So it finally happened. After years of having accounts all over the place, one finally got hacked. None of my devices could fetch mail, so I logged into the web client to see what was going on (sometimes Google goes down). It gave me some screen that said there had been suspicious activity on my account, and that I’d need to verify my identity using a code sent to my phone. Entire process took about 5 seconds, and access was restored under my existing password. There were about 20 emails in the inbox, all returned undeliverable, with some link to a spam site in the message body (thanks Google for catching that). All of the addresses were kind of old (probably emailed them years ago) but I’m sure a couple were still active.
I’m not sure who or how, other than someone must have known my password. It’s odd because, while I use the same password for a few things, I have about 8 that I rotate around. The one I use for GMail though is one of my better ones, and one I typically reserve for higher security sites. I only enter it on my own devices (laptop, phone, etc), so I’m thinking someone must have sniffed a packet or hacked into one of those sites.
In any case, I spent the better part of the day assigning unique 20+ character passwords to each site I frequent. Finally bought 1Password (both Mac and iPhone / iPad version) and put it to good use. I’ll post up a quick review and share how well the program works. In the mean time, it isn’t a bad idea to remember to change your password often, and to something better than just the minimum requirements. XKCD rases a good point in one comic (#936 – Password Strength), that picking a string of 3 or 4 easily remembered words as a password, is as secure, if not more, than picking a string of just randomly assigned characters.