New answers tagged

2

Your case is documented in the Trillian Security Practices. The mobile device version of the software will store your Google password encrypted on the company servers of the Trillian developers. This allows them to keep your GoogleTalk session alive, even if your mobile device has bad connectivity. It also allows you to use the web version of the Trillian ...


1

Just having your GA ID isn't enough to compromise the site. There is the chance that the spambot is sending fake referrer information using your domain name, but that doesn't have anything to do with GA tracking code, and furthermore, it's out of your control even if they do. If this email didn't come from Google, like @Matthew said, I'd classify it as ...


0

Within the source of the page you linked, you can find the source CSS. As hinted by @Numeron, you will find this contains the following: #next-controls { margin-top: 20px; display: none; } I recommend opening this page in Chrome, using the Inspect feature, and toggling off/on the display: none; line in the CSS. Then, you will see for yourself the ...


23

As web developer, I agree with Andrew it all points that it was a developer's mistake. They probably password protected some of the resources required for some of the ads (for example, css, js, a font, an image, a json, etc). I tried with my gmail account and is also happening. The protected link is: https://googleads.g.doubleclick.net/pagead/drt/si?ogt=1&...


2

First of all if the domain name (the fully qualified domain name left of the rightmost period) isn't Google, I wouldn't log in. You should always look for the right most period. Once you hit a slash (/ or \), you have superceeded the domain name. not a dash or hyphen, that could be a part of exampledomain.com, etc. basically make sure it is Google, you can ...


1

As @fishy says, Google's first goal is to increase adoption. Anecdotally, it seems like a majority of people do not require a second factor of authentication for any of their accounts. SMS-based tokens can sometimes introduce too much of a delay, lead to charges for incoming messages and hence is thought to reduce usability of the system. TOTP requires the ...


1

Like the previous two-factor auth scheme, this assumes that you are in possession of your cell phone. Unlike the previous scheme, it doesn't require you to enter any numbers (6 digit security key) into to login. (Keep in mind that since the system hasn't been completely rolled out yet, there could be lots of other information about the security of the ...


1

It is not you logging in on this phone, it is (presumably) you logging in on another device. You get prompted to authorize the login on the other device. That's why the prompt also mentions the device. So now you get a simple yes or no pop-up, rather than a confirmation email, text or setting up a separate security key. In itself it's not more secure, but ...


8

It might be a (extremely poor) phishing attempt, or it might be just a misconfigured ad server (asking for the login and password due to .htaccess). Report it to Google (as they own both GMail and doubleclick). Don't panic. Changing password is probably not necessary, but I still recommend doing it it (you should change your paswords at least semi-...


16

This is an HTTP(S) Auth window. It looks like one a Google Ad is using it to ask for your Gmail credentials. However, there's no legitimate reason it would do so, especially over HTTP (unencrypted). You should report it to Google immediately.


70

This seems unlikely but not unthinkable. From the information in your question and the supplied screenshot, it seems that the Google ad domain was or currently is compromised. What todo now? Firstly, make sure that you have antivirus and anti-spyware software installed and that this software (including your operating system) is up-to-date. It is a good ...


2

You just canĀ“t. You could monitor internet traffic and be sure it is loading the google page, but still not be sure if it is showing the one they loaded. And also it could be the real page and still it is keylogging what you type. So: 1) Only type this kind of info on apps you trust; 2) Apps should probably do not require you to trust them, by letting ...


0

Giving an app your OAuth token is kind of like giving them a limited-use password. In this case it's a password they they can use to get into your Google Drive, but they can't use it to get into your Gmail. If you're not comfortable with the app saving that key to storage, then don't use that app. Also, you can review which OAuth tokens you've granted and ...


1

There's two sides here that some people may have confused. So let me keep them straight: First of all, your password for your Gmail account (your actual Google password) is hashed responsibly. I haven't seen the details published publicly anywhere, so instead I'll just say that the people responsible for this care about security and have a very thorough ...


6

If you look at the page source, there is a JavaScript function rwt() executed on onmousedown event. <a href="http://security.stackexchange.com/" onmousedown="return rwt(this,'','','','1','AFQjCNHano0MrEGop-Wp0eV_bNhmdh7OtQ','H4np7JuYNqsCuTIjB-78Eg','0ahUKEwjzldecwZfNAhWEVxoKHX8OAnwQFggdMAA','','',event)"> Information Security Stack Exchange</a>...



Top 50 recent answers are included