Not All Security Questions Are Secure

I’m a thief. I stole an email address, and I don’t feel too bad about it. Maybe a year or so ago, I decided to register my full name with Gmail. Because my primary address had my gaming handle in it, I wanted something a little more professional to use when necessary. When I attempted to register, I was told that name was already taken. For you Kevin Johnsons out there, this might not be uncommon. For a Seth Gholson, this is quite uncommon. My initial thought was “Oh! I must’ve registered it long ago and forgotten.” Naturally, I clicked “forgot my password.” I was present with the following security question:

What is your favorite color?

This seemed quite odd. I’d never use that as security question. For one thing, I’m on the fence between green and blue. I tend to spend a few years in each camp, alternating every so often. I just assumed I might’ve made this account so long ago that I chose this question before I understood what security meant. I made a gamble and I picked green. Wrong. Next up: blue. Bingo. I was present with a “new password” form. I set my password and logged in.

There were 5 emails – all Myspace related, 4-6 months old, and unread. None had even been archived. The last email was an account cancellation message from Myspace. That seemed awfully odd. A bit of Googling and and use of the Way Back Machine and I found him: another Seth Gholson. If his Myspace profile was an accurate indication, then he was around 14 or 15, had already developed an impressive ego, and fully expects to become a professional athlete.

Lessons to be learned by Mr. Other Seth Gholson:

1. Don’t pick easy security questions.
2. Don’t use the most obvious answer.
3. Bind your next gmail account to a secondary email address, like I did right after I snatched it.
4. Stay away from Myspace. It’s full of pervies.

I don’t feel too bad for this. It looks like he barely ever used it. On top of that, I’m older. I call firsties. If there’s a Seth Gholson out there born before ‘83, I welcome you to snatch the address from me.

Off with my Gmail account’s head! Long live my Gmail account!

In an effort to simplify life and centralize my scattered points of communication, I’m consolidating my email addresses. I currently have:

• My original gmail account, which includes my gaming handle for some strange reason and I’ve hated using it for years.
• My email account for this blog, which uses Google Apps For Your Domain Business.
• My full name at gmail – my acquisition of this account warrants its own post. I don’t use it too often because my last name isn’t immediately intuitive and it makes the address a bit long.
• My primary email account from my old domain, which I primarily used for a side job I used to do, but I have a couple of random website accounts tied to it like Drop Box.

When I started considering this, I immediately thought of Google Reader, gmail chat, and of course Buzz. I want to check everything from the same account, so these are a factor as well.

Transferring my contacts was a cakewalk, but not as easy as it should be. When you create a new account, Google has 3 emails waiting in your inbox – an introduction to mobile phone access, a summary of customization options like colors and themes, and a third email sympathizing with the pains of transferring contacts and a handy “Import contacts and mail” link. Strangely enough,  they wouldn’t allow me to import contacts from another gmail account. WTF, Google? I had to export/import a Google CSV file, but no obvious data was lost. It also allowed me an opportunity to address the contacts that I don’t really communicate with often enough to label a “contact” and omit them. Nonetheless, it should’ve been a one-click operation.

Google Reader was a similar painless affair – I just exported the OPML file from my old account and imported into my new account.

Buzz and Google Chat were a different story, though. Because Buzz just launched, I’m only following 9 people – the 9 it automatically recognized. For this and for chat, I had to manually add each contact by typing in their name or email address. Luckily, Buzz tied into Google Reader, so I was automatically following my old Google Reader chaps.

Next up – forwarding. In each of my old accounts, I configured it to forward all email to my new account. In my new main account, I created a filter and I have each account dropping into its own folder label. This will help me make sense of it all at first, but I plan to eliminate this distinction later.

I expect there to be some cases in which I don’t want my reply-to address to be my new main email address, but keep it as the old address. Because of this, I added all accounts under “Send mail as” in my Google settings. This will allow me to still send mail from my @sethgholson.com address if I specifically wanted to:

Google sends a verification email to that address with a code/link to confirm you own the address. Because I had already configured forwarding, it all came to my new inbox and I didn’t have to hunt down the number in each account.

I’m sure I neglected something, but that should be the core of the transition.