Google Warning Gmail Users About State-Sponsored Attacks 69
Trailrunner7 writes "Google, whose users have been frequent targets of suspected attacks by foreign governments, is deploying a new warning system for users who may be victims of those kinds of attacks. The new system is in addition to existing warnings that Google will show Gmail users when their accounts may have been accessed by attackers. Gmail users have been on the receiving end of a number of known attacks, including the infamous Google Aurora attack that has been blamed on China. Part of that operation was aimed at a specific subset of Gmail users, including Chinese dissidents and journalists. Now, Google says it will warn users about exactly that kind of activity."
Re:Google thinks texting is secure??? (Score:3, Informative)
First, there is an Android/iPhone/BlackBerry authenticator app (software one-time pad) that you can and should use instead of SMS-sent confirmation code if you don't have a dumbphone.
Second, if you cannot use such an app: obviously SMS represents in no way a secure channel, but it still adds another unsecure channel a potential attacker has to identify then crack (although wiretapping SMS is peanut butter for NSA and friends, linking phone number to Google account might not always be trivial when using prepaid cards for example).
Re:Google thinks texting is secure??? (Score:5, Informative)
Another point is that you can use Google authenticator rather than the SMS garbage. This is much more secure and uses HMAC-Based One-Time Password Algorithm (RFC 4226) [ietf.org] and Time-Based One-Time Password Algorithm (RFC 6238) [ietf.org]. It even has a PAM module that you can use with just about anything that supports PAM, and it has iOS, Android, and Blackberry versions of the client app.
Re:How about... (Score:5, Informative)
Which email client has encryption installed out of the box?
Outlook, Thunderbird, the mail client in OS X, Evolution, and KMail all come to mind -- they all at least support S/MIME out of the box. Now, I think S/MIME is not appropriate for the typical PC user's email and the PGP's web-of-trust approach is a lot better, but it is not as though there is no encryption option available in popular email clients.
find out how to generate keys
This is definitely the weakest link in the chain for email encryption -- I do not think any of the clients I mentioned above have an automatic key generation process. Maybe Google should submit a patch to Thunderbird instead of working on better ways to let people know that they have been compromised (or perhaps in conjunction with that).
somehow get my public key to all of the people that I want to communicate with?
S/MIME does this automatically when you send signed email to people.