How secure are my e-mail accounts?

[Jaibaba Bholanath]

I have a Gmail account. I have designated this account as the one where
I get my various password information sent to me. In case I forget a
password, I click on the "Forgot password" link, and they send it to me
at my google account. I then use the password.

My question is: How secure is my Gmail account? Can I trust that
information from my gmail account will not be conveyed to somebody
else? Someone having access to my Gmail account can surreptitiously
send a "Forgot Password" request to one of me subscriptions, then open
my e-mail and see the password, then access my subscription. Isn't that
possible?

I have been reading that Google has said that they will store all
e-mails and will use the information for business purposes. Yahoo has
said recently in the Hackers' meet that they will give out some of the
codes to hackers. Which tells me that it's highly dangerous to trust
anybody unless there is a law governing their possible misuse of e-mail
- now and in the future.

Does the Windows Firewall and the Windows Live Defender have any role
to play in this regard?

 

[Gordon]

I have a Gmail account. I have designated this account as the one where
I get my various password information sent to me. In case I forget a
password, I click on the "Forgot password" link, and they send it to me
at my google account. I then use the password.

My question is: How secure is my Gmail account? Can I trust that
information from my gmail account will not be conveyed to somebody
else? Someone having access to my Gmail account can surreptitiously
send a "Forgot Password" request to one of me subscriptions, then open
my e-mail and see the password, then access my subscription. Isn't that
possible?

I have been reading that Google has said that they will store all
e-mails and will use the information for business purposes. Yahoo has
said recently in the Hackers' meet that they will give out some of the
codes to hackers. Which tells me that it's highly dangerous to trust
anybody unless there is a law governing their possible misuse of e-mail
- now and in the future.

Does the Windows Firewall and the Windows Live Defender have any role
to play in this regard?

Nothing about email is secure - packet sniffers can intercept transmissions
anyway.

 

[Bob I]

If you want secure, put it on paper and then eat the paper, anything
else may be found out.

 

[P. Johnson]

Well, if they're sending your password in plain text and not encrypting it,
you can only trust that to be as secure as you trust every email relay and
router between you and who sent the email.

Only if they can access your email account or sniff it along the way at one
of the mail relays or routers along the way as it's being delivered. This
is a good reason why you should always use strong passwords and never use
the same password for two different accounts. If you have a Palm PDA or
smartphone, I strongly reccommend GNU Keyring
(http://gnukeyring.sourceforge.net/) to generate and save passwords
someplace handy (and be sure to use a strong, memorable password you can
write quickly for Keyring's password, as Keyring will be using that
password to encrypt your password database).

None whatsoever.

Nothing about email is secure - packet sniffers can intercept
transmissions anyway.

That's not true. You can use an end-to-end encryption system such as
OpenPGP (http://en.wikipedia.org/wiki/OpenPGP) to encrypt your message to
the public key of your recipient. The usual key length is 1024 bits,
though 4096 is getting more common. The time it takes to try to break the
key by brute force doubles with every bit, so we'll all probably be dead by
the time someone cracks a 4096 bit key.

To Jaibaba, I can't see any Google Groups posts (my newsserver drops Google
Groups due to the amount of usenet abuse sourced at that site), so if you
reply, a courtesy copy by email would be appreciated.