Late last night, I read a post at the Bradlands about a Gmail security vulnerability which, I think, was the equivalent of having your sense slapped into yourself when you're really drunk. Except I wasn't drunk, I was kind of in a semi-permanent state of adoring, when I should've been thinking; I had pets. Oh, I still have pets, but now I have common sense as well.

Essentially, Gmail has the following security vulnerability:

All a person has to know to be able to break into your Gmail account is to click "forgot my password" and correctly guess your "secret question", that's it, that let's them set your password to whatever they want. So when you pick your "secret question", pick a personal question which is fucking ungoogleable! I did not, I picked "What is the name of your cat?".

When I put it like this, it does seem like common sense should have stopped me from doing so, right? Well, in my defense, when I picked the "secret question", I was under the impression that my password would be sent to my "secondary e-mail address" (also required to sign up for Gmail) when that question was answered correctly, not that anyone who'd be able to answer it could set a new password right then and there. That, and my cat is really adorable.

Should you forget your password, answering your "secret password" is the first and quickest option to set a new password, only if you've forgotten the answer to that question, too, does Gmail send the password to your "secondary e-mail address".

So the first thing I did, once sense was brutally but efficiently slapped into me, by reading that post, was of course to change my "secret question". It's a lot tougher to find out now (it might not be impossible, but it's definately ungoogleable). I also submitted a Gmail bug report.

The second thing I did was to Google for Gmail addresses, and to check the secret question for any I could find. I did find quite a few addresses, and most of them used the default secret question, asking for your mother's maiden name. Most Gmail users are seemingly from the US (which isn't so odd) and I have just about no idea how to find a US citizen's mother's maiden name using public records, nor where or how to dig for those public records online. Someone else might know, and if they do they have access to almost all Gmail accounts, but I don't.

I do know, however, how to use Google, and quite well at that. The first time I found a Gmail user with a similarly stupid "secret question" like mine, asking for the name of his puppy, my reaction can be described as "Aha!". I did just a little bit of Googling and found out his dog's name in less than a minute's time. I'm not the mischievous kind, well I wasn't yesterday night at least, so I didn't break into his account, instead I sent him an e-mail, warning him of his weak "secret question". He was grateful.

When I found the second Gmail account with a secret question asking for the name of a pet, there was no "Aha!" reaction, there was just pity. I was over the excitement of it. As a person newly awoken from the dreamlike state of dedicated reverence of a pet, I felt for him. So I sent him a similar e-mail as the previous one I sent, explaining that his "secret question" was weak and that it was all a person needed to answer in order to hijack his account. I've had no word from him, yet. (Update: He was thankful for the warning as well.)

The third time I found a Gmail account with a secret question asking for the name of a pet it was just a real downer. I sent him, too, the same e-mail, explaining the security vulnerability, and telling him he should change his "secret question". No word from him yet, either.

That was it, then I went to bed.

Between these three, I went through many accounts with a secret question asking for their mother's maiden name, which I didn't bother to look up, and a few other most likely ungoogleables, like asking for the hospital in which they were born, and some really obscure ones too.

Apparently, I was not the only one not thinking straight about the googleability of my pet's name. But then again, I didn't think that was all anyone needed to know to set a new password. So, people, Gmail users especially, pick an ungoogleable secret question, okay? Thanks.

But, let it be clear, that I'm not saying that Google's approach to retrieving access to your account when you've forgotten your password is wrong. I'm not sure it is. I do think Google should make it very clear when you pick that question that it is all anyone needs to answer to be able to hijack your account, as opposed to having the password sent to your secondary e-mail address.

After careful consideration, I actually think that Gmail's approach is totally right. They shouldn't send the password to the secondary e-mail address, they should just let you reset your password, then and there, once you answer your secret question. Why? Because your Gmail account is quite likely to outlive your secondary e-mail account, especially if your secondary e-mail account is a Hotmail or Yahoo account, which Gmail effectively replaces for all intents and purposes.

But they should be clearer about the purpose of that secret question.

Permanent link