If someone hacks my Gmail, can they
hack my other accounts?
Hi everyone, Leo Notenboom here for Askleo.com.
Ask Leo is supported in part
by my patrons, for whom I'm very, very thankful.
Visit at askleo.com/patron for more information.
About supporting Ask Leo! And Patron exclusive benefits.
Here's the question.
If someone has one password to my.
Gmail account, can they access my other.
Account even though it has a different email and password?
The best I can say is maybe.
But this is something that I think.
People overlook a lot, and as a.
Result, I want to go over the.
Scenarios that we're talking about.
So the initial compromise here is
that someone has a password for your Gmail account.
In other words, they can log into your Gmail.
They can obviously change the password, but.
If you can still get in, perhaps they haven't.
They can read your email.
They can do a number of interesting things.
The "interesting things" part is worth paying attention to.
For example, after they read a message.
They get into your account, and after they read one of your emails, they.
Could mark it as unread.
Unless you were looking at the exact.
Same time, you would never know that.
They had read it.
They could take one of the messages
that you've received, forward it to somewhere else,
and then delete the forward from your sent mail, and again, make it marked as unread.
You might not notice that it had been forwarded if you weren't paying attention.
Perhaps worst of all, they could receive a message, read it, delete it, and.
Remove it from your trash.
You'll see why that's worst of all here in a moment.
But while they have access to your.
Account, they can cause a lot of.
Havoc even without denying you access to the account.
Here's the scenario.
What I'll call directly linked accounts are accounts for which you have used this.
Gmail email address as either the login.
ID or a recovery ID.
I'll talk about recovery IDs later.
Let's talk about the login ID first.
They don't have access to this other.
Account yet, but they have access to your Gmail account.
Maybe they can see from your email.
That you've got a Dropbox account because.
There'S a message from Dropbox for you.
Great.
They can then run over to the.
Dropbox account, try to log in.
Of course, it will fail because they.
Don'T know your password.
They will then initiate a password reset.
Click on I forgot my password.
Dropbox will then send you your email.
Address, a password reset request.
They, since they have access to your.
Email, can read it, act on it.
Reset your Dropbox password, and then delete.
The email from your Gmail as if.
It had never arrived.
They now have access to your Dropbox.
They have set a new password on your Dropbox.
You don't have access to your Dropbox.
And to be super clear, Dropbox is just an example.
Any other service that you use this Gmail account to log in is vulnerable.
If they have access to your Gmail.
Account,
they don't really even need to know that those other accounts exist, right?
In my case, my example here, I.
Told you that they happen to notice.
You'Ve got a Dropbox account because you.
Received some email from Dropbox.
The other scenario that is probably more.
Common is that they'll just try all the popular services.
They'll run password reset requests
against Dropbox and OneDrive and just any other online service you can think of.
Chances are you'll probably use one of them.
That password reset request will work.
They will see the email show up.
In your inbox, they'll act on it.
They will compromise that other service, and.
They'Ll delete the email from your inbox.
As if it never showed up.
So yes, they can get directly linked accounts.
Now, I truly realize that that was not your question.
You were very specific about how this.
Email address was not used to log.
Into this other account.
That's great.
But what if it's your recovery address?
What if that email address your Gmail.
Address that they have access to because. They know the password?
What if that's the account not to.
Log into that service, but to recover.
The account for that service?
It's the secondary email address or an.
Alternate email address for these other services.
Everything I've just talked about works pretty much the same.
They can try and they do try.
Your Gmail account against all of these.
Other services in the hopes of trying.
To reset your password.
It gets worse.
Let's say you don't use your Gmail.
Account as the secondary email address
for any of these other accounts except for one.
Let's say you have a second email address.
I'll just say a Yahoo address.
And that's what you're using for all.
Of these other accounts.
From your perspective,
you've got your Gmail account as being completely separate from all these other
accounts because they use your Yahoo account.
What's the recovery email address for your Yahoo account?
If it's your Gmail, you've still created a link.
You've still created a stepping stone.
They could compromise your Gmail account,
use that to then compromise your Yahoo account.
And use that then to compromise all.
Of these other accounts that you happen.
To use your Yahoo email address to sign in.
What can I say?
Do they do it really?
We've heard of this kind of stuff.
Happening, but it's not particularly common.
Not yet, anyway.
That doesn't mean it can't happen to you.
You need to stay secure, and ultimately.
There'S nothing special about this scenario.
You don't need to take extra steps.
You need to take the steps we.
Keep recommending you take all the time.
Use strong passwords.
Use different passwords on every site or service.
Use a password vault to make those two steps easy.
Keep your account recovery information up to.
Date on all of those accounts.
And if you can use two factor.
Authentication because that way the very
first question you started with is a non starter.
Even if someone had the password to.
Your gmail account, if you have two.
Factor authentication on that gmail account, they.
Still can't get in hope. That helps hope.
That helped clarify a little bit about.
Why security is so incredibly important for.
Updates for comments for alert related links and more visit askleo.com/146153
I'm Leo Notenboom and this is Askleo.com thanks for watching.