The common security options to avoid this horror scenario are a secondary email and a security question that can be used to recover a Google account. Google users from the United States have another option at their disposal which has been added recently to Google: The ability to recover an account password by a SMS that is send to a cell phone.

The option is currently only visible to US visitors. The Googlesystem blog suggested to use a US proxy server so that the option would become visible to users from other countries as well. I personally would not be using a proxy server to log into important web account. The possibility is there however and you can check out their blog post for some pointers. It is apparently possible to select another country from the list which makes it strange why they are not enabling the option for all users.

Users from the US or those using a US based proxy can open the Google Accounts page to enter a cell phone number as an additional method of restoring a Google account. It is likely that Google will roll out the feature soon for other countries as well.

Dustin Brooks reverse engineered the program and discovered the plain text username and password of the software developer. He was wondering why someone put his own mail information in the source code and discovered that the user’s username and password would be send to that Gmail account.

With the login credentials at hand he decided to investigate further and logged into the Gmail account of John Terry only to find out that the Inbox had 1777 messages each containing usernames and passwords of users of the software.

If you have been using G-Archiver make sure you change your password immediately and report the incident to the online store where you made the purchase. It would not be bad to contact Google as well because they are probably the ones with the best information to catch the guy.

via [Coding Horror, thanks to Dante for the tip]