Using 2-Step Verification with GMail

In the recount of what happened yesterday regarding my hacked Paypal account, I realized that it was my GMail that was originally compromised and used to reset my Paypal password.

After realizing that, I went and changed my Google Account password and used their 2-Step Verification process.

To those who have been asking in the comments what is and how to activate the Google 2-Step Verification feature, this video should give you the details:

I really don’t know how my GMail was compromised but it could be one of several possible ways:

I’ve lost an iPhone 3G, Nexus One and iPhone 4 in the last 12 months and it’s possible its been sold to the grey market with my GMail account still logged in.
Public terminal. I remember going to a net cafe last week to have my ID and Passport scanned and emailed. I remember shutting down the browser but could not remember if I explicitly logged out.
WiFi Sniffing. This is rare but still possible — my account could have been sniffed over free public WiFi. I even bring my SmartBro Share-It around and leave it without any password so others can use it too (I like to share my net connection). I’m now locking my WiFi.
At least 3 of my staff also have access to my GMail account so that’s a huge security hole there as well. I trust them but it’s possible they’re not very careful when they need to access my account online.

In any case, this has been a lesson for me and hopefully a reminder to everyone reading this as well. Go try the 2-step verification process so you have some peace of mind.

Abe Olandres

Abe is the founder and Editor-in-Chief of YugaTech with over 20 years of experience in the technology industry. He is one of the pioneers of blogging in the country and considered by many as the Father of Tech Blogging in the Philippines. He is also a technology consultant, a tech columnist with several national publications, resource speaker and mentor/advisor to several start-up companies.

https://www.yugatech.com

31 Comments

Paul says:

14 years ago

As they say, charge this unfortunate event to experience. Stay positive, Abe. We learn better things out of our daily encounters.
- Reply
Jay says:

14 years ago

Sir yuga, baka may kinalaman yan dito http://www.pcmag.com/article2/0,2817,2386287,00.asp
- Reply
James says:

14 years ago

Wow Yuga for a Tech journalist you are pretty careless with your hardware and your online credentials

Not to troll but you should have implemented security precautions before all of these things happened to you.
- Reply
Abe Olandres says:

14 years ago

@james – tao lang po! nagkakamali din.
- Reply
William T says:

14 years ago

Once you got the mess sorted out, it might be helpful to your readers to write a ‘how-to’ guide on steps to be done after losing a computer or smartphone. In this connected age, many people neglect these security matters, specially when they are busy getting a replacement SIM, restoring their data on their new phones.

Stuff like changing your password to all website, email linked to your smartphone, and doing this at home on a virus-free PC.

And just a suggestion, beef up the security of not only your phones but your w2ebsites, especially now that Yugatech has a companion ecommerce site in Yugadeals.

Here’s hoping Paypal will sort out everything in your favor…

Now I gotta activate that two-step verification on my gmail account… :)
- Reply
Messie says:

14 years ago

Sana meron din ganito for yahoo mail. *sigh*
- Reply
sherwin says:

14 years ago

Sirs add ko din puwede din niyo tignan sa may baba ng gmail yun last account activity. dito makikita nyo kung saan ni-access yun gmail nyo and kung anong access type browser or mobile.
- Reply
say says:

14 years ago

as soon as I read yesterday’s post, I also switched to Gmail’s 2-step verification method. Yaan ng matrabaho, at least it’s a lot safer. :)
- Reply
Lawrence says:

14 years ago

Yuga,

Is it possible that 3rd-party applications in the Android Market can get hold of your GMail username and password if you sync your Calendar and Contacts on your Android device?
- Reply
csseyah says:

14 years ago

I should do this 2-step verification also.. Thanks po sa info na ito….
- Reply
1001 says:

14 years ago

mas simple yung explanantion dito kesa sa lifehacker.
- Reply
Andre says:

14 years ago

Facebook just released a security feature where new computers have to type in a code sent to your cellphone to use your facebook. I couldnt get it to send to my Smart phone though.
- Reply
silverlokk says:

14 years ago

Looks foolproof, but wait! Far as I remember, Google gives you a set of numbers you can use when you don’t have your phone. Obviously, you wouldn’t keep those on any of your devices. I believe Google asks you to print it out, then delete the file.
- Reply
Apache says:

14 years ago

Tips for my own Personal Experience

1. 24hrs History Only – i never let my Laptop or Desktop or Tablet hold history cause they can use it go get hacked or took information.

2. CCleaner – Easy access if you use 3 or 5 difference browser and its easy to use just Analyze and Run Cleaner. just before using CCleaner close all application.

3. Password – Always give your self 5mins to change your password in every 3 months and keep in mind with a great pattern for example ” pAsS0rD3 ” Put Small and Big letters and Numbers but if you can really memorize and type a 5secs add a Special Character for example ” p@sS0rD3 ” imagine if you can do it in 5secs even he can’t imagine that.
- Reply
thed0t says:

14 years ago

The alternative to using SMS notifications to get the code is through the official Google Authenticator app for Android, iOS, and BB. However, if you don’t have any of those (like me hehe), there is a j2me app (for Symbian users — Nokia, Sony Ericsson, Samsung, etc). Look for “lwuitgauthj2me” and install it. Not bad!
- Reply
JC John Sese Cuneta says:

14 years ago

It’s a hassleâ€¦ a littleâ€¦ but you get used to it after a few months of using the 2-Step Verification. Quite useful and gives you more room to breath especially when logging-in outside of your trusted terminals.
- Reply
ernie says:

13 years ago

Abe problema ko di ako makalogin kasi wala na ako nung backup code then I still have my two phones with me peropag nagrequest ako ng other method of verification since nasa akin pa yung two phone, I’m getting this error msg: An unexpected error occured while sending your passcode. Please use a code generated by your mobile application or try again later. I’ve already try this https://www.google.com/support/accounts/bin/request.py?contact_type=two_step_recovery_no_phone&source=no_ts kaso parang wala kasi di ko maprovide yung ibang info. Patay na ako.
- Reply
Jay Castillo says:

13 years ago

I implemented this after I read your post and after almost a month, I can definitely say this works. I’m now quite used to the verification code sms. Thanks Abe!
- Reply
Maria says:

13 years ago

Got a related entry: http://www.freemindsfreelines.com/2012/02/why-and-how-to-setup-two-step.html
- Reply