13

I am very concerned with security of my Google account in case I lose the phone (as in: lose it, have it stolen/robbed, etc.). Right now it seems that whoever grabs my phone will also have full access to mail, calendar etc.

I would be perfectly happy to sync manually and/or have a password prompt every time I try to sync, but I don't see this option.

How can I protect my account? Is screen lock any good? How hard is it to bypass it?

The phone is HTC Desire should it matter.

2 Answers 2

13

Instead of entering a password every time you sync or access your mails - which will also be more insecure, because you enter the password often and in public - think about a good screen lock (PIN or Password) and a remote wipe solution.

Changing your Google account password is always a good idea in case of a stolen Android device. According to Oleg Ostroumov comment, the device will stay logged in for ~hour and then request a password.

6
  • Of course I would change the password as soon as I could... but if the phone was stolen there would still be a time where the thief would have the phone and I would have no means to change it or even call someone to do it for me. Is the built-in screen lock good enough protection for it, or is it easily bypassed? Feb 16, 2012 at 9:24
  • There are various types of screen locks on Android. IMHO a password is the safest and it can not easily be bypassed. If your phone is stolen when it's locked you are pretty safe. I would not call someone to change your Google password.
    – Flow
    Feb 16, 2012 at 9:44
  • Also, with enough patience and a flashlight (provided the user is greasy and doesn't change his unlock pattern very often) it's quite possible to deduce their pattern from the smudges on the screen. A PIN code is immune to this, and it's quicker to enter too :) Feb 16, 2012 at 13:24
  • 1
    @KonradGarus No, if you try and guess a certain number of times (around 20 afaik) incorrectly it freezes up and asks for your google account password. Feb 16, 2012 at 13:27
  • 1
    Update: phone stays logged in for ~hour, and then it requests password. So changing password is indeed a solution. It's good news that one doesn't need to factory reset the phone to log out :) I'm deleting my previous confusing comment.
    – Oleg M
    Sep 5, 2013 at 12:18
12

In addition to what Flow says, and I think this is a superior solution:

Use application-specific passwords

The idea here is that you can create an application-specific password for any non web-based application that needs your Google credentials (think Android phones, mail clients, IM clients, etc.) You create a credential for each purpose and use this instead of your Google password -- this doesn't require special cooperation by third-party application developers. You can keep track of all issued application-specific passwords, and revoke them on a case-by-case basis if necessary. So if your phone is stolen, you can easily revoke access to your Google account and the attacker will no longer be able to log in as you. Please note that some applications might leave behind contact lists and offline email which will still be on the device even if it's not associated with a valid Google account. You'll need a remote wipe application for this purpose.

You can find this on your Google Account settings page. Look for authorizing applications and sites, and take it from there. See also this video from Google about 2-step authorization and application-specific passwords.

While at it, enable 2-step authorization using your Android device for an extra layer of security when you log in from an unknown computer/device.

1
  • +1 I really think that 2-step authorization is the way to go as it will force you to use application-specific passwords
    – tidbeck
    Feb 23, 2012 at 9:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .