Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

I am about to leave for a trip. During this trip, I would have to connect to my Gmail account, and I'm totally unhappy to type my password using public, unsecured machines, potentially having keyloggers and similar nice stuff.

I already use 2-step verification and I'll change my password as soon as I come back, but I'm still unhappy with the idea of using the same password, given that my mobile can be lost or stolen during the trip.

Is there something similar to one-time password system in Gmail?

share|improve this question
add comment

3 Answers 3

up vote 12 down vote accepted

You can generate one time codes that can be used as part of two-step verification that doesn't require your phone. You can print out a bunch before you go and stick them in your wallet or luggage to use as needed.

Other than that, there are a number of guides with suggestions for trying to stay secure. Make sure you are using HTTPS (default now) and if you are super paranoid about keyloggers you could try bashing a bunch of random text into notepad then cut pasting the letters for your password into the form.

Happy travelling!

share|improve this answer
    
This google feature still requires that you enter your actual password, and still allows 2-step login via SMS to a cell phone, so it doesn't address the original question - if they keylog your password and steal your phone and can receive SMS on it, you're still hosed. It does allow you to use 2-Step Verification without a working cellphone, via one-time passwords, though. –  nealmcb Mar 17 at 15:46
add comment

I spent much time looking for the same answer, which brought me to this forum.

I am using 2-Step authentication but do not want to use my private password on public computers nevertheless. Google supplies application specific passwords which unfortunately do not seem to work with desktop browsers (Google still asks for your original password).

What you could do if you are travelling is to change your password before travel. Use the new password with the authentication software and re-set the password once you come back.

I found no other solution other than that for the time being.

This might be a good reference: Passwords and codes used with 2-step verification

share|improve this answer
add comment

You are wise to try to protect your password, but modern malware can attack you in many other ways (monitoring the network traffic, real-time session hijacking, etc.), so you really just shouldn't expect anything you do on a public machine to be secure. See the answers at the IT Security Stackexchange for more information:

One good strategy noted there is to use really low security accounts for high-threat activities. E.g. if all you want is to be able to read an occasional email, e.g. to print an airline boarding pass from a computer at your hotel, you could set up a separate email account only used for such things, and forward the emails you want to print using your smart phone.

Back to your specific question: in 2012, Google was experimenting with a way to log in to a desktop computer, using your smart phone, scanning a QR code displayed on the desktop: Open Sesame: Google’s Newest Security Log-In Uses QR Codes | WebProNews. Sounds like a good option for some situations, but they cancelled the service before going public with it.

The Google option to use OTP for the 2nd authentication step, in the answer by John C, is handy if you can't get SMS messages while travelling, but you still expose your main password to keyloggers. His idea of mixing it up via notepad may help, but won't protect against a determined attacker.

I still wish there was a way to avoid having to enter your main password on a public kiosk.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.