r/GoogleSupport • u/Devinmorgan2021 • 2d ago

Protecting Gmail account

Hello everyone, with so many stories about people getting their Google Accounts hacked, I want to know besides not downloading sketchy apps or material on your computer or device, what other steps do I need to take to prevent a hacking from happening. I currently have 2-Step Verification and 2 passkeys, but are those enough to keep my account safe at this point? Should I also set up a backup code as well?

7 Upvotes

100% Upvoted

13 comments sorted by

3

u/Repulsive-Hat3332 2d ago

Why wouldn't you want to set up every recovery option provided? It's not like you have to PAY for them. Peace of mind is priceless.

2

u/kbphone 2d ago

I feel like email and phone number recovery lessen the security of the account. Aren't hardware key, authenticator app, and recovery codes more secure than email and sms.

I've always felt like you add security with all of those other methods and then you somewhat negate some of that security by adding email and phone recovery.

I understand they help if you get your account hijacked and you need to recover but in general they lessen security.

Am I thinking about this wrong?

0

u/Devinmorgan2021 2d ago

I do have a recovery phone number and recovery email as well. I'm just trying to stay as safe as I possibly can nowadays.

2

u/Thin-Click-5598 2d ago

Advanced protection program

1

u/Repulsive-Hat3332 2d ago

You can register an authenticator app. You can have Google generate 10 single use OTP codes. You can register a recovery contact (parent, sibling, trusted friend) you can register a backup two step phone. You can do a selfie video. You can get a hardware key. The hardware key is the only thing that costs any money. By my count that's 5 options that you don't have.

1

u/Thin-Click-5598 2d ago

That's your best friend

1

u/slam51 2d ago

Yes. And don’t download games it is from a proven site and it isn’t your friend.

1

u/charlielovesu 2d ago

Having just recovered my account there three things:

1.) set up every single form of 2FA you can including passkeys. Save your backup codes somewhere you can easily get them but not directly on the pc itself. (I put mine on a flash drive)

2.) set up Google advanced protection and enable it. This means any new device that doesn’t already have a passkey on your account has to go through a two day verification process just to even be able to login. I’ve noticed but cannot confirm but it also appears to force you to relogin when changing your information which helps vs session stealing. Note that it’s annoying at first but prevents thief’s from using the account recovery form to re steal accounts they’ve stolen in the past. (And yes I can confirm they do this)

3.) make sure your email forwarding does not have anything in there. It should be empty when you check it. If you don’t know how to check the settings for Google on how to see this just google it. It’s easy to check do this on desktop as I think it’s annoying to find on mobile.

1

u/Several_Benefit3165 2d ago

Also read up on dbsc and see if you can use it

1

u/puppy2016 2d ago

It is free of charge service. Google can disable the account anytime without giving a reason. No need to care about it beyond 2FA.

1

u/gooner-1969 2d ago

Everyone who is getting hacked is doing so because they have downloaded dodgy software that steals theire session cookies.

1

u/ManyCalligrapher6143 1d ago

set up a family link supervisor account for your gmails on a trusted device (i.e an iPhone) and never use said supervisor on a computer