A neat bit of security from Google

[andrewducker]

Let's say you're using a PC you've never used before, and you want to use GMail, but you're not sure you want to enter your password on it, because it might have a keylogger.

Simple - well, if you have an Android phone - go to https://accounts.google.com/sesame and it shows a QR code (one of those 2D barcodes). Scan that from the phone and it asks you (on the phone) if you want to allow access. If you say yes then the PC is automatically logged in to GMail.

Works on non-Android phones too, apparently - but they don't have your account info stored on them, so you have to log in on the phone to tell it who you are.

Comments

[matgb]

So if my phone gets stolen anyone can access my Gmail? I'm guessing more to it than that.

[andrewducker]

If you're phone gets stolen then anyone can read your gmail anyway, because your gmail account is linked to your phone.

Unless you change your password, which would solve both problems.

[strangemeetings.livejournal.com]

What a good idea!

[octopoid-horror.livejournal.com]

That's sort of neat, but if I want to use Gmail, but the computer might have a keylogger, since those security features seem to rely on having a smartphone, why not just use my phone to check gmail?

It's cool that QR codes are being used a bit more nowadays though.

[skington.livejournal.com]

That's certainly the first use I've ever heard of a QR code that made anything remotely like sense.

[andrewducker]

Depends what emails are being sent. I could still happily send/receive emails that weren't completely full of secret info without worrying about it.

And I prefer keyboards to typing on my phone, rather a lot. This just gives a bit of extra security when using n internet cafe.

[skreidle.livejournal.com]

For my Gmail account, I have an authenticator app on my Android phone for my Gmail account; at least* once a month (on my phone's Gmail app and on the website), I'll be asked to enter an encryption-based six-digit code to access my account, and if I know it to be a private system, I can lock it open for 30 days.

* I think I can insist it ask me every time.

Oh, and I had to scan a QR code to set up the app the first time.

Also, if I lose the phone or the authenticator app, I've also set up a text-message-based backup, as well as a slip of paper in my wallet with a set of backup strings. :)

[skreidle.livejournal.com]

I disagree -- a QR code can contain a relatively huge amount of data vs a simple barcode, meaning a scan can instantly give you an entire website, or a business card, without having to write anything down.

[andrewducker]

I have exactly the same setup, and very handy it is too!

[skreidle.livejournal.com]

Just that extra bit of protection/security. :)

[fearmeforiampink]

There's also things like largescale sending or receiving, sending or receiving lots of attachments, or receiving, editing and sending attachments; stuff where the desktop is much easier than a phone for doing 'em.

[jack-ryder.livejournal.com]

Just re-posted that on my lj. Worked on my iPhone too (and will come in handy when we travel this year.)

Thanks for that Andrew.

[andrewducker]

Glad you'll find it useful!