Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I was recently checking my Recent Activity under the "Details" tab inside my Gmail inbox, and I noticed this IP Address, it's not my IP:
I proceeded to look up the IP and it's located in Mountain View California, can someone explain to me what is going on here?
What is going on here, specifically, and how could someone go about protecting their email?
I am assuming that using Gmail is the first thing that I should change in order to prevent this.
You can find a possible explanation on the Google Support pages regarding the "Recent Activity" option:
"If you're using Mail Fetcher with another Gmail account, a Google IP will appear; this is simply because the messages are being fetched through our servers."
Edit: To answer your comment:
I would not call Gmail insecure. For the average user, they are secure enough. If I would have to give an example of a really insecure email, that would be some companies that use their own mail servers that do not even encrypt their mail traffic. In that case, it's easy to sniff the whole mail traffic including passwords.
Gmail on the other hand is of course encrypting their mail traffic, and I'm sure they are protecting their servers well. Their gmail webapp is fairly complex, which always brings the risk of vulnerabilities, but they offer large amounts of money for everyone who can discover a vulnerability.
But often additional security is needed. First of all, when using regular e-mail, you can never be sure if the mail you received was really sent by the person from which it seems to have come. It's too easy to spoof an e-mail address. In order to fix that issue, you would have to digitally sign messages you send with your private key, and the person on the other side needs to have your public key in order to verify if the message really was send by you and if it was changed in transit. It sounds a bit complex, and that's one reason why most people do not use it. Using a similar method, using public and private keys, you can encrypt the content of the message so that only the intended person is able to decrypt it. A tool for signing/encrypting mail is called GPG.
If you are for example using Outlook to receive mails, it is also important to encrypt your pst file that contains all your mails. That means, you must also protect your data at rest. I said Google is encrypting mail traffic, but that is only for mails in transit. If you save the mails on your PC using Outlook, it's your responsibility to take care of the encryption for the data at rest.
