1

Lately I've been bothered by the fact that should one of my e-mail accounts be in some way compromised despite its long and randomized password phrase. I'd have hell to pay since it is effectively a gateway into a large portion of any other accounts of varying value I possess.

What I wonder then is, how can I go about optimizing my e-mail account security?

My e-mail accounts are all hosted on siteground under a custom domain of mine. This service has no way of providing 2FA for e-mail accounts unlike Gmail. As far as gmail goes, I travel a lot over long periods of time which creates a few issues as they tend to lock you out of your account when you go abroad and lose access to the phone number with which you setup the account (this loss of access to the phone number is often permanent in my case).

I'm under the assumption that there's basically only two things I can do, aside from avoiding accessing my e-mail on a 'foreign system' or on a 'foreign network', and that is to:
1. Ensure that I utilize randomized passwords of considerable character length.
2. Acquire 2-factor authentication.

Is there any way for me to somehow alter my hosting setup in order to acquire 2FA for a custom domain, which is then enforced whether I use a third-party e-mail client such as Outlook or Thunderbird?

Is my only 'reasonable' option to utilize gmail, and if so, is there a way around the damn phone verification issues that becomes a torn in my side every time I relocate?

Also, is there an e-mail client such as Thunderbird that can actually handle the potential 2FA request? I have a lot of e-mail accounts that I need to manage in general, so if I can't keep them all in one place, that'd be a massive inconvenience. I don't mind 'signing' in once a day or so with 2FA, as long as the session is kept active.

Chaminda Bandara
  • 283
  • 1
  • 2
  • 13
  • I have 2FA on my Google accounts, and it uses Google Authenticator which can work offline. You can also setup things like Google Titan or Yubikey, which also work offline. You don't have to worry about phone connectivity in these 2FA setups for Google. However, I think if you travel to China, then you won't have access to your Gmail account (2FA or not!). – keithRozario Dec 14 '18 at 05:57
  • Well, I'm aware of how different types of 2FA and the fact that gmail has access to it. I'm less certain that gmail is a viable long-term option due to the phone verification requirement as well as the fact that I still have custom domains that I need to acquire 2FA for (which I'm not sure how to). – hurtcomplex Dec 15 '18 at 03:22
  • [Related](https://security.stackexchange.com/questions/19709/pop3-imap-stronger-authentication) – RubberStamp Dec 18 '18 at 03:34

0 Answers0