How secure am I?

Ditendra · 10 Oct 2019

How secured is my Google account if I have strong password (unique to Google only), use 2-step verification Google sign-in prompt in my phone, plus Google authenticator in my phone and my phone number added too.

I'm asking this because I decided to store my Bitwarden master password & recovery code in my google keep notes. I have written it on the paper too, but what if I lose this paper or I forget where I put that paper? I don't have good memory.

And one more question: How secured is my bitwarden account if I use strong unique password, enabled to two step verification in my google authenticator in my phone, but also email in case I don't have access to my authenticator. Should I leave it like this or remove email option and leave only authenticator, but in that case, I if I forget my masterpassword and lose my recovery code (which I also store in my google keep notes), I will never gain access to my bitwarden account which sounds a bit scary. However to lose access to my google account and to forget and lose access to my bitwarden account sounds almost impossible.

So, should I store my bitwarden masterpassword and recovery code in my google keep? Am I secured enough?

And should I leave enabled email codes in bitwarden or just authenticator?

Golden · 10 Oct 2019

Don't you use Bitwarden to access your Google account? If you forget your Bitwarden master password then you lose access to your Google account anyway, so you are in a vicious cycle of being locked out.

Storing your Bitwarden password in plain text is extremely risky. Perhaps you need to change it to something that is easier to remember?

Ditendra · 10 Oct 2019

Golden said:

Don't you use Bitwarden to access your Google account? If you forget your Bitwarden master password then you lose access to your Google account anyway, so you are in a vicious cycle of being locked out.
Storing your Bitwarden password in plain text is extremely risky. Perhaps you need to change it to something that is easier to remember?

No, if I change it to something easier to remember it must be very simple and small, because I have very bad memory and I think master password of Bitwarden must be strong and complex.

I think keeping bitwarden password in google gives me more chance not to forget about it, because if I only write down on the paper and I lose that paper or forget where I put it, I will be out of everything. And maybe, if I store it in google and I will be inside google (I'm not signed in google only if I reinstall windows or reset my phone), I will have access to my bitwarden password in case I forget it.

Anyway, my question is: How secured is a google account if almost all security options are enabled including it's strong password as well. How hard it will be for hacked to gain access to such account?

Plankton · 10 Oct 2019

As for being secure:
As about as well as it can be.......as long as the end user does his due diligence in setting up ones security, as you have. Then you should be good. That said....you hear horror stories of big giants like FB, Google, MS; all doing stuff with ones data all the time. You just never know what's going on behind the scenes.

Google does offer to save passwords when logging into sites. Google also has extensions/plugins for passwords...even one for Bitwarden.

Golden · 10 Oct 2019

Ditendra said:

Anyway, my question is: How secured is a google account if almost all security options are enabled including it's strong password as well. How hard it will be for hacked to gain access to such account?

Your are as secure as Google's systems let you be...but Google is a big target.

Your current approach relies on Google being impenetrable, but clearly you have doubts about that. I think you need to consider reversing how you use Google to secure your Bitwarden master password, and use Bitwarden+2FA to secure your Google account instead. That way you never have to wonder how secure your Google setup is.

Steve C · 11 Oct 2019

I don't trust any tools which stored passwords 'securely' in the cloud.

I save passwords to a password protected Word file stored on a bitlocked USB drive plus a backup copy drive.

Ditendra · 11 Oct 2019

Steve C said:

I don't trust any tools which stored passwords 'securely' in the cloud.

I save passwords to a password protected Word file stored on a bitlocked USB drive plus a backup copy drive.

What if you're outside and something happens and you need to login somewhere like in your bank account and you don't remember your password? I've been in many situations when I was outside & needed passwords which I didn't remember and used my cloud service to get my passwords.

Steve C · 11 Oct 2019

Ditendra said:

What if you're outside and something happens and you need to login somewhere like in your bank account and you don't remember your password? I've been in many situations when I was outside & needed passwords which I didn't remember and used my cloud service to get my passwords.

I don't need to access secure web sites 'outside'

Barman58 · 11 Oct 2019

There are a few ways to provide a secure password regime that is rememberable (if that's a word), one ingenious way is to create a stub password IE a 8 letter password using upper lower case letters numbers and symbols that you learn. you then add an identifier to where the password is used EG the name of the site it applies to so you could have long complex and unique passwords that are simple to remember

Another more lazy way is use one of the password keys that is an encrypted USB stick

Of course the most likely way for someone to hack your password is at the internet site end - security is getting better but still, not long goes by without a "Internet passwords stolen from site" headline

as for writing passwords down in a book or on a sticky note on your Home PC monitor surround, this is surprisingly safe few hackers will consider any regular individual important enough and worthwhile financially to Physically burgle or Rob the individual ( burgle - Break in to a property, Rob - take from the individual by threat or use of Violence)

z3r010 · 11 Oct 2019

You may want to look at replacing Google Authenticator with Authy as you can use it across multiple devices and there is less chance of getting locked out of your sites if you lose or break your phone.