/a> (if you work in the SMB market AuthAnvil<\/a> is a good option)<\/p>\n

Google are calling this \u201cTwo Step Verification<\/strong>\u201d \u2013 presumably to make it sound a little less scary. \"Winking<\/p>\n

All well and good but Google aren\u2019t going to hand out tokens to everyone right?<\/p>\n

In a manner of speaking yes they do.<\/p>\n

There is one thing that just about everyone who uses a computer will have on their person at all times<\/p>\n

A mobile phone.<\/span><\/p>\n

Here\u2019s how it works.<\/p>\n

Each time you logon with your username and password Google can send a text message to a designated mobile phone. (They provide backup options too – they\u2019ll even call you and read the code to you!) \"image\"<\/a><\/p>\n

You can\u2019t login until you\u2019ve provided the code.<\/p>\n

You can then optionally choose to stay logged into that computer for 30 days.<\/p>\n

This means if anyone else guesses your password they still won\u2019t be able to login!<\/p>\n

\"image\"<\/a>There is also an app you can use as an alternative way to do this that effectively turns your phone into a SecurID token and doesn\u2019t even require an active internet connection. This is called Google Authenticator.<\/a><\/p>\n

It\u2019s worth mentioning that other services also have similar schemes<\/p>\n

Hotmail<\/strong> will send you single use code via text message if you\u2019re on a computer you wouldn\u2019t normally use. These codes expire after 15 minutes and you enter it instead of your password. It\u2019s not quite two factor authentication but would stop a keyboard logger from stealing your password. Details on that are here<\/a>.<\/p>\n

Facebook <\/strong>will send you a code via text message when you login to a computer it doesn\u2019t recognise (you can authorise your computers) they call this \u201cLogin Approvals<\/strong>\u201d. Details are here<\/a>. Only thing I\u2019ll say about this is that when I tried to set it up I gave up after 30 minutes as I didn\u2019t receive the first text message!<\/p>\n

I\u2019m talking specifically about Gmail here though as it was the first account I held that offered this extra security.<\/p>\n

Setting it up is pretty straightforward.<\/a><\/p>\n

1) Visit this link: https:\/\/www.google.com\/accounts\/SmsAuthConfig<\/a> and sign in.<\/p>\n

\"image\"<\/a>2) From the drop-down menu, select the country where your phone is registered, and enter your phone number in the box.<\/p>\n

3) Choose whether you\u2019d like to receive your codes by text or by voice call. You can always change this later.<\/p>\n

4) Enter your phone number, then click Send verification code to receive a code on your phone.<\/p>\n

5) Enter the code from the text or voice message into the box, then click Verify.<\/p>\n

6) Next you\u2019ll be asked whether you want to remember the computer you are using. If you check the box, you won\u2019t need to enter a code to sign on with this computer for the next 30 days. Don\u2019t check this box if you are using a public computer or a device that you don\u2019t regularly use to sign in.<\/p>\n

7) Click Turn on 2-step verification to finish the process!<\/p>\n

Done! At this stage if you wanted to use the Google Authenticator app you can set this up with these instructions.<\/a><\/p>\n

The only other thing left to consider are any applications that may be accessing your account where you can\u2019t use the verification process. You may be checking your email via Outlook or via an app on your phone for example. It\u2019s designed to ask for a user name and password and doesn\u2019t know anything about verification codes.<\/p>\n

To get around this you can generate an application specific password. This is a password that when Google receives it in combination with your user name won\u2019t ask for verification. Google will generate a password for you that you enter into the application. It doesn\u2019t get used anywhere else so you don\u2019t have to memorise it.<\/p>\n

These passwords can be revoked at any time if you\u2019re worried it may have been compromised or if you want to generate a new one. Google has good setup instructions for this here<\/a>. (otherwise this post would end up even longer than it is!)<\/p>\n

Hopefully all this makes sense and it\u2019ll at least make you think about how you secure your important accounts. It\u2019s good that companies are taking steps to help improve security which will only improve over time but ultimately you\u2019re responsible for your own data.<\/p>\n","protected":false},"excerpt":{"rendered":"

It\u2019s not always obvious but your email account is one of the most important things you have on the Internet. (Jeff Attwood wrote a really good post about this back in 2008!) Your email account is like the keys to the city because when you sign up for just about any service on the Internet<\/p>\n

<\/span>Read More<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[18,44],"tags":[],"class_list":["post-1092","post","type-post","status-publish","format-standard","hentry","category-google","category-security"],"yoast_head":"\nProtecting Your Gmail Account with Two Factor Authentication. - Andy's Techie Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/andyparkes.co.uk\/blog\/index.php\/2012\/03\/02\/protecting-your-gmail-account-with-two-factor-authentication\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Protecting Your Gmail Account with Two Factor Authentication. - Andy's Techie Blog\" \/>\n<meta property=\"og:description\" content=\"It\u2019s not always obvious but your email account is one of the most important things you have on the Internet. (Jeff Attwood wrote a really good post about this back in 2008!) Your email account is like the keys to the city because when you sign up for just about any service on the InternetRead More\" \/>\n<meta property=\"og:url\" content=\"https:\/\/andyparkes.co.uk\/blog\/index.php\/2012\/03\/02\/protecting-your-gmail-account-with-two-factor-authentication\/\" \/>\n<meta property=\"og:site_name\" content=\"Andy's Techie Blog\" \/>\n<meta property=\"article:published_time\" content=\"2012-03-02T12:31:03+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2012-03-02T12:58:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/andyparkes.co.uk\/blog\/wp-content\/uploads\/2012\/03\/image_thumb.png\" \/>\n<meta name=\"author\" content=\"Andy Parkes\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Andy Parkes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/andyparkes.co.uk\/blog\/index.php\/2012\/03\/02\/protecting-your-gmail-account-with-two-factor-authentication\/\",\"url\":\"https:\/\/andyparkes.co.uk\/blog\/index.php\/2012\/03\/02\/protecting-your-gmail-account-with-two-factor-authentication\/\",\"name\":\"Protecting Your Gmail Account with Two Factor Authentication. - Andy's Techie Blog\",\"isPartOf\":{\"@id\":\"https:\/\/andyparkes.co.uk\/blog\/#website\"},\"datePublished\":\"2012-03-02T12:31:03+00:00\",\"dateModified\":\"2012-03-02T12:58:50+00:00\",\"author\":{\"@id\":\"https:\/\/andyparkes.co.uk\/blog\/#\/schema\/person\/3534e8ac6b1bec765cd061feff56679d\"},\"breadcrumb\":{\"@id\":\"https:\/\/andyparkes.co.uk\/blog\/index.php\/2012\/03\/02\/protecting-your-gmail-account-with-two-factor-authentication\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/andyparkes.co.uk\/blog\/index.php\/2012\/03\/02\/protecting-your-gmail-account-with-two-factor-authentication\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/andyparkes.co.uk\/blog\/index.php\/2012\/03\/02\/protecting-your-gmail-account-with-two-factor-authentication\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/andyparkes.co.uk\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Protecting Your Gmail Account with Two Factor Authentication.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/andyparkes.co.uk\/blog\/#website\",\"url\":\"https:\/\/andyparkes.co.uk\/blog\/\",\"name\":\"Andy's Techie Blog\",\"description\":\"Professional Geek\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/andyparkes.co.uk\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/andyparkes.co.uk\/blog\/#\/schema\/person\/3534e8ac6b1bec765cd061feff56679d\",\"name\":\"Andy Parkes\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/andyparkes.co.uk\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3824cbf53df51d7ca5cf809b6ad81a157fbfff2292e36ab8666f04ddad06bfcc?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3824cbf53df51d7ca5cf809b6ad81a157fbfff2292e36ab8666f04ddad06bfcc?s=96&d=mm&r=g\",\"caption\":\"Andy Parkes\"},\"description\":\"Andy Parkes is Technical Director at Coventry based IT support company IBIT Solutions. Formerly, coordinator of AMITPRO and Microsoft Partner Area Lead for 2012-2013. He also isn't a fan of describing himself in the third person.\",\"sameAs\":[\"http:\/\/www.andyparkes.co.uk\/blog\"],\"url\":\"https:\/\/andyparkes.co.uk\/blog\/index.php\/author\/andyparkes\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Protecting Your Gmail Account with Two Factor Authentication. - Andy's Techie Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/andyparkes.co.uk\/blog\/index.php\/2012\/03\/02\/protecting-your-gmail-account-with-two-factor-authentication\/","og_locale":"en_US","og_type":"article","og_title":"Protecting Your Gmail Account with Two Factor Authentication. - Andy's Techie Blog","og_description":"It\u2019s not always obvious but your email account is one of the most important things you have on the Internet. (Jeff Attwood wrote a really good post about this back in 2008!) Your email account is like the keys to the city because when you sign up for just about any service on the InternetRead More","og_url":"https:\/\/andyparkes.co.uk\/blog\/index.php\/2012\/03\/02\/protecting-your-gmail-account-with-two-factor-authentication\/","og_site_name":"Andy's Techie Blog","article_published_time":"2012-03-02T12:31:03+00:00","article_modified_time":"2012-03-02T12:58:50+00:00","og_image":[{"url":"https:\/\/andyparkes.co.uk\/blog\/wp-content\/uploads\/2012\/03\/image_thumb.png"}],"author":"Andy Parkes","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Andy Parkes","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/andyparkes.co.uk\/blog\/index.php\/2012\/03\/02\/protecting-your-gmail-account-with-two-factor-authentication\/","url":"https:\/\/andyparkes.co.uk\/blog\/index.php\/2012\/03\/02\/protecting-your-gmail-account-with-two-factor-authentication\/","name":"Protecting Your Gmail Account with Two Factor Authentication. - Andy's Techie Blog","isPartOf":{"@id":"https:\/\/andyparkes.co.uk\/blog\/#website"},"datePublished":"2012-03-02T12:31:03+00:00","dateModified":"2012-03-02T12:58:50+00:00","author":{"@id":"https:\/\/andyparkes.co.uk\/blog\/#\/schema\/person\/3534e8ac6b1bec765cd061feff56679d"},"breadcrumb":{"@id":"https:\/\/andyparkes.co.uk\/blog\/index.php\/2012\/03\/02\/protecting-your-gmail-account-with-two-factor-authentication\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/andyparkes.co.uk\/blog\/index.php\/2012\/03\/02\/protecting-your-gmail-account-with-two-factor-authentication\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/andyparkes.co.uk\/blog\/index.php\/2012\/03\/02\/protecting-your-gmail-account-with-two-factor-authentication\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/andyparkes.co.uk\/blog\/"},{"@type":"ListItem","position":2,"name":"Protecting Your Gmail Account with Two Factor Authentication."}]},{"@type":"WebSite","@id":"https:\/\/andyparkes.co.uk\/blog\/#website","url":"https:\/\/andyparkes.co.uk\/blog\/","name":"Andy's Techie Blog","description":"Professional Geek","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/andyparkes.co.uk\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/andyparkes.co.uk\/blog\/#\/schema\/person\/3534e8ac6b1bec765cd061feff56679d","name":"Andy Parkes","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/andyparkes.co.uk\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3824cbf53df51d7ca5cf809b6ad81a157fbfff2292e36ab8666f04ddad06bfcc?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3824cbf53df51d7ca5cf809b6ad81a157fbfff2292e36ab8666f04ddad06bfcc?s=96&d=mm&r=g","caption":"Andy Parkes"},"description":"Andy Parkes is Technical Director at Coventry based IT support company IBIT Solutions. Formerly, coordinator of AMITPRO and Microsoft Partner Area Lead for 2012-2013. He also isn't a fan of describing himself in the third person.","sameAs":["http:\/\/www.andyparkes.co.uk\/blog"],"url":"https:\/\/andyparkes.co.uk\/blog\/index.php\/author\/andyparkes\/"}]}},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pmvJ6-hC","jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/andyparkes.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/posts\/1092","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/andyparkes.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/andyparkes.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/andyparkes.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/andyparkes.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/comments?post=1092"}],"version-history":[{"count":2,"href":"https:\/\/andyparkes.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/posts\/1092\/revisions"}],"predecessor-version":[{"id":1093,"href":"https:\/\/andyparkes.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/posts\/1092\/revisions\/1093"}],"wp:attachment":[{"href":"https:\/\/andyparkes.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/media?parent=1092"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/andyparkes.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/categories?post=1092"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/andyparkes.co.uk\/blog\/index.php\/wp-json\/wp\/v2\/tags?post=1092"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}