Securing your Email is IMPORTANT!!


Recommended Posts

When it comes to securing your online accounts with a strong password and two-factor authentication, one of the most IMPORTANT online accounts to secure is your email.

 

When a password is forgotten on a website, the password reset link is usually sent to your email (or a code is sent to your phone if you have two-factor authentication turned on). If someone got a hold of your email password, they could go to sites around the internet, resetting your website passwords (by having reset links sent to your email account which they now have access to) giving them complete access.

 

In the case of Gmail (which is a google account), it may be used to sync your chrome browser. If someone gets access to it, they also get access to any saved passwords saved inside chrome for other websites.

 

Your email is 1 password you DO NOT want to reuse! When creating a password, NEVER use a word found in the dictionary all by itself. Pad it with something, add some punctuation. For instance, take the word microscope. That word used by itself is a HORRIBLE password, but padding it with more characters makes it dramatically more secure. Let’s put a date and some punctuation on the end of it. Now we have microscope1954*!# This is a MUCH stronger password.

 

Strong, secure password are hard to remember, I get that. So don’t feel bad about writing your passwords down, in fact I highly encourage it! I’m much less concerned about someone breaking into your house steeling your book of passwords, than I am about someone hacking your email account because you reused / used a weak password.

 

Online services such as Gmail, Outlook and Yahoo typically won’t let you use a horrible password without adding a capital letter and some numbers (but they will obviously let you reuse one). 

 

Most email providers also support two-factor authentication. When enabled, you must provide a second factor of authentication when logging into your online account after providing the correct password.

 

The two types of Two-factor for your email are typically

 

SMS : A SMS message (Text message) is texted to your phone with a one time use code - This is the least secure two-factor method, but it is still more secure with it than without it.

 

Authenticator: Once enable you scan a provided QR code into an authenticator phone/tablet app of your choosing (Example, Google Authenticator or the Microsoft Authenticator) with your camera and the app will then generate a 1 time code every 30 seconds. 

 

If you use the Authenticator method I recommend saving the QR code that you initially scan into the authenticator, so you can scan that same QR again into the same phone (should you have to reset it) or in to a new phone (should something happen to your current one).

 

Two-factor codes are typically required when the email site detects a new login from a browser or computer it has not seen before.

 

So just remember, if your email password is not unique, change it! If your email password contains a just a single dictionary word, change it! If your email provider supports two-factor authentication but it's not enabled, turn it on! Your email is the single greatest point of failure of your online identity.

Link to comment
https://www.neowin.net/forum/topic/1385127-securing-your-email-is-important/
Share on other sites

12 hours ago, Steven P. said:

Or use two-factor authentication, then you can have a weak ass password all you like, but you aren't getting in without the second step auth.

That isn't true at all. 2FA isn't the end all and isn't a guarantee you are safe. 

2 hours ago, Steven P. said:

Thread cleaned, please stay on topic.

It's ok Steve, I don't mind if my threads go off topic, Off topic is still comments, comments still bump me to the front page, front page gives me views :)

Hello,

 

A properly-engineered, properly-implemented and properly-used multi-factor authentication system can greatly increase the security of account logins by providing resistance against brute-forcing, password-reset attacks and so forth.  Of course, if the second factor is vulnerable to phone (SIM or account) resets, token theft, biometric spoofing, and so forth, then a large amount of additional security layer is mitigated.

 

Regards,

 

Aryeh Goretsky

On 7/24/2019 at 1:53 AM, Circaflex said:

That isn't true at all. 2FA isn't the end all and isn't a guarantee you are safe. 

Many security experts are saying that if you use 2fa you never have to change your password again. 

 

Right now, there is no known way to bypass 2fa or get the code/onetime auth key without having your device.  It is better to use a token that is registered to your device via an authenticator app vs a password.  If you know of a way to bypass/circumvent 2fa, I am sure all of us would like to know.

2 hours ago, sc302 said:

Right now, there is no known way to bypass 2fa

Depends what the 2fa method is.

SMS can for sure be circumvented - there are many know hacks to this. Pretty sure nist has or is dropping it as valid/recommended method even.

This is why the 3 points of @goretsky "A properly-engineered, properly-implemented and properly-used" are so critical - and can tell you for pretty much fact the weakest link in that chain is going to properly used point "user"... 

 

And there are multiple ways to get around other 2fa.. mitm sort of attacks, mitendpoint, compromised software, etc. etc..

here

https://www.rsaconference.com/writable/presentations/file_upload/idy-f02-12-ways-to-hack-2fa.pdf

So saying there is no known way is just not true..

 

3 minutes ago, BudMan said:

Depends what the 2fa method is.

SMS can for sure be circumvented - there are many know hacks to this. Pretty sure nist has or is dropping it as valid/recommended method even.

This is why the 3 points of @goretsky "A properly-engineered, properly-implemented and properly-used" are so critical - and can tell you for pretty much fact the weakest link in that chain is going to properly used point "user"... 

 

You are right a PAYG phone and a weak password written on a post it note stuck on the computer screen just isn't enough!

Also, malware on the device that would forward the 2FA. This would be more of a whaling type scenario though. Also, if you have a device that was compromised or you wrote your secret that is used to generate the 2FA token and it was stolen, by passing 2FA would be fairly easy. 

 

Always have the application/software alert you of any new logins. This would help incase it was compromised. 

On 7/23/2019 at 10:55 PM, warwagon said:

When it comes to securing your online accounts with a strong password and two-factor authentication, one of the most IMPORTANT online accounts to secure is your email.

Very true! I secure my personal and professional email accounts with crazy long passwords generated by LastPass, and behind TOTP 2FA. And my LastPass password is even longer, again behind 2FA. Finally, I change these 3 passwords and a few other critical ones once a month. :)

2 hours ago, BudMan said:

Depends what the 2fa method is.

SMS can for sure be circumvented - there are many know hacks to this. Pretty sure nist has or is dropping it as valid/recommended method even.

This is why the 3 points of @goretsky "A properly-engineered, properly-implemented and properly-used" are so critical - and can tell you for pretty much fact the weakest link in that chain is going to properly used point "user"... 

 

And there are multiple ways to get around other 2fa.. mitm sort of attacks, mitendpoint, compromised software, etc. etc..

here

https://www.rsaconference.com/writable/presentations/file_upload/idy-f02-12-ways-to-hack-2fa.pdf

So saying there is no known way is just not true..

 

sorry, going back several years to when rsa key was the standard.  I should know to stay up on knowBe4

2 hours ago, The Dark Knight said:

Very true! I secure my personal and professional email accounts with crazy long passwords generated by LastPass, and behind TOTP 2FA. And my LastPass password is even longer, again behind 2FA. Finally, I change these 3 passwords and a few other critical ones once a month. :)

Ya, I don't change mine once a month. That just sounds like a pain, give I have 8 gmail address :D

Change my important passwords usually every 6 months, which is coming due again,  I used to do it around Windows new releases, but I got a little behind this year,  but will get it done in a day or two, and make accounts more secure again.    Then I should be set,   might setup Microsoft Authenicator as well,  I do have Google setup with clicking yes or no on login if it's me from my Galaxy S10e.

 

Too much trouble trying to change every account password, but I know I should again, just know it's gonna take a while

 

11 hours ago, bikeman25 said:

Change my important passwords usually every 6 months

You guys need to keep up, and I have always said this - changing passwords for the sake of changing passwords is BS.. And the guy  that wrote the standard has come out and said as much.

 

NIST now clearly states

"“SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically).”"

 

Unless something has happened, someone left the company.  There has been some breach or something... Changing your password because its been 90 days has always just been utter ######.. And you know what it does do - it forces people to write ###### down ;)

9 minutes ago, BudMan said:

You guys need to keep up, and I have always said this - changing passwords for the sake of changing passwords is BS.. And the guy  that wrote the standard has come out and said as much.

 

NIST now clearly states

"“SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically).”"

 

Unless something has happened, someone left the company.  There has been some breach or something... Changing your password because its been 90 days has always just been utter ######.. And you know what it does do - it forces people to write ###### down ;)

When I first started working, I needed to remember three fairly complex passwords all of which needed to be changed every 90 days. And like you said, in the end I wrote my passwords down. 

2 hours ago, BudMan said:

You guys need to keep up, and I have always said this - changing passwords for the sake of changing passwords is BS.. And the guy  that wrote the standard has come out and said as much.

 

NIST now clearly states

"“SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically).”"

 

Unless something has happened, someone left the company.  There has been some breach or something... Changing your password because its been 90 days has always just been utter ######.. And you know what it does do - it forces people to write ###### down ;)

Forcing users to change their password every 90 days also forces them to rotate ###### passwords

2 minutes ago, Steven P. said:

## # ### isn't a great password :s 

Why does the 4 letter swear word that starts with S ends with T show up as ###### <------6 characters long ... now they don't know what swear word I was going for, so then I have to edit it so it has the correct amount of ####

2 minutes ago, warwagon said:

Why does the 4 letter swear word that starts with S ends with T show up as ###### <------6 characters long ... now they don't know what swear word I was going for, so then I have to edit it so it has the correct amount of ####

Because at the time moderators didn't want swear words to have the same amount of characters so that people could instantly fill in the word by themselves, it was requested to use a generic term, which is what I did. (and another fine example of how I don't decide everything on my own).

2 hours ago, BudMan said:

You guys need to keep up, and I have always said this - changing passwords for the sake of changing passwords is BS.. And the guy  that wrote the standard has come out and said as much.

 

NIST now clearly states

"“SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically).”"

 

Unless something has happened, someone left the company.  There has been some breach or something... Changing your password because its been 90 days has always just been utter ######.. And you know what it does do - it forces people to write ###### down ;)

Ya, I always thought changing passwords just for the sake of it or due to number of days was dumb as dirt. Can't even begin to remember last time I changed my passwords! Don't know a single person that's changed their passwords. Don't know of a single person that's ever had their e-mail hacked or anything either.

Still required to change passwords every 90 days for various work related sites/government sites.  Some of them have to be around 15 characters ... can't use x number of characters previously used (so you can't just go up a digit or whatever) ... 

 

Though the work related sites are slowly but surely transitioning away from username/password to CAC card/pin number.  Praise baby Jesus.

3 hours ago, BudMan said:

You guys need to keep up, and I have always said this - changing passwords for the sake of changing passwords is BS.. And the guy  that wrote the standard has come out and said as much.

 

NIST now clearly states

"“SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically).”"

 

Unless something has happened, someone left the company.  There has been some breach or something... Changing your password because its been 90 days has always just been utter ######.. And you know what it does do - it forces people to write ###### down ;)

100% 

 

I used to change my entire list every 90 days. What a fool I was. I was using LastPass at the time and have since migrated to BitWarden and have always used strong, tool generated passwords, often at the length limit of the site. I was changing these for no reason.  Today I continue to use strong passwords (as should everyone) and 2FA when available with a preference to time based values over SMS codes. Changing a 23 character password that I never knew to start with every 90 days was foolish and a monumental waste of time.  

 

I just wish my employer would stop making us change them every 90 days AND allowed us to use a password manager.

  • 4 weeks later...
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • I'm fine with a little reasonable promotion of Edge, but the degree which they do it right now I consider extremely unreasonable. 
    • Microsoft AI boss no longer believes that AI will replace human workers by David Uzondu Mustafa Suleyman, the head of Microsoft AI, recently took back his statements concerning white-collar jobs that he gave to the Financial Times in an interview made back in February, where he claimed that AI would replace office workers within 12 to 18 months. On Monday's episode of The Verge's Decoder, Suleyman recast the technology as more like a helpmate than a tool designed to take over your job. He explained that smaller office duties will "increasingly become digitized, automated" as people generate more digital materials. During the discussion, Suleyman emphasized a "very important distinction" between "tasks" and "jobs" to clarify his previous claims. He argued that his earlier comments only referred to individual actions that people perform at their desks. Suleyman used to work for DeepMind, the research lab he co-founded in 2010 alongside Demis Hassabis and Shane Legg, before he left in 2022 to establish Inflection AI and build an empathetic digital assistant. Microsoft hired him in March 2024 to lead its newly formed "Microsoft AI" division, placing him in charge of consumer products like Copilot, Bing, and Edge. His February comments also detailed plans for Microsoft to achieve self-sufficiency with a $140 billion infrastructure budget to train frontier models, predicting that creating a customized AI will soon feel like creating a podcast or a new blog: The 41-year-old is not the only AI executive who's softened his "AI will replace you" stance. OpenAI's CEO, Sam Altman, last month used X to push back against employment panic by arguing that his startup builds tools to assist humans rather than build replacements. He had previously garnered backlash by suggesting that many modern office roles that AI might replace did not qualify as "real work" in the first place, at least when you compare desk jobs to physical, historical labor like farming.
    • Adobe Acrobat Reader DC 2026.001.21662 by Razvan Serea Adobe Acrobat Reader DC software is the free, trusted standard for viewing, printing, signing, and annotating PDFs. Its the only PDF viewer that can open and interact with all types of PDF content – including forms and multimedia. It’s connected to Adobe Document Cloud – so you can work with PDFs on computers and mobile devices. Adobe Document Cloud is a revolutionary, modern and efficient way to get work done with documents in the office, at home or on-the-go. At the heart of Document Cloud is the all-new Adobe Acrobat DC, which will take e-signatures mainstream by delivering free e-signing with every individual subscription. Document Cloud includes a set of integrated services that use a consistent online profile and personal document hub. With Adobe Document Cloud, people will be able to create, review, approve, sign and track documents whether on a desktop or mobile device. Businesses will be able to take advantage of Document Cloud for enterprise which provides enterprise-class document services that integrate into systems of record such as CRM, HCM, CLM, and CMS, adding speed, efficiency and transparency to getting business done with documents. Adobe Acrobat Reader DC new feature highlights: Work with PDFs from anywhere with the new, free Acrobat DC mobile app for Android or iOS. Select functionality is also available on Windows Phone. Use the new Fill & Sign tool in your desktop software to complete PDF forms fast with smart autofill. Download the free Adobe Fill & Sign mobile app to add the same option to your iPad or Android tablet device. Save money on ink and toner when printing from your Windows PC. Store and access files in Adobe Document Cloud with 5GB of free storage. Get instant access to recent files across desktop, web, and mobile devices with Mobile Link. Sync your Fill & Sign autofill collection across desktop, web, and iPad devices. Adobe PDF Pack premium features includes: Convert documents and images to PDF files. Use your mobile device camera to take a picture of a paper document or form and convert it to PDF. Turn PDFs into editable Microsoft Word, Excel, PowerPoint, or RTF files. Combine multiple files into a single PDF (web only). Get signatures from others with a complete e-signature service. Send, track, and confirm delivery of documents electronically instead of using fax or overnight services (tracking not available on mobile). Store and access files online with 20GB of storage. Download: Adobe Acrobat Reader DC 64-bit | 719.0 MB (Freeware) Link: Adobe Acrobat Reader DC Home Page | Release Notes | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Meta will now use data from outside businesses to personalize AI responses by David Uzondu In an update that's rolling out globally (except in a handful of countries), Meta will use your data from outside businesses to personalize your AI responses and your primary feeds. Meta already utilizes your shopping activity to target ads, but the company now plans to expand this tracking to personalize other "parts of your experience" like feed algorithms and AI assistant chats. The company is replacing the two settings ("Your activity off Meta technologies" and "Activity from other businesses") that currently let you disconnect off-platform activity with a single, renamed setting called Activity from other businesses. If you don't want Meta to manipulate your feed and AI responses using your outside history, you can just turn the Activity from other businesses setting off in your account settings. This toggle resides within your Accounts Center, applying your choice to every connected profile. Turning this off will not stop companies from sending your data to Meta. The company will still collect your web interactions, but it only uses them to train products, while still accessing external accounts you connect. When The Verge spoke to Meta spokesperson Emil Vazquez, the representative said that this update will exclude several locations at launch, including the European region, the UK, Brazil, Thailand, South Africa, Turkey, South Korea, Ecuador, Nigeria, and Kenya. The new update comes at a time when the social media giant is recovering from a major PR disaster involving generative AI. Last week, there was a huge security issue on Instagram where attackers figured out a way to trick Meta AI into handing over account ownership (even if the victim had 2FA enabled). Some of the affected accounts include the dormant Obama White House profile, cosmetics brand Sephora, the Chief Master Sergeant of the Space Force, and security researcher Jane Manchun Wong. Internally, the company also had to scale back plans on its Model Capability Initiative (MCI), an employee-monitoring program designed to train corporate AI models by recording worker keystrokes and screen activity, after employees raised privacy concerns and complained about severe battery life drain.
    • JetBrains is working to cut false positives in RustRover 2026.2 by David Uzondu Recently, JetBrains released the fifth EAP build of its dedicated IDE, RustRover 2026.2, bringing improvements like a Run gutter icon for criterion_main! macro benchmarking and a feature that alerts you when there are unused traits in your current scope. Now, the company is out with a blog post addressing one of the "most common" complaints from users: false positives. In RustRover, a false positive occurs when the editor incorrectly highlights something as an error even though the project compiles and runs successfully. This mismatch flags a gap between the IDE's internal intelligence and the actual compiler. When the editor flashes red warnings over perfectly valid code, developers lose trust in the tool, which stalls momentum. Traditionally, RustRover runs cargo check to detect compiler errors and warnings, but it also relies on its own code analysis engine to power real-time features. To provide quick feedback, this engine parses your source code into a syntax tree while inferring types and resolving names as you type. Because this engine must work on broken, half-written code and react instantly, its logic sometimes diverges from the compiler's, producing false positives that do not exist in the compiler's eyes. JetBrains said that it has a "dedicated task force" focused specifically on identifying and fixing false positives by analyzing user reports and examining large-scale open-source projects. To speed up this process, the team built an internal system modeled after Crater, the famous Rust project that compiles and runs tests for every single crate published on crates.io. This automated pipeline compares the diagnostics from RustRover's analysis with actual compiler output to catch discrepancies before they reach users, ensuring smoother workflows. RustRover, for those who're unaware, is a dedicated IDE designed specifically for Rust developers. It's been around for a couple of years now, providing features like built-in debugging via LLDB, seamless cargo integration, advanced macro expansion, and HTML support. JetBrains distributes the app under two licensing models: a paid commercial subscription and a free option for non-commercial use.
  • Recent Achievements

    • One Year In
      Primer1st earned a badge
      One Year In
    • Experienced
      JayZJay went up a rank
      Experienced
    • Reacting Well
      Sir_Timbit earned a badge
      Reacting Well
    • Week One Done
      rubentuben8 earned a badge
      Week One Done
    • Week One Done
      ARaclen earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      512
    2. 2
      PsYcHoKiLLa
      229
    3. 3
      Edouard
      134
    4. 4
      ATLien_0
      87
    5. 5
      Steven P.
      80
  • Tell a friend

    Love Neowin? Tell a friend!