Re:My GMail password scares me with its power
by pyre on Wednesday October 07, 2009 @06:24PM
(#867804)
I don't think that you understand what you're saying. Let's look at a few examples:
Scenario #1
===========
- I have 3 online accounts: gmail, hacker news, okcupid
- I use the same password for all accounts
- someone hacks okcupid
- they now have the password to my gmail account
- they also have my email which is attached to the okcupid account
- hacker uses okcupid password to access my gmail account.
- hacker users access to gmail account to reset password for hacker news
Scenario #2
===========
- I have 3 online accounts: gmail, hacker news, okcupid
- I use the same password for both hacker news and okcupid,
but I use a different password for gmail.
- hacker breaks into okcupid
- hacker now has my email address and my password for
okcupid/hackernews
- hacker attempts to access my gmail account, but cannot
because the password is different
- hacker attempts tot access my hacker news account, and
gains access since it's the same password as my okcupid
account
Scenario #3
===========
- I have 3 online accounts: gmail, hacker news, okcupid
- I use separate passwords for each account
- hacker breaks into okcupid
- hacker now has my email and password for okcupid
- hacker accumpts to access my gmail and hacker news
accounts, but cannot.
You're saying that because it's possible for someone to gain access to your gmail account, you use the same password everywhere, but this is the wrong conclusion to draw here.
Scenario #3 where each account has a different password is the best, but Scenario #2 is still better than Scenario #1. Just because a compromise on your Gmail account is a 'Game Over' scenario just means that you have to apply extra security measures to your Gmail account. Your Gmail password should definitely never be used as a password anywhere else and should be the strongest password that you use (other than maybe an online banking password).
tl;dr version:
You email account password should be your strongest password, even if you use the same password everywhere else. The odds of someone hacking your email account are low, the odds of someone hacking a no-name website and using your account information to get your email password are high.
Scenario #3 where each account has a different password is the best, but Scenario #2 is still better than Scenario #1. Just because a compromise on your Gmail account is a 'Game Over' scenario just means that you have to apply extra security measures to your Gmail account. Your Gmail password should definitely never be used as a password anywhere else and should be the strongest password that you use (other than maybe an online banking password).
tl;dr version:
You email account password should be your strongest password, even if you use the same password everywhere else. The odds of someone hacking your email account are low, the odds of someone hacking a no-name website and using your account information to get your email password are high.