I have seen lots of horror stories of people who have lost control of their Google account, especially Gmail.
How can I prevent the same thing from happening to me? What steps can I take to protect my account before I lose control of it?
0
Add a comment
|
1 Answer
Google offers quite a few tools to help you keep unwanted persons out of your account, but some of them only work if you activate and use them.
Keep your Account Recovery Options up to date
Mobile telephone number: If you forget your password, or if there is unusual activity on your account, Google can send you a security code via SMS for you to prove you are who you say you are. If someone has your account password it's quite unlikely they've also got your mobile phone. Google will only use your number for security purposes. Important: Keep this up to date! This won't be of much use if Google sends security codes to a phone number you no longer use.
Recovery email address: Similar to the mobile phone number, this is a different email address where Google will send security codes and other important security messages, like when you've forgotten your username and/or your password. If you don't have a second email address, you can always use the email address of someone you trust (like a spouse).
Alternative email address: This is different from the recovery email address in that this is a second address that you can use to sign in to your Google account. It also cannot be a Gmail account or an address that's associated with a different Google account.
Use two-step verification
This may be the single best way to protect your account. When you log in from an untrusted device, you'll be prompted not only for your password but also for a six-digit code sent to you that's unique for your device. Even if someone has your password, if they don't have access to your secondary device where your code is sent, then they can't complete the login.
In case of emergency (if you've lost your phone or its battery dies), you can also generate a list of ten one-use codes that you can print out and keep in a safe place to use when accessing Gmail from a previously untrusted device. Note: "two-step verification" is not necessarily the same as "two-factor authentication", which can be even tougher to crack.
Use a strong, unique password
There are lots of places to get advice on how to create a strong password online, so I won't belabor it again here. Just as important, however, is to never use the password for your Google account anywhere else. Every month it seems there's news of a site that has had user credentials stolen. While you may not care about the data that was on that site, since so many people re-use passwords that's where the value lies for the bad guys.
Think about it: If you forget the password to your bank account, where does the reset password link get sent? Your email address. The password for your email should be the strongest of all.
Set Gmail to always use HTTPS (SSL)
Unless there is a technical reason not to, you should have Gmail set to always use a secure connection (HTTPS). This setting is found under Settings > General > Browser connection.
When using a shared/public computer...
Use "private" or "incognito" mode in the browser: These modes (available in most modern browsers) prevent the storage of web history, form data, or cookies. If you can't use this mode, be sure to clear history and cookies after you log out.
Log out from your account when you're done: This should go without saying, but people forget.
Don't fall for phishing attempts
No site should be asking you for your Google Account password except Google. Don't enter your password on any page you reach after following a link, even from someone you trust. Go straight to https://www.gmail.com or https://accounts.google.com/ServiceLogin instead.
Keep your system secure and up-to-date
Keep up with OS and browser updates. Make sure you use a trustworthy malware/virus scanner and keep it up to date as well.
Watch for connected apps that do more than they should
Google and Gmail have very robust APIs which allow for a variety of apps to add a lot more functionality to Google's apps. However, they also have a lot of access, and it's possible that a rogue app, or one that is insecure, could be leaking your information. You should regularly check your security settings for apps, sites, and devices to make sure that only the apps and such you still use are listed there. Apps you no longer use (or which don't come from a trusted source) you should remove from your account.
Further information:
- Gmail security checklist
- What if I forget my password (video)
- Know your Google security and privacy tools
- Keeping your account secure
- An update on our war against account hijackers
- Gmail product forums: "how to protect my account from password theft?" answer from bkc56 (A little dated but still a lot of good information)
