On Saturday morning I made the mistake of trying to open what I thought was a digital game on my desktop computer. Instead, it was a hacker’s software that accessed my Google account, bypassing two-factor authentication through some combination of saved cookies and my current logins, changed my recovery options to truly lock me out, and then take over the Stonemaier Games YouTube channel to post cryptocurrency videos.
It was a really, really bad day.
I’ve posted the full story in a combination of text and video, but I wanted to spread the word to you as well just in case it will help you avoid this type of hack. I didn’t think I would fall for something like this–I don’t open strange attachments or click on odd links–yet one mistake was all it took. And I thought my security levels were solid, but they weren’t enough.
I know it’s scary to think about this sort of thing happening, and sometimes it leads to inaction. I totally understand that. So if there’s just one thing you do as the result of reading this, here’s what I recommend: Open Gmail (or whatever program you use for email), look at the account recovery options, and add an authentication app to them (I use one called Authenticator). A recovery phone number and email aren’t enough–as I now know, a hacker can change them in seconds.
The good news is that by end of day on Saturday, Google had restored my account (email, Google Docs, YouTube, etc). It was an incredibly harrowing day, but I was fortunate it wasn’t days, weeks, or forever. I’m still in shock, as it’s such an invasive violation. Despite how vigilant I’ve been since then, it feels like it’s still happening. It isn’t a good feeling, and I hope this post will increase the chances you won’t have to feel the same way someday.