Google Security

With news that 5 million Gmail passwords leaked on a Russian Bitcoin forum a couple of days ago, I started looking at how to make my Google account more secure.

First thing you want to check is whether there have been logins from unfamiliar devices and/or locations. Head over to security.google.com to check recent activity.
Second thing I did is to enable 2-step verification, the second step being a security code that Google sends to your mobile number via SMS. Every time you need to sign in to your Google account, you enter your password, plus this security code. Just be aware that as soon as you enable this feature, you have to re-authenticate your apps, devices, and browsers that use your Google account.

This works fine for Google sign-ins on the desktop. On Android, it's a bit of a mixed bag. Some newer apps are 2-step-verification-aware, and will allow you to enter the security code. Some apps will simply say that your password is incorrect. Couple of ways to go around this:

• Remove Google account, then add it in again. Enter account password as usual. A browser page should pop up asking you to enter the security code.
• On my older Android (Gingerbread) phones, this didn't work because it doesn't allow you to remove Google account, unless a factory reset is done. For this, you need to generate an app/device-specific password in lieu of your standard Google password. Works as advertised.

Worst case, if things aren't working out well, simply disable 2-step verification, and change your password regularly.