16

I am about to leave for a trip. During this trip, I would have to connect to my Gmail account, and I'm totally unhappy to type my password using public, unsecured machines, potentially having keyloggers and similar nice stuff.

I already use 2-step verification and I'll change my password as soon as I come back, but I'm still unhappy with the idea of using the same password, given that my mobile can be lost or stolen during the trip.

Is there something similar to one-time password system in Gmail?

Improve this question

3 Answers 3

Reset to default
14

You can generate one time codes that can be used as part of two-step verification that doesn't require your phone. You can print out a bunch before you go and stick them in your wallet or luggage to use as needed.

Other than that, there are a number of guides with suggestions for trying to stay secure. Make sure you are using HTTPS (default now) and if you are super paranoid about keyloggers you could try bashing a bunch of random text into notepad then cut pasting the letters for your password into the form.

Happy travelling!

Improve this answer
1
  • This google feature still requires that you enter your actual password, and still allows 2-step login via SMS to a cell phone, so it doesn't address the original question - if they keylog your password and steal your phone and can receive SMS on it, you're still hosed. It does allow you to use 2-Step Verification without a working cellphone, via one-time passwords, though.
    – nealmcb
    Commented Mar 17, 2014 at 15:46
3

I spent much time looking for the same answer, which brought me to this forum.

I am using 2-Step authentication but do not want to use my private password on public computers nevertheless. Google supplies application specific passwords which unfortunately do not seem to work with desktop browsers (Google still asks for your original password).

What you could do if you are travelling is to change your password before travel. Use the new password with the authentication software and re-set the password once you come back.

I found no other solution other than that for the time being.

This might be a good reference: Passwords and codes used with 2-step verification

Improve this answer
1
  • 1
    I don't think Google lets you use the same password over again, does it?
    – user541686
    Commented Dec 20, 2015 at 11:46
3

You are wise to try to protect your password, but modern malware can attack you in many other ways (monitoring the network traffic, real-time session hijacking, etc.), so you really just shouldn't expect anything you do on a public machine to be secure. See the answers at the IT Security Stackexchange for more information:

One good strategy noted there is to use an additional low security account in unsafe locations. E.g. if all you want is to be able to read an occasional email, e.g. to print an airline boarding pass from a computer at your hotel, you could set up a separate email account and forward copies of emails to it from your main account.

Back to your specific question: in 2012, Google was experimenting with a way to log in to a desktop computer, using your smart phone, scanning a QR code displayed on the desktop: Open Sesame: Google’s Newest Security Log-In Uses QR Codes | WebProNews. Sounds like a good option for some situations, but they cancelled the service before going public with it.

The Google option to use OTP for the 2nd authentication step, in the answer by John C, is handy if you can't get SMS messages while travelling, but you still expose your main password to keyloggers. His idea of mixing it up via notepad may help, but won't protect against a determined attacker.

I still wish there was a way to avoid having to enter your main password on a public kiosk.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.