Gmail’s security scare is a dark reminder of the Internet’s fragility

Welcome to The Full Nerd newsletter—your weekly dose of hardware talk from the enthusiasts at PCWorld. Missed the latest topics on our YouTube show or the hot news from across the web? You’re in the right place.

Want this newsletter to come directly to your inbox? Sign up on our website!

I’ve been called “process oriented” more than once in my life. I don’t mind. People take systems for granted, but their structure provides a sense of safety and security. Until they don’t.

I feel a lot people missed the point last month, when news circulated about 2.5 billion Google users potentially at risk following a data leak. Everyone immediately jumped to the idea that passwords needed to be changed—not a bad instinct, as we ended up discussing on The Full Nerd this week.

But as that very conversation illustrates, people usually focus on the smaller details: who got hacked, if data was leaked, and whether a password change is warranted. (Spoiler: I believe that changing a password takes so little time, you should just do it when the topic ever comes up.)

What most folks don’t focus on the fact that Google’s data leak happened through a major third-party vendor—and followed on the heels of other major companies suffering data leaks through the same source. That external company is Salesforce, no small player either.

When I hop on my computer or phone each day, I believe in the technology. I assume the services and apps I use won’t add extra demands to my day. But with the ever-expanding scope of data breaches and leaks, that trust is slipping. And perhaps it’s a good thing that it is.

IDG

As end users, you and I have little control over the systems we all rely on. But we do have a say over our response to chaos. Problems occur when I assume peace and tranquility, and then a huge disruption lands on my doorstep.

Right now, people focus on what to do in the moment, and breathe a sigh of relief when the damage doesn’t appear to be widespread. For this example, Google ended up clarifying that no accounts were compromised as a result of the Salesforce leak—and the talk started turning to no one having to worry.

I’m a contrarian on this point. I say we should keep talking about how to handle online security, especially as the largest players fall victim to exploits. Not just the thing to do at the moment, but how easily a person can enact those changes.

So yes, folks should know to update their passwords any time there’s a breach. That’s still vitally important. But a user should ideally be able to rotate a password in just a few minutes, too—they should operate in a way where it can happen fast, without needing to be thought about again later on.

Because what happens on the day that Google does fall to a breach? Or DNS finally folds in on itself because hackers are no longer content to mess around for sheer amusement? Most people haven’t planned for such disruption. 

How well would you cope?

In this episode of The Full Nerd

In

Willis Lai / Foundry

Keychron