1

Trying to connect to GoogleTalk from the Trillian app for Android (a universal instant messenger app), I got denied even with the correct password. Then Google e-mailed me saying that my password is compromised and that an access to my account was blocked from IP 74.201.35.40 (somewhere in the USA).

Does it mean the Trillian application is spoiled (trying to steal my Google account), or is it just poorly programmed so that it's their server that connects to Google rather than me? Or something else? Should I stop using the app?

  • Well in that case I probably shouldn't poke fun. Usually you wouldn't say an IT product has become spoiled, rather a food, or situation. Regardless, doing a whois on that IP shows it is owned by Cerulean Studios, the people who make Trillian. Was it the first time you tried using Trillian? Sounds like Trillian might not be a Google Trusted app. To check you can go in your google setting and check allow unverified apps and see if it works. – cremefraiche Feb 23 '16 at 22:14
  • @cremefraiche You can, I just need some hint that it's a joke, otherwise I'm confused.... – yo' Feb 23 '16 at 22:29
  • Yo, I think @cremefraiche was surprised at your choice of the word 'spoiled'. While not wrong, it is not a word that a native speaker would choose. Perhaps 'broken' or 'faulty' are more appropriate. – Neil Smithline Feb 23 '16 at 22:58
  • @NeilSmithline well, I should have said "unsafe" probably then. – yo' Feb 23 '16 at 23:02
  • Much better. At the end of his comment, Creme suggested you tweak your Google settings. – Neil Smithline Feb 23 '16 at 23:20
2

Your case is documented in the Trillian Security Practices. The mobile device version of the software will store your Google password encrypted on the company servers of the Trillian developers. This allows them to keep your GoogleTalk session alive, even if your mobile device has bad connectivity. It also allows you to use the web version of the Trillian application.

If you reset your Trillian password, then all your stored third-party credentials are lost, since they are encrypted with the lost password. This underlines their claim that third-party passwords are stored encrypted.

Given this setup, it is really the case that the Trillian company server connects to Google with your decrypted clear-text password. Google detects the company server as origin and blocks it if your other devices are far away from the U.S. (see comment by @cremefraiche).

To make GTalk work in Trillian on mobile devices, go to your Google Security Dashboard and mark the server as trustworthy for Google logins.

If you don't like this approach at all, stop using Trillian in the mobile and web version. Delete your Trillian account and change all passwords you ever entered into their application.

| improve this answer | |
  • Sounds like a good case for using an app password, as well, so you can simply revoke access to that password instead of changing your main account password if you stop using Trillian. – Ben Jun 22 '16 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.