Using 2-Step Verification with GMail

In the recount of what happened yesterday regarding my hacked Paypal account, I realized that it was my GMail that was originally compromised and used to reset my Paypal password.

After realizing that, I went and changed my Google Account password and used their 2-Step Verification process.

To those who have been asking in the comments what is and how to activate the Google 2-Step Verification feature, this video should give you the details:

I really don’t know how my GMail was compromised but it could be one of several possible ways:

I’ve lost an iPhone 3G, Nexus One and iPhone 4 in the last 12 months and it’s possible its been sold to the grey market with my GMail account still logged in.
Public terminal. I remember going to a net cafe last week to have my ID and Passport scanned and emailed. I remember shutting down the browser but could not remember if I explicitly logged out.
WiFi Sniffing. This is rare but still possible — my account could have been sniffed over free public WiFi. I even bring my SmartBro Share-It around and leave it without any password so others can use it too (I like to share my net connection). I’m now locking my WiFi.
At least 3 of my staff also have access to my GMail account so that’s a huge security hole there as well. I trust them but it’s possible they’re not very careful when they need to access my account online.

In any case, this has been a lesson for me and hopefully a reminder to everyone reading this as well. Go try the 2-step verification process so you have some peace of mind.

Abe Olandres

Abe is the founder and Editor-in-Chief of YugaTech with over 20 years of experience in the technology industry. He is one of the pioneers of blogging in the country and considered by many as the Father of Tech Blogging in the Philippines. He is also a technology consultant, a tech columnist with several national publications, resource speaker and mentor/advisor to several start-up companies.

https://www.yugatech.com

31 Comments

Paul says:

14 years ago

As they say, charge this unfortunate event to experience. Stay positive, Abe. We learn better things out of our daily encounters.
- Reply
Jay says:

14 years ago

Sir yuga, baka may kinalaman yan dito http://www.pcmag.com/article2/0,2817,2386287,00.asp
- Reply
James says:

14 years ago

Wow Yuga for a Tech journalist you are pretty careless with your hardware and your online credentials

Not to troll but you should have implemented security precautions before all of these things happened to you.
- Reply

Benchmark says:

14 years ago

Nobody is perfect you know. Even the experts forget some basic things. And like what Si Abe said, “Tao lang po.”
imho says:

14 years ago

I kinda agree with james. how can a recognized tech blogger be careless like that? I guess the word that comes to mind is “overrated.”

just my 2 cents.
daniel says:

14 years ago

abe is a tech-blogger and he’s careless. then i tell you, SONY is an $88 billion dollar company… bakit sila na-hack? wala namang perpekto eh. exams ko lng ^^
William T says:

14 years ago

Yes. Tao lang naman, but four high-end devices in a year seems much, most people will become paranoid just by losing one of those high-end device. I did, when I lose my e60 a few years back, since then my phone is strapped to my belt wherever I go, there was a time when I even put plastic leash on it. :) Still, us humans, are forgetful creatures, and the information overload of the internet age sometimes leave us less focused than optimal…
nameless says:

14 years ago

I guess, ok lang naman yun. madami naman natatanggap na freebies si sir. ;)
gregg says:

14 years ago

@james sheesh Its like saying when you are a F1 racer champ you won’t get into accident ?
James says:

14 years ago

Haha I’m sorry but that’s really poor analogy

But to play along, I’m careful with my data and with my hardware. I make sure my phone has the capability to be remotely wiped when its lost, and also 2 step verification is on the moment it was available to Google Apps users.I also make sure SSH is on when I go online on public wifi hotspots

So in a way, I haven’t been in an “accident” when I’m driving my “F1” car. And if the event I will meet such an “accident”, I have technology to at least save my ass when it does happen, just like the real F1 cars when they encounter a crash.

The point I’m trying to drive here is that, for a blog owner and also a coupon discount site owner (or part owner?). Yuga should have been more pro-active when securing his data. He should have known better.

Abe Olandres says:

14 years ago

@james – tao lang po! nagkakamali din.
- Reply

silverlokk says:

14 years ago

Some other gaffes by people far more prominent than Abe:

The legendary Ken Olsen of Digital Equipment Corp, who saw no future in personal computers
None other than Bill Gates, who initailly dismissed the Internet
I think there is a world market for maybe five computers. — Thomas Watson, IBM Chairman, 1943
<Hey, we don’t need you. You haven’t got through college yet.> — HP to Steve Jobs on the latter’s request for funding development of what became the Apple

And the list goes on.

William T says:

14 years ago

Once you got the mess sorted out, it might be helpful to your readers to write a ‘how-to’ guide on steps to be done after losing a computer or smartphone. In this connected age, many people neglect these security matters, specially when they are busy getting a replacement SIM, restoring their data on their new phones.

Stuff like changing your password to all website, email linked to your smartphone, and doing this at home on a virus-free PC.

And just a suggestion, beef up the security of not only your phones but your w2ebsites, especially now that Yugatech has a companion ecommerce site in Yugadeals.

Here’s hoping Paypal will sort out everything in your favor…

Now I gotta activate that two-step verification on my gmail account… :)
- Reply
Messie says:

14 years ago

Sana meron din ganito for yahoo mail. *sigh*
- Reply

silverlokk says:

14 years ago

+1

I believe it’s most important though for Internet banking sites.

sherwin says:

14 years ago

Sirs add ko din puwede din niyo tignan sa may baba ng gmail yun last account activity. dito makikita nyo kung saan ni-access yun gmail nyo and kung anong access type browser or mobile.
- Reply
say says:

14 years ago

as soon as I read yesterday’s post, I also switched to Gmail’s 2-step verification method. Yaan ng matrabaho, at least it’s a lot safer. :)
- Reply
Lawrence says:

14 years ago

Yuga,

Is it possible that 3rd-party applications in the Android Market can get hold of your GMail username and password if you sync your Calendar and Contacts on your Android device?
- Reply
csseyah says:

14 years ago

I should do this 2-step verification also.. Thanks po sa info na ito….
- Reply