
Hacking a Google Apps account is easy, with apparently no limits in the number of attempts and no warnings from Google to the victim
It was not about just a weak password after all.
The reason why 300+ confidential documents were stolen from Twitter’s Google Apps account was actually because of Google’s totally insecure login process.
Don’t believe me? Just try login at docs.twitter.com as… say “ev” like in Evan Williams, Twitter’s co-founder (“biz” would be another alternative). Of course, unless you really know the password or use some sort of an automated password tool, you won’t get in.
So Google is secure, right?
Wrong! For Sophos security analyst Chet Wisniewski, the problem is actually as simple as the vulnerability is huge: Google will not throw you out after, let’s say 25 attempts guessing Ev’s password.
Actually, Google doesn’t even seem to impose any limits on fraudulous attempts – I couldn’t get this confirmed by Google who will not talk openly about its security process.
Worse, because of Google’s lack of security, Twitter’s co-founder wouldn’t even know that someone has tried to breach into his account. “Even my Linux machine will warn me when my wife tries unsuccessfully to login,” jokes Wisniewski.

It's mind-boggling that Google lets anyone try to reset the administrator password for Twitter's domain!
In the end, Google Apps is a security nightmare for its users as they have to totally rely on Google for all things security. “And because it’s in the cloud, there’s no way to prevent data leaking out, unless you opt for an on-premise version of Google Apps,” adds Jamz Yaneza, a threat research manager at Trend Micro.
And just for the fun of it, you can even reset the admin password for Twitter’s Google Apps domain. It’s that easy!
Google Apps needs security overall redesign before enterprises put confidential data
So does the TwitterGate means you shouldn’t leave your documents online? Well for McAfee, Trend Micro and Sophos security experts I talked to, enterprises should not put their most confidential documents online: it should be behind a firewall, and on the company’s servers.
However, in defense of Google’s security, 2-factor authentication solutions for its for fee Apps Premier edition are available from third-parties that will solve the weak password issue; which Twitter now uses.
But this should not prevent Google from redesigning it’s security process to fully protect all its Google Apps customers, as well as users of the company’s consumer apps.