Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

Is there anyway I can access a Google Reader account without entering my main password that could be used to steal access to my other service accounts, like Gmail?

I like to spend my free time reading blogs through Google Reader, but I only have access to public computers that might have keyloggers installed.

share|improve this question

migrated from superuser.com Jun 15 '11 at 17:45

This question came from our site for computer enthusiasts and power users.

3 Answers 3

Using 2-step authentication

You can't log in to Google services without your password. What you can do however is activate 2-step verification:

2-step verification requires two independent factors for authentication, much like you might see on your banking website: your password, plus a code obtained using your phone.

It's an extra step, but it's one that significantly improves the security of your Google Account because it requires the powerful combination of both something you know—your username and password—and something that only you should have—your phone. A hacker would need access to both of these factors to gain access to your account.

If someone might get hold of your password, they'd have no means of accessing your Google Account other than with your phone as well.

Here's Google's own Help page for 2-step verification including a video.

Using passwords that you can revoke

With the 2-step verification there comes a problem: Some applications still rely on the "user/password" scheme and need one single password to login.

You can generate application-specific passwords under My Account. Those are passwords you can enter instead of your normal Google password. They will work as expected, but don't require you to use the 2-step auth.

In your scenario, you could create an application-specific password for a public computer, enter it there, and as soon as you're home, revoke it. That way – even if there were a keylogger – the obtained password would become useless after revoking.


Using KeePass

Another solution would be to carry a USB stick with a KeePass database. This database would have your Google credentials, but it would be secured by some other password.

In the public place, just

  • plug in the USB stick
  • open KeePass portable
  • open the database file
  • and then enter your KeePass password (possibly with another additional lock file that is needed to open the database. This file could be hidden as a .doc file or anything.)

Even if there were Keyloggers, they wouldn't know where that KeePass password belongs. Then you can copy and paste the Google credentials to the Google Login page.

This is only safe assuming

  • The clipboard isn't sniffed
  • The USB stick contents are not copied to the computer without you knowing

Also, as @grawity mentions below,

KeePass has an "Auto-type" function for entering passwords automatically, which can be triggered by hotkey and is secure against keyloggers

You can find out more about Auto-Type on the KeePass website.

share|improve this answer
    
FWIW, the 2-step verification does include an "alternate passwords" feature. However, those passwords again work for any service, and are hard to remember. –  grawity Jun 15 '11 at 12:57
1  
Correct. Those are meant for logins from applications that don't feature 2-step auth yet. However using them defeats the purpose because these "alternate" passwords work permanently when entered iirc. –  slhck Jun 15 '11 at 13:00
    
@slhck: They are useful in a way – I can store an alternate password in my mail client's config, and revoke when necessary, without ever exposing the primary password. –  grawity Jun 15 '11 at 13:05
2  
I think it's worth it to switch to the 2-step verification, especially if you have a smartphone. I've got the Google Authenticator running on my iPhone, and when I use a public computer (or the 30 day check box expires), Google asks for my code. I pull out my phone and it generates a code for me to type in. It seemed like it was going to be a pain at first, but it really wasn't, and I can be sure no one is going to be able to get into my account. –  Jared Harley Jun 15 '11 at 18:17
1  
Another addition: KeePass has an "Auto-type" function for entering passwords automatically, which can be triggered by hotkey and is secure against keyloggers. –  grawity Jun 20 '11 at 15:45

If you don't want to set up the 2-step verification for your Google Account (see slhck's answer), you could always create a new Google account just for your Google Reader, and not use any of the other Google-provided services with your "reader account".

You can go to the Google Reader settings, and under the Import/Export tab, export your feeds from your main account and then import the generated OPML file into your reader-only account.

share|improve this answer

Another option is to export your feeds to another feed reader. See google help here. This wouldn't solve the problem of needing to log in, but it would be with a different username/password. Also, I am pretty sure there is no way to use this method and have it makr items as read on your original reader account.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.