Q&A: Verifying Gmail on the Road

Q. I have the Gmail two-step verification turned on for my account, but I am preparing to travel overseas and will not be able to use my cellphone to get verification codes. Should I just turn off the two-step verification for my trip?

A. If you will not have access to your cellphone for the Gmail verification process, you can print out a set of codes before you leave. When the Web browser on your friend’s computer requests a verification code, type in one of those codes. You get 10 codes at a time. After you use one to log in, it becomes inactive and you move on to the next one when you need to check your Gmail account again.

You can create a set of codes by logging in to your Google account and clicking the Show/Generate Code option in the “Printable backup codes” section. You can print the codes or save them to a text file. You can also generate a new set of codes if you use (or lose) the first batch. Google has more information on using backup codes on its support site.

Along with printable backup codes, that same Google page of verification settings has options for sending codes to other phone numbers, like those of trusted friends or family members. And even if you do not have cellular service for your phone overseas, you can use the Google Authenticator app for Android, BlackBerry or iOS to generate codes on the device. The “Mobile application” section of the verification settings page has instructions.

Reclassifying Songs in iTunes

Q. I noticed that iTunes has labeled some of the music I have loaded from CDs “Unclassifiable” in the genre list. Can I change this so the tracks sort into the proper music types?

A. Song files can sometimes be tagged improperly if the information used by iTunes to label the converted CD contains errors or incomplete information. The labels are not permanent, though, and you can edit them.

Select a song in iTunes, go to the File menu and choose Get Info; you can also right-click on the song and choose Get Info. When the Info box appears, go to the Genre field and use the drop-down menu to select a new style of music — or type in a new one. Make any other corrections you need to in the other text fields and click O.K.

TIP OF THE WEEK Want to grab a photo you have uploaded to your Flickr account, to print out or use as a profile photo for a social media site? Just log into Flickr and click on the thumbnail image of the picture you want to use in your Photo Stream or other photo set.

On the picture’s main page, click the More menu icon in the bottom-right corner (it looks like three large dots) and choose “View all sizes.” On the resulting page, you should see a variety of sizes for the photo. The sizes are measured in pixels, like “Square (150 x 150),” “Medium 500 (333 x 500)” and the original size of the image when you uploaded it.

Click the size you want and then click the Download link on the page. If you already know the image size you need, you can just right-click on the picture and choose the desired option from the “View all sizes” menu from the photo’s main page.

Gadgetwise Blog: Q&A: Setting Up Gmail Securely

I’m trying to download my Gmail into the Apple Mail program on a new Mac and I’m getting an error when I try to set up the account. I have Gmail’s extra verification turned on, but there’s no place in the Mac’s Mail program to enter the security code they send to my phone. What can I do?

Google’s two-step verification feature can trip up mail-setup scripts that are not equipped to handle anything more than just a standard password. In this situation — or if you have recently turned on two-step verification and found your mail program or devices can no longer get Gmail — you need to log into your Gmail account in the Web and set up an “application-specific password.”

You can find Google’s step-by-step instructions for using application-specific passwords here and a YouTube video demonstration online as well. Once you log into your account and go to your security settings, you can get to the application-specific passwords area. Here, you can type in a name for the application (like “Apple Mail”) and click a button to generate a lengthy one-time password to type into the Mail program’s password box.

Google’s site has a troubleshooting page that guides you through setting up other types of mail software to send and receive messages from your Gmail account. The page also includes links to guides for programs besides Apple Mail, like Microsoft Outlook, Windows Mail, Mozilla Thunderbird and mail programs for Android, BlackBerry and iOS devices.

Gadgetwise Blog: Q&A: Experimenting With Gmail Labs

Are those Gmail Labs add-ons safe to use, or could I be endangering my in-box by installing them?

Those nifty little Gmail-helper programs known as Labs, which do things like display Google Docs and Map previews in messages, or provide a preview pane for the mailbox, are experimental. While some Labs are quietly safe, some could potentially cause problems with your in-box loading properly. Google itself stresses that Labs could break at any time, and certain Labs add-ons could change or disappear temporarily — or for good. So proceed at your own risk.

You may find that some Gmail Labs are so inventive and handy that they are worth that risk. Google occasionally highlights new additions to the Labs collection on the Gmail blog for people who like to sample new software.

You can see the current roster of available Labs by logging into your Gmail account, clicking the gear icon on the right side of the screen and selecting Settings from the menu. On the Settings screen, click the Labs tab to see what features are available and click the Enable button next to the ones you want to try out. Click the Save Changes button to turn on the selected Labs.

If you find a Labs add-on not to your liking, return to the Labs tab on the Settings screen, click the Disable button next to the one you want to turn off and click Save Changes. If something has gone horribly wrong and you cannot get your Gmail in-box to load, Google has a way to disable all your Labs at once: just use the address https://mail.google.com/mail/u/0/?labs=0 instead of your regular Gmail bookmark.

The Gmail Help site has more troubleshooting tips for Labs problems.

Gadgetwise Blog: Q&A: Cleaning Up Outdated Gmail Contacts

How can I get rid of old e-mail contact information? Gmail keeps offering these as suggested addresses every time I text or e-mail my family and friends, long after they’ve stopped using those accounts.

Each time you reply to or forward a message, Gmail automatically creates a new contact for those addresses that are not already in your Contacts list. While helpful in some situations, this feature can lead to outdated or unneeded entries that pile up quickly as suggested addresses for new messages.

To delete the unwanted addresses from the Contacts list, log into your Gmail account. Click the triangle next to the word “Gmail” on the left side of the page and select Contacts from the menu. (You can also go right to the Contacts page at google.com/contacts.)

When you land on the Contact Manager page, select the entries you want to delete from the list by turning on the checkboxes next to the names. Once you have the outdated addresses selected, click the More button at the top of the list and choose Delete Contacts from the menu. Google has more information about managing contacts (including removing them from Google Plus and from contact groups) on its site.

Gadgetwise Blog: Q&A: Logging Out of Gmail From Another Computer

I check my personal Gmail on the Web at work and sometimes forget to sign out of my account before I leave for the day. Is there a way to see if I left it on back at the office?

Gmail includes a feature that shows all your account activity on different computers and devices. Better yet, you can also use this tool to remotely sign out of any Gmail sessions on other computers and keep your account more secure.

To see your account activity, sign into Gmail on the Web from your home computer and scroll down to the bottom of the page. On the right side, you should see a line that says “Last account activity” and lists the most recent time mail was checked on your account, along with a Details link.

Click the Details link to open a page listing all your account activity on different computers and mobile devices, including the Internet addresses used and the times the account activity occurred. If you see other locations where your Gmail account is active, click the “Sign out of all other sessions” button to log out everywhere else.

Google introduced this ability to remotely sign out of your Gmail account a few years ago. For more information, check out the original post about the feature on the Gmail blog.

Gadgetwise Blog: Q&A: Extra Security for Gmail

I have read that I should turn on “two-step” authentication for my Gmail account to keep it safe from getting hacked. What is this and what do I do?

Google’s two-step verification (authentication) for Gmail users requires both your account password and a numeric code from Google sent to your mobile phone in order to log in. When you sign up for the extra verification step, you can choose to have the mobile code required each time you log in to your account, or just each time you log in from a new computer or device.

So even if someone swipes your Gmail password and tries to log into your account from his or her computer, the required verification code is still sent to your phone, which you hopefully still have in your possession. You can set up two-step verification in the security area of on your Gmail account settings page. Google has setup instructions on its site.

Bits Blog: Yahoo Breach Extends Beyond Yahoo to Gmail, Hotmail, AOL Users

SAN FRANCISCO — Another month, another major security breach.

Yahoo confirmed Thursday that about 400,000 user names and passwords to Yahoo and other companies were stolen on Wednesday.

A group of hackers, known as the D33D Company, posted online the user names and passwords for what appeared to be 453,492 accounts belonging to Yahoo, and also Gmail, AOL, Hotmail, Comcast, MSN, SBC Global, Verizon, BellSouth and Live.com users.

The hackers wrote a brief footnote to the data dump, which has since been taken offline: “We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call, and not as a threat.”

The breach comes just one month after millions of user passwords for LinkedIn, the online social network for professionals, were exposed by hackers who breached its systems. The breaches highlight the ease with which hackers are able to infiltrate systems, even at some of the most widely used and sophisticated technology companies.

Marcus Carey, a researcher at Rapid7, a security company found that among the data were some 106,000 Gmail e-mail addresses, 55,000 Hotmail e-mail addresses and 25,000 AOL e-mail addresses. Those e-mail accounts were not hacked; instead people had used their e-mail address as user names for a Yahoo service.

Sucuri, a company that checks for malware, set up a Web site, labs.sucuri.net/?yahooleak, that lets concerned users check if their account details were compromised in the breach.

Dana Lengkeek, a spokeswoman for Yahoo, said the compromised accounts belonged to Yahoo’s Contributor Network, and that fewer than 5 percent of the passwords posted were still valid.

Chris Gaither, a spokesman for Google, said Google immediately reset passwords for vulnerable Gmail accounts.

The hackers claimed to have stolen the passwords using a hacking technique called an SQL injection, which exploits a software vulnerability.

“We are fixing the vulnerability that led to the disclosure of this data, changing the passwords of the affected Yahoo users and notifying companies whose user accounts may have been compromised,” Ms. Lengkeek said in the statement.

Mr. Carey said it was unclear whether Yahoo’s breach had been contained and noted that hackers could still be inside its systems.

Computer security experts recommended that Yahoo users consider changing their passwords to other sites, as hackers tend to test those passwords across multiple sites.

They were quick to chastise Yahoo for allowing hackers such an easy way into its systems. “Why haven’t organizations like Yahoo got it yet? SQL injection is a known attack,” said Mark Bower, a vice president at Voltage Security. “If what is stated is true, it’s utter negligence to store passwords in the clear.”

Bits Blog: Yahoo Breach Extends Beyond Yahoo to Gmail, Hotmail, AOL Users

SAN FRANCISCO — Another month, another major security breach.

Yahoo confirmed Thursday that about 400,000 user names and passwords to Yahoo and other companies were stolen on Wednesday.

A group of hackers, known as the D33D Company, posted online the user names and passwords for what appeared to be 453,492 accounts belonging to Yahoo, and also Gmail, AOL, Hotmail, Comcast, MSN, SBC Global, Verizon, BellSouth and Live.com users.

The hackers wrote a brief footnote to the data dump, which has since been taken offline: “We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call, and not as a threat.”

The breach comes just one month after millions of user passwords for LinkedIn, the online social network for professionals, were exposed by hackers who breached its systems. The breaches highlight the ease with which hackers are able to infiltrate systems, even at some of the most widely used and sophisticated technology companies.

Marcus Carey, a researcher at Rapid7, a security company found that among the data were some 106,000 Gmail e-mail addresses, 55,000 Hotmail e-mail addresses and 25,000 AOL e-mail addresses. Those e-mail accounts were not hacked; instead people had used their e-mail address as user names for a Yahoo service.

Sucuri, a company that checks for malware, set up a Web site, labs.sucuri.net/?yahooleak, that lets concerned users check if their account details were compromised in the breach.

Dana Lengkeek, a spokeswoman for Yahoo, said the compromised accounts belonged to Yahoo’s Contributor Network, and that fewer than 5 percent of the passwords posted were still valid.

Chris Gaither, a spokesman for Google, said Google immediately reset passwords for vulnerable Gmail accounts.

The hackers claimed to have stolen the passwords using a hacking technique called an SQL injection, which exploits a software vulnerability.

“We are fixing the vulnerability that led to the disclosure of this data, changing the passwords of the affected Yahoo users and notifying companies whose user accounts may have been compromised,” Ms. Lengkeek said in the statement.

Mr. Carey said it was unclear whether Yahoo’s breach had been contained and noted that hackers could still be inside its systems.

Computer security experts recommended that Yahoo users consider changing their passwords to other sites, as hackers tend to test those passwords across multiple sites.

They were quick to chastise Yahoo for allowing hackers such an easy way into its systems. “Why haven’t organizations like Yahoo got it yet? SQL injection is a known attack,” said Mark Bower, a vice president at Voltage Security. “If what is stated is true, it’s utter negligence to store passwords in the clear.”