6

I received a confusing email from Google today. It had the subject 'Critical security alert' and the body said in part 'Google has become aware that someone else knows your password, and we've taken steps to protect your account.'

Apparently these are legitimate, and I've confirmed the links and message headers don't look like a phishing attempt.

Image: https://imgur.com/a/cvpfh3k

The odd thing is that the email address listed is not a Gmail address - it is an email associated with one of my web hosting accounts. We fetch mail from this account via POP3 into our Gmail account.

The text is unambiguous - they state plainly they know someone knows the password to this account. But how? Google has no special access to the account. They presumably have the plaintext copy of the password available for POP3 authentication, so if there was a data breach on this storage at google then I guess that's one way, but I'm coming up blank on anything else. And the text 'sign back in' sounds like they meant to send it for Gmail but I don't know how to ask them.

Even if my poor security hygiene meant a third party had access how would Google know?

Improve this question

1 Answer 1

Reset to default
7

Since Google has the password for the POP3 account it can check the common password dumps if the password is known publicly. They don't claim that somebody is actively using the password with your POP3 account, only that somebody knows it. And they urge you to change the password to protect your account.

Improve this answer
3
  • 1
    I suppose that is possible but I still find the phrasing very odd - what steps are they taking to 'protect my account'? Emails were still being retrieved the day after getting that message and my host confirms that no IPs but my own or Google's were accessing the mail server. The password in question was auto-generated by KeePass and not used elsewhere so it's possible it's in a public dump but very unlikely.
    – Nick P
    Feb 4, 2019 at 2:09
  • 1
    @NickP, Same experience, questions and feelings here. I went ahead and checked my password in public dump (and then changed it!) but it wasn't found. I find the whole thing kind of odd.
    – K. Meke
    Nov 11, 2020 at 13:43
  • @schroeder my deleted answer addressed the OPs 1st question: "The text is unambiguous - they state plainly they know someone knows the password to this account. But how?" (my bold). My answer also included rationale wrt. NIST 800-63B (see the other comments against this answer). I wasn't confident to edit Steffen Ullrich's answer to provide additional info, nor did I think it would be appropriate, as I addressesed more recent development in the Pwnd Passwords API. Feel free to delete this comment and I'll forget about it - I don't know any other way to respond.
    – brynk
    Nov 12, 2020 at 21:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.