Re: Gmail (was: Re: lore+lei: part 2, now with IMAP)

[Konstantin Ryabitsev <konstantin@linuxfoundation.org>]

On Mon, Nov 15, 2021 at 07:34:00PM +0100, Geert Uytterhoeven wrote:
> On a related subject, I am using Gmail for email (e.g. patch review),
> but not for actual patch submission (git send-email through my ISP's
> SMTP server). I do have app passwords set up for git send-email on
> my laptop (if I ever need to send patches while on the road, barely
> used so far) and for backing up email using getmail.
> 
> Recently I received an email from Google that my account may be "at
> greater risk of targeted attack", and that they recommend enrolling
> into Google's strongest account security offering, the Advanced
> Protection Program.  Apparently this makes use of a hardware token,
> the Titan Security Key. 

Well, I'm sure they wouldn't mind if you paid them money for a "Titan Security
key", but it's really just a rebranded Chinese-made U2F token and, as such,
not any different from any other U2F security key. You can get one from
Nitrokey (nitrokey.com) or SoloKeys (solokeys.com). I *do* recommend using a
hardware token for your Google account, seeing as it's increasingly tied to so
much of our online identity.

> I have no idea what kind of criteria are
> used to reach out to people (might be people involved with important
> FLOSS projects, who knows? ;-), but the other family members haven't
> received this.

It's anyone's guess, but it's probably based on analyzing various account
dumps a-la haveibeenpwned.com or Mozilla's Firefox Monitor. It doesn't
necessarily mean that you have anything in particular to worry about.

Best regards,
-K