I too am very curious about this. Even if his password was exposed and he didn’t have 2-factor auth, doesn’t Google by default ask for confirmation — e.g. texting a number or backup email associated with the account — when seeing an unrecognized device? Maybe he didn’t have any alt contact methods associated with his account?

(which might not be that unusual, he’s old enough to have opened a gmail account upon launch, before extra info hoops were put in place, and maybe he never touched his account config in the past 2 decades?

▲

mattbis a day ago | parent [-]

You are probably right... I tend to change my password semi often. It's always a super complex impossible to remember string - and always keep an eye on the account activity.

Not to mention ; you would assume he should have more than one device linked to the account and then that adds another layer, since Google will ask you " is this you trying to logon ". <-- that is the only way to get Google to do the unrecognized flow you mention.

If you are suggesting it was exposed and he didn't immediately randomise all his passwords.. WORDS FAIL ME

It's all security 101 the irony is immense...

if the US government / FBI need someone to give some talks on how to do security ...

▲

ffsm8 a day ago | parent [-]

Changing a password that's randomly generated is security theatre. It doesn't meaningfully improve security

Also it's entirely possible they only compromised a honeypot.

Considering their track record, that's actually more likely tbh

▲

mattbis a day ago | parent [-]

Honeypot sure I didn't think of that.. But I was under the impression the FBI confirmed it ? So we can rule it out.

Making the password impossible to guess - how could that not be?

Since then you know you have a breach, as its randomised gibberish, if you then get the 2nd device asking " is this you trying to login " you can definitely know you are compromised....

I can't see your logic here, that isn't " theatre " ????

If you think that is theatre what is better then? Words and numbers.. easily brute forced.. Sorry can't agree.

▲

ffsm8 a day ago | parent [-]

Why would they willingly destroy their successful honeypot if the other party announced they've access to it?

I haven't seen what's in it either though, but I would not rule it out yet, especially when the FBI is involved - which love those tactics

When you're compromised, changing the password is obviously not theatre - but changing a password which is randomly generated with enough entropy is what's pointless theatre. A secure password is secure, esp. If you're already using a password manager then the act of changing isn't meaningfully increasing your security (unless you're aware that your password was compromised) because the way to compromise it is what...? Having a keylogger on a device you logged in on? Then the changed password will be just as compromised

	▲	mattbis a day ago \| parent [-]
		That's why keepass is really useful since you aren't ever typing in the password.. its generated and then copied to the clipboard.. That clipboard is then wiped after X seconds. So then you know that you have been rooted => If that fails to resolve it. Reduce the number of vectors to know what you have to change asap. in this scenario you don't want to be guessing about how they did it. The randomised gibberish just means you can rule out certain things. I can agree on part of what your saying but a string high entropy password, makes it harder to brute.. Many services don't really do that whole retries thing properly. So make it take as long as possible. If you don't use a random gibberish your password can be cracked on any consumer device in a surprisingly short amount of time... This way you can then focus on that a session token is probably how they got in.. It's the most common vector these days...