0

I had a google suspicious activity warning four days ago triggered by logging in from a location I don't use often. I accepted the offer to view the activity and acknowledged that I recognized it. This normally makes the warning go away.

However in this instance every time I log back in over the last four days, I get a red warning bar at the top of a signed-in google page.

warning

When I click Review your recent activity I get the critical security alert box grayed out with a white box over it saying "You've already replied that you recognize this activity" followed by two options Change reply and OK.

Of course I click "OK" every time because I do not want to change my reply and risk the possibility of locking my account.

QUESTION: Does this behavior indicate that there is a further security issue that I'm unaware of? What would happen if I instead clicked Change reply? Right now I have two-factor turned off so I'm very concerned about getting locked out. Are there any further problems that I could look for somehow?

  • macOS & Chrome incognito mode

I should note that in the last weeks I received two dialogues from google when initiating a search, to verify that I was not a robot, due to "unusual traffic from (my) computer network". (also shown below)

That happened at a shared WiFi connection using a DSL line.


warning


warning


update:

Following AlphaD's comment to go to https://myaccount.google.com/security-checkup I found that there is an issue of a possible 2nd device being logged in.

myaccount security-checkup

Does this mean that for certain there is a Mac somewhere that's been logged in to my google account for 164 days without me knowing it? I haven't ever knowingly logged in on any other computer than my own computer.

I don't know how to check if this device is real or not.

However if I go to https://myaccount.google.com/security I only see one device:

myaccount security

closed as off-topic by multithr3at3d, Xander, MechMK1, Benoit Esnard, Rory Alsop Aug 15 at 13:39

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – multithr3at3d, Xander, MechMK1, Benoit Esnard, Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Would you happen to be using a VPN? – AlphaD Aug 9 at 5:38
  • @AlphaD no, just what's described. Thanks! – uhoh Aug 9 at 5:39
  • Not sure if it applies to your case but this question might help – AlphaD Aug 9 at 6:15
  • @AlphaD I've looked into that and there seems there is an issue. I've updated with further screen shots. – uhoh Aug 9 at 7:15
  • 2
    This is probably a question for Google support. – multithr3at3d Aug 9 at 20:51
2

Google suspicious activity warning persists for 4 days despite my confirming I recognize it

This behavior is intentional. If an attacker had gained access to your account, allowing the warning to be dismissed would allow the attacker to dismiss the warning before you were able to see it.

  • Very interesting, is this speculation, or do you have a source? It certainly does make some kind of sense. – uhoh Aug 10 at 8:01
1

QUESTION: Does this behavior indicate that there is a further security issue that I'm unaware of? What would happen if I instead clicked Change reply? Right now I have two-factor turned off so I'm very concerned about getting locked out. Are there any further problems that I could look for somehow?

That your google account notes suspicious traffic from your computer or network might be an indicator for automated usage of google search (e.g. if you built a tool to search a lot) or if you are using a vpn/tor and change ip/location during your sessions.

The other security issue you search for is having turned off two factor authentication. I'd suggest you turn that on. If you own a smartphone, use the Google Authenticator App to generate Timebased One Time Passwords (TOTP). You'll also get 10 backup codes you can use if you loose access to your device. So I'd suggest keeping them at a reasonably secure space (e.g. printed out under your mattress.

Afterwards, change your google account password and sign out of all devices - you'll need to login in to every device again, using the 2FA code generated from the app. This will make sure that you do not have anyone (ab)using your account.

  • Thanks for your answer. "...automated usage of google search... or if you are using a vpn/tor..." none of those apply to me or my computer, though they could possibly to other potential users of one of the WiFi connection points I use. As far as two factor is concerned, I won't be able to reactivate it for a few more weeks. – uhoh Aug 9 at 7:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.