Anything that makes a task more difficult, makes it more secure. The question always is, is the extra effort "worth it".
The Yubikey seems to be a hard token. I've used them. They are a pain.
Orginally, at this point, I wrote a bunch about attack vectors and on and on. But the bottom line is that I'm not willing to go through 2FA to access my Gmail account remotely, so I don't use it. It's not "worth it." They've gone too far. I don't like a lot of the things my Google account gets used for.
And, I don't want to turn my phone into a security device of any kind and no, I won't install an app on my phone to access your service. I don't have a choice with Gmail. That is making it hard to deal with some institutions. So I caved and set up a second phone.
But I'm also questioning whether I rely on, or am exposed to, the internet too much..
An issue is that the banks, whatever, seem to have a poor understanding of what the threat is. Golden1 once, not that long ago, sent me a legitimate email that looked exactly like a phishing scam. I sent them an email referencing their initial correspondence and that, no , I wouldn't respond that way. And at least for awhile, they included instruction on how to reply after logging in.
The social attacks are still working. I've never spoken to anyone who knows of a reasonable userid/password being brute forced. Guessing that the password is "password" counts as a socail attack in my book.
So we pile on armor in places where the attack never succeeds and leave ourselves bare where it does.
-Gary
On Mon, Mar 20, 2023 at 12:16:19AM -0700, Brian E. Lavender wrote:
Gary,
There is not doubt in my mind that 2FA is the way forward. I think you need a different token than your cell phone, such as the Yubi key. Here is an article on Yubikey and Google.
"In 2009 Google was the target of sophisticated cyber attacks capable of circumventing traditional security controls. With a lack of viable two-factor authentication (2FA) options to effectively prevent these attacks and account takeovers, Google began working closely with Yubico to extend the capabilities of the YubiKey two factor authentication technology to also include public key cryptography."
https://www.yubico.com/resources/reference-customers/google/
You can generate an application password for Google.
https://myaccount.google.com/apppasswords
Some other settings
Gmail SMTP server address: smtp.gmail.com Gmail SMTP name: Your full name Gmail SMTP username: Your full Gmail address (e.g. you@gmail.com) Gmail SMTP password: The password that you use to log in to Gmail Gmail SMTP port (TLS): 587 Gmail SMTP port (SSL): 465
Requires SSL: Yes Requires TLS: Yes Requires authentication / Use authentication: Yes Requires secure connection / Use secure connection: Yes
Brian
On Sun, Mar 19, 2023 at 10:00:02AM -0700, Gary wrote:
Thanks for the idea that there is a way around gmail two-factor authentication. I only use Gmail for things like boarding passes now because I couldn't log in with mutt.
IMHO the whole two-factor identification thing has gotten way out of conttrol. Especially if you mostly use a desktop system. I now have an old phone and a $9/month cellphone plan just to accomodate it. That phone never goes anywhere except my office.
-Gary
On Sun, Mar 19, 2023 at 09:18:26AM -0700, Chris Miller wrote:
Hi Folks,
I want to use gmail to send myself backup logs, since my mail server is not available during backup. I continue to get a credential error, but the credentials I am using are correct. I suspect that this is the result of "two-factor" authentication, which I am not using on gmail, but which has caused the "allow less secure access" to be disabled. I could use my ISP and configure an "Upstream SMTP-Smart Host", but then I have a detail to remember and reconfigure should I ever change my ISP.
Is anybody doing this successfully, without submitting to "Google Workspaces" or "Microsoft Office 365"?
Thanks for the help,
Chris.
V:916.799.9461 F:916.974.0428 A: Because we read from top to bottom, left to right. Q: > Why should I start my reply below the quoted text?
Lug-nuts mailing list -- lug-nuts@bigbrie.com To unsubscribe send an email to lug-nuts-leave@bigbrie.com
Lug-nuts mailing list -- lug-nuts@bigbrie.com To unsubscribe send an email to lug-nuts-leave@bigbrie.com
-- Brian Lavender http://www.brie.com/brian/
"There are two ways of constructing a software design. One way is to make it so simple that there are obviously no deficiencies. And the other way is to make it so complicated that there are no obvious deficiencies."
Professor C. A. R. Hoare The 1980 Turing award lecture _______________________________________________ Lug-nuts mailing list -- lug-nuts@bigbrie.com To unsubscribe send an email to lug-nuts-leave@bigbrie.com