Your Gmail account contains some of the most sensitive personal information about you and is
hands down the most vulnerable link in your online security profile. More than likely, some document
you’ve sent or received contains your full name, your address, and even your social security
number. It doesn’t matter how empty your bank account is, this information can easily be used
to maliciously steal your identity, destroy your credit and lock you out of your online accounts.
In other words, the five simple steps for securing your Gmail account, I’m about to share
with you - steps that will only take a few minutes to implement - aren’t just something to consider
“someday”. It’s critical to do this RIGHT NOW. Welcome to All Things Secured, my name is Josh
and as somebody who has personally had their Gmail account hacked in the past, I can tell you
from experience how annoying and time-consuming it is to recover from this kind of attack. You
don’t want to have to go through that, trust me. By the way, this video is sponsored by Yubico,
a company I’m really proud to represent, and there’s a very good reason for that
which I’ll explain in a moment. For now, let’s jump right into your Gmail settings.
I hate that I even have to share this as a step, but if you don’t have a strong password,
please, please change it right now. A strong password is a random combination of characters,
the longer the better, that is unique, meaning that you only use that password for Gmail and
not a single other online login. To change your Gmail password,
go to myaccount.google.com/security and click on “Password” under “Signing into Google”.
Make sure you create a better password that you won’t forget and isn’t used anywhere else.
Now that you’re in the security settings of your Gmail account, you may have noticed a few warnings
under the Security Checkup box. Even if Google gives you a pat on the back with a message reading
“Your account is protected”, I still recommend you jump over to the security checkup page.
I’ll have a link in the description or you can just type in what you see here on the screen.
It’s really important to know what you can do with this tool Google provides, both from a
monitoring and threat avoidance standpoint. For example, I can check all of the devices that are listed as
“trusted” to open my Gmail account and make sure there aren’t any unknown devices that I can tell
Google I don’t recognize. Or better yet, let’s say my phone was stolen, this allows me to quickly
jump in and tell Google to sign that device out so that the thief won’t have access to my email
even if they're able to get into that device.
In my opinion, probably the most important change you can make to secure your Gmail
account is to turn on 2 factor authentication. As you can see here, I have multiple security
keys as well as the Gmail prompt setup as my 2 factor authentication, or 2FA for short.
Now let me stop and say this. If you take away only one thing from this video I want it to be
this: Gmail security does not exist without 2FA. In other words, if you’re not using 2FA, even if
you have the strongest password in the world, your account security is at high risk. I’m not trying
to scare you, I’m just telling you the truth. There are many ways that you can activate 2FA,
including SMS text, authenticator apps and even backup codes. Thankfully,
the most secure way to do this is also one of the easiest to setup. And that’s where Yubikey,
the sponsor for this video comes in. If you’ve followed me here for any amount
of time, you know that I don’t take on many sponsors on this channel. And the truth is,
they didn’t reach out to me, I reached out to them, basically saying “I use your 2FA keys,
I love them. Let’s work together!”. You see, I own a few of their 2FA keys,
including one that I keep on my keychain, which works for my computer and Apple phone, the backup
that I keep in an undisclosed location, and the new Bio which uses fingerprint authentication.
There are plenty of 2FA keys you can find on Amazon,
but when it comes to this kind of security, I’m very picky about who I trust. You can use the
Yubikey Security Key to secure not only your Gmail account, but also any other account that supports
the FIDO protocol, and there are plenty of them. If you don’t have your own 2FA key yet or perhaps
you don’t have a backup, Yubico is offering a special discount on their affordable Security Key
series so that you can buy a couple of your own. You’ll find links in the description. Personally,
I bought four, a primary and backup key for myself as well as the same for my wife. I promise you,
this is an investment in your security that you can’t afford NOT to make. I know that’s a double
negative. In other words, you need to do this. The process of setting up a 2FA key on your Gmail
account it’s pretty straightforward. Log into your Gmail account,
go to myaccount.google.com/security, scroll down and find 2-Step Verification,
turn it on if you haven’t already, then click “Add security key”. Of course, you’ll already
need to have purchased your key, but once you have your Yubikey device in hand, you’ll click on USB
and then register the key by plugging it into your computer or device. Name it whatever you want and
then you’re done! You can remove the keys at any time, which is useful if you somehow lose the key.
Now any time you log into your email on a new device, you’ll need to plug in this
key to verify that this is, in fact, your account. But that’s exactly what you want.
Important side note here: whenever you use any kind of 2FA, you NEED to make sure you
have a backup plan. This could be a second key, backup codes that you store securely or
something else. The last thing you want, though, is lock yourself out of your Gmail account!
An important step in your Security Checkup after 2FA is to review 3rd party access. Over the years,
we allow certain apps or websites to have access to our account and we often forget to remove them
when we’re done using that particular service. For example, you can see here that at some point
I allowed Word Cloud for Documents to have access to my account.
Since I don’t use that service anymore, I’ll go ahead and remove access.
You should do the same to any apps or sites that you don’t recognize. And don’t worry,
if you make a mistake, they can always ask for new access that you can give them again.
Now for those of you who want an extra measure of security - and don’t worry, I’m not judging
you because I do this - you can enroll in what Google calls its Advanced Protection Program.
It’s free to sign up, and although it was designed with activists and
journalists in mind, it’s open to anybody. Essentially, the Advanced Protection Program
forces you to use a 2FA key, which I’ve already said is the one thing you need to be doing anyway.
In addition to 2FA, a Gmail account enrolled in this program performs
stringent checks on file downloads, app installs, malware, etc.
Honestly, I can’t think of a good reason not to enroll in this free program unless
you just refuse to buy a required 2FA key. But, since I know you care about locking
down your Gmail account, a 2FA key is a no-brainer investment. Make sure you
grab your own set of Yubikey 2FA keys using the special discount link below this video
and share this with other family and friends who you know need to enhance their own Gmail security.
Oh yea, and if you want help setting up your Yubikey on other accounts besides just Gmail,
make sure you watch this tutorial next. Click right here.