Hacking Update: Please Do These Things if You Use Gmail
(Update: Please see followup item on the risk of total data loss and how to avoid it.)
As mentioned yesterday morning, my wife's Gmail account was taken over by what has proven to be a very destructive hacker. The spam message the hacker sent out seemed droll; the consequences turn out to be less amusing. In my nearly 30 years of using electronic communication, this is the most troubling episode I've been involved with.
1) If you use Gmail, please strongly consider switching to the two-step authorization system. What I really mean is, "you should switch to the two-step system, and you should do it now."
With this system, you enter your Gmail account with your user name and normal password -- but then you must also enter an additional authorization code, generated in real time and sent to your mobile phone. It's similar to the authorization schemes that some banks and corporations use.
This is more cumbersome than the normal system, but in practice is a lot easier than it sounds. If you're at your normal home computer, you can choose to be prompted for the extra code on that computer only once per 30 days. Even when you don't activate that, if you have your mobile phone with you entering the code adds maybe 5 seconds to the log-in process. (For times when you don't have your mobile phone, there are other work around procedures, explained when you sign up.)
In exchange for the minor security burden, the real-time authorization vastly increases the barriers to outsiders trying to get into your account. They would need to know your password -- and also to have possession of your own mobile phone, to get the real-time code. It could happen, but it's far less likely.
2) If you use Gmail, please be sure to list several additional "password recovery contacts," in addition to your normal email address. If you have done this, then should your account be compromised (or if you just forget your password), Google can instantly and automatically send reset instructions to your mobile phone, a different email account, etc. But if you have not done that, so that their only verified way to contact you is through your main and now compromised account, then they have no automated way to verify your identity. Involving human beings in verification complicates and tremendously slows the process. If you wait until after you've had a problem to think of this step, it's too late.