Apps More Secure Than Gmail ?

Hi,

As long as I've been flapping my gums recently asking questions, I thought I'd go ahead and ask another one or two. Pardon my long-windedness, but I thought since these questions are related, I'd ask them together.

1. Would it be correct to say that a Google Apps user is (perhaps) less likely than a Gmail user to find his/her account hacked because the domain used is something other than @gmail ? (I'm thinking that if hackers target users at the 'big 3' providers, they are trying to access accounts that have login credentials at those providers' domains, and that, therefore, someone with their own domain wouldn't necessarily be on the hacker's radar. Hackers would be looking for joe@gmail not joe@joesdomain hosted at GA.)

Or, to ask it from a different direction, is there any reason to believe that a domain hosted at FastMail, PolarisMail, Tuffmail, Runbox, etc. is any less likely to be hacked than someone hosting his/her domain at GA ? IOW, does the technology behind the service make Yahoo, Gmail, & Hotmail more 'hackable,' or does the domain popularity make it so ?

2. Re: Google Apps specifically: Let's say someone has a domain hosted with GA and only has 1 user account. So, the sole user is also the administrator. There would be two ways to set this up in an effort to maintain security and minimize or avoid hacking:

(a) Have two separate accounts -- one for administration which is never used for actual email correspondence, and one user account that is active for email activity. Or,

(b) Have one account (the admin account) with a very difficult, passcode-quality username, which would only be used for login purposes, and then use nicknames (also called 'aliases' -- available only in GA, not in Gmail) for actual email correspondence.

​

In both cases the username of the admin account is (presumably) unknown, because it is never used except for logins.

The first option has the advantage that anyone hacking the user account would not have access to the admin account, and the admin can (easily ?) regain control over the user account if hacked. (But what's to stop someone from somehow hacking the admin account directly ?)

OTOH, the second option has the advantage that the email address(es) used for emailing are only nicknames and not actual accounts, so, unlike the first option, there is no user account to be hacked into, even though the address may be known.

So I'm interested in any opinion on these matters.

My apologies again for a long-ish post.

Thanks !

 

Hi,

Thanks for the informative reply !

Careful ! You may be opening a can of worms here !

And since you said that, may I start by responding to your comments below ?

Thanks for the information !

Then if platform security is a strong link in the chain of account safety, would it be fair to say that smaller services, ones that focus on email, would tend generally to have better security than the big 3 which have not only email to maintain, but also search, news, forums, shopping, weather, maps, etc. (a case of good (Google) and better (Fastmail, EuMX, Hushmail, etc.) ? IOW, how do we know which company has the best platform security (esp. if the big 3 are hacked so often).

Re: phishing: FWIW, I do recall reading some articles on email security, privacy, etc. and I would find in the comments section people sometimes complaining of having their (Yahoo, Gmail or Hotmail) accounts hacked. The web is loaded with these complaints ! Occasionally, the person commenting would be someone with lots of computer knowledge, who had a strong password, who was not duped by phishing attacks, etc.

It's that kind of situation -- a situation in which the account was as close to invulnerable as could be yet it was still hacked -- that concerns me. And it's worse when I see all the links to 'how to hack Yahoo/Gmail/Hotmail' videos at YouTube and elsewhere. Apparently, some hackers claim to have software (comparable to that Firesheep extention we talked about in another thread) that just "gets in" and steals a password. No phishing necessary.

And it's usually the 'big 3' that are the targets. How many times do we hear complaints of someone's EuMX or Fastmail or Hushmail account being hacked ?

I say all this as a complete ignoramus on the subject, but also to indicate that I've seen/read things which suggest that phishing is not necessarily always to be blamed for accounts being hacked, though it may account for it in a lot of cases. It's the other cases that interest me, where a strong and intelligent defense wasn't enough.

When I had a GA account hosting my domain I did have separate admin and user accounts until I thought (perhaps unwisely ?) that I should follow the second option -- 2 (b) in my original post -- since in that case 1) the admin username/account was still unknown & unused, and 2) the "used" email address was only a 'nickname' (alias) and not, in fact, a "user" account, and, therefore, could not be hacked into. I also wanted to simplify things by not having more than one account, and I figured, if a hacker could hack the admin account if it was the only account, he could also do so if it were a separate account. It's not as if a hacker needs to access the user account before being able to hack the admin account, right ? An admin account is either secure or not regardless of whether there are any user accounts, no ? Or is that incorrect ?

Yes, I do recall reading about this. And, since Gmail doesn't allow aliases as GApps does, it's probably the only way to go. Still, since "Gmail ignores the dots," it really doesn't have the same kind of protection, because the username is still right there, visible.

From my slightly paranoid perspective , though, I would prefer the Apps feature of allowing nicknames/aliases so that the username can be completely unknown/unused and the used email address could be a completely different username (all this being as long as I had a domain to be hosted, of course).

On a side note, I have read some people saying that they also like Apps better because of its not having a password recovery option (Gmail does). I don't know if that difference has changed, but some hackers apparently are able to get in to someone's account easily (?) by the password recovery feature (secret question/answer or alternate email address). Apps eliminates that option for the hacker. So, more responsibility is placed on admin control over users as a consequence -- and he/she better keep that password safe !

Whew ! Sorry for rambling on. Thanks again for your input !

 

Thanks for your continued input, Ray. (Is that how you prefer to be addressed here on the forums ? If not, my apologies.) Great information. I'll just respond briefly (briefly for me, that is ):

1. To my understanding, the "big 3" are Gmail, Hotmail and Yahoo, though I realize some might want to put AOL in there somewhere.

2. Not being a 'techie,' I can only say that it appears that there is an obvious connection between the "non-stop noise about hacked Yahoo and Hotmail accounts" and the fact that they seem to be the two holdouts as far as implementing full-session SSL is concerned. (That, and the fact that they are companies with undoubtedly a lot of older people and/or less internet-aware people who want a 'simple' email service but who aren't careful about security. Too bad they don't read your articles !!)

A search for "gmail account hacked" showed a lot of results, not unexpectedly. Some of them were hackers offering 'how to's.' So there are a lot of accounts compromised. But you may be right about Yahoo and Hotmail being hacked much more mercilessly. It's too bad there aren't statistics out there (that I can find) that show who's hardest hit.

3. Nice article on the "5 Tips" !

As a sub-set of number 5, the strong password, is the (new ?) feature some services have of "one-time" passwords. Great for those 'public computer' sessions people might have when at the library or something when you don't want prying eyes to see your master password. My preferred service, FastMail, has some very nice alternative login functionality (though I've never needed/used it). And Hotmail is supposed to be coming out with that, as well.... whenever.

Thanks again for all the great feedback !

Scott

 

Thanks for the MAAWG link ! Interesting....