• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Gmail Password Leak

Some more info on the leak:
• Google provides more details on potential Gmail account leak
• Google Online Security Blog: Cleaning up after password dumps

From Google:
We found that less than 2% of the username and password combinations might have worked, and our automated anti-hijacking systems would have blocked many of those login attempts. We’ve protected the affected accounts and have required those users to reset their passwords.
Click to expand...

So if you haven't been forced to reset your Gmail password, you're probably okay. Still, now's a great time to hop on the 2-factor authentication bandwagon ;)
 
Still, now's a great time to hop on the 2-factor authentication bandwagon ;)
Click to expand...
Apologies if this justifies another thread. I hopped on that bandwagon yesterday. Is one roped into using the official GMail app if you use 2-factor auth?

The stock Samsung email app did not want to sign in correctly when I changed to 2-factor.

PS...I might also say...make sure you get codes for all the devices you use BEFORE you lose your phone and have to use Android Device Manager to find it. I almost learned that the hard way.
 
mwrobe1 said:
Apologies if this justifies another thread. I hopped on that bandwagon yesterday. Is one roped into using the official GMail app if you use 2-factor auth?

The stock Samsung email app did not want to sign in correctly when I changed to 2-factor.

PS...I might also say...make sure you get codes for all the devices you use BEFORE you lose your phone and have to use Android Device Manager to find it. I almost learned that the hard way.
Click to expand...

Welcome to the cool kids club :D

Apps that don't support 2FA can still be used - you just need to generate an application-specific password for it: https://security.google.com/settings/security/apppasswords?pli=1

By the way, I recently stumbled across Authy, which is an improved version of the Google Authenticator app. It's a bit easier to set up AND it has an optional cloud sync option so you don't have to generate a new 2FA key if you move to a different device (or factory reset yours).

:thumbup:
 
Thanks for that. It was too easy. Didn't know that all that was baked-into Google since early 2011. Who knew? I guess its time to get the word out.
 
So I've been thinking of setting 2 step verification up for a while and this has finally pushed me to do so. I'm having a few difficulties though... Set up on the laptop fine but, when I then have to enter the details on my phone, it doesn't seem to want to play... keeps looping back to put your password in, followed by "you need to log in from your browser, please input your code" or something. What am I doing wrong?!?!?
 
D-U-R-X said:
So I've been thinking of setting 2 step verification up for a while and this has finally pushed me to do so. I'm having a few difficulties though... Set up on the laptop fine but, when I then have to enter the details on my phone, it doesn't seem to want to play... keeps looping back to put your password in, followed by "you need to log in from your browser, please input your code" or something. What am I doing wrong?!?!?
Click to expand...

You'll need to copy the code out of the Authenticator app and paste it into the browser when you get prompted.

Timing can be tricky - each code is only good for 30 seconds, so you have to be pretty quick.
 
I've been getting the code via a phone call. Entering it immediately and have been getting the same issue each time! :confused:
 
:confused: that is odd.

I'd try removing and readding the account on the phone entirely rather than just updating the credentials. See if that works a bit better.
 
Actually, I'm gonna have to do that at the weekend... can't be bothered with setting everything up again once I re-link... got friends round!
 
You could also try creating an application-specific password and using that on your phone instead of the two-factor. That's how I used to do it back in the day.
 
electricpete said:
Is that 3rd party app safe? Seems like it might need some access to the security features of your Google account
Click to expand...

Authy never gets access to your Google account (because you never give it your Google password - two-factor FTW!). You only give it the secret needed to generated the time-based codes. That said, you do have to trust that Authy will be proactive in safe-guarding those secrets - that will likely be a personal decision on your part. They do seem to take security seriously - and their app has been updated quite a bit more recently than the official Google Authenticator app. :dontknow:

Your call, but I'm pretty comfortable with Authy (and have been for several months).
 
You must log in or register to reply here.
Back
Top Bottom