Hot answers tagged

103 votes
Accepted

Is gmail-to-gmail still insecure? Why?

Email is historically considered insecure for two reasons: The SMTP network protocol is unencrypted unless STARTTLS is negotiated, which is effectively optional The mail messages sit unencrypted on ...
user avatar
  • 71.9k
85 votes
Accepted

Why does Gmail (add accounts) using SMTP server recommend SSL instead of TLS?

From that link: Select a secured connection Check with your other mail service for their recommended port number and authentication type. Here are some common combinations: SSL ...
user avatar
  • 11.3k
72 votes
Accepted

What should I do about Gmail ad asking me for password?

This seems unlikely but not unthinkable. From the information in your question and the supplied screenshot, it seems that the Google ad domain was or currently is compromised. What to do now? ...
user avatar
  • 6,234
67 votes

New Gmail login system—going against conventional wisdom?

For smaller sites, you don't want to allow hackers to enumerate your user lists, but for Google, the site is so large, one can assume almost everyone has an account or several accounts. So, the risk ...
user avatar
  • 123k
53 votes
Accepted

Is there any way for my ISP or LAN admin to learn my Gmail address as a result of me logging into Gmail's web interface through via their network?

For your average home user, services like GMail (that are run over TLS) would not leak information like the username to the ISP or network administrator. If you're using a machine that is also ...
user avatar
  • 15.8k
52 votes

How is it possible for boss to know I am finding a job?

Your boss is likely making assumptions. They can't read your messages on LinkedIn (unless you have your inmails forwarded to your work email and your company is monitoring your inbox....unlikely) The ...
user avatar
50 votes

New Gmail login system—going against conventional wisdom?

Jeff Atwood, when making the login for Discourse, had this to say on the subject: This was the source of a long discussion at Discourse about whether it made sense to reveal to the user, when they ...
user avatar
  • 2,391
41 votes

How to prove my Gmail has been hacked?

First things first, change your password and make sure the new password is secure (10+ characters, a number somewhere other than the last character, a capital somewhere other than the first character, ...
user avatar
  • 9,428
36 votes

New Gmail login system—going against conventional wisdom?

For Gmail, you can determine whether an account exists simply by sending an email to an @gmail.com address. If it bounces, that account does not exist. This is true of many email providers. Here, ...
user avatar
32 votes

Is there any way for my ISP or LAN admin to learn my Gmail address as a result of me logging into Gmail's web interface through via their network?

To complement @David's and @Steve's answers: If the attacker ("Adam", in your case) has administrative access to your machine, then he can learn all your secrets. Installing an extra root CA, under ...
user avatar
  • 169k
32 votes
Accepted

How is Gmail susceptible to brute-force attacks?

For starters, that article misuses terminology. Whatever vulnerability they may be referring to it seems pretty blatant that it is not "brute force" as that would contradict the premise of that very ...
user avatar
  • 1,334
30 votes
Accepted

Fell for phishing scam. Is my gmail account with 2-step verification vulnerable?

Since you didn't enter your second factor code from your phone, and since you didn't say that you received a text requesting the second factor, you should be safe. However, if you want to be sure ...
user avatar
  • 1,418
24 votes

What should I do about Gmail ad asking me for password?

As web developer, I agree with Andrew it all points that it was a developer's mistake. They probably password protected some of the resources required for some of the ads (for example, css, js, a font,...
user avatar
  • 2,184
24 votes

How can I determine (as a layman) if an E-mail was set to self destruct?

Emails, sent through SMTP, have no way of "self-destructing" internally built in to them. They're basically just text files that hang around for eternity until all copies are manually deleted. The ...
user avatar
  • 5,724
20 votes
Accepted

How is it possible for boss to know I am finding a job?

Your employer is possibly using a service like "Keeper" from HiQ Labs, which can provide forward-looking attrition risk analysis based on LinkedIn data. Keeper analyses LinkedIn user data ...
user avatar
  • 316
19 votes

Is there any way for my ISP or LAN admin to learn my Gmail address as a result of me logging into Gmail's web interface through via their network?

As David says, the provider of your network usually can't see data passed over https connections. However, your Gmail address is not necessarily passed only over https connections. For example, if ...
user avatar
  • 2,008
19 votes

Somebody is spoofing my email to send spam messages, and I have no idea how to block

I have now added this : v=spf1 include:_spf.google.com ~all The ~all at the end just causes a soft fail, that is that mail will still be delivered. If you want to have a permanent fail use -all. Of ...
user avatar
18 votes
Accepted

How to detect self destructing emails? How to prevent from self destruction?

It is not possible to create a digital communication that will self-destruct after a certain amount of time (or upon sender's command). This because of the nature of the message, which once reaches ...
user avatar
  • 5,060
17 votes

Is gmail-to-gmail still insecure? Why?

A lot of this hinges on what you mean by "insecure". Traditionally e-mail was considered an insecure transport as it was transferred over an unencrypted protocol (SMTP) and typically you had ...
user avatar
  • 60.8k
16 votes

What should I do about Gmail ad asking me for password?

This is an HTTP(S) Auth window. It looks like a Google Ad is misconfigured. You should report it to Google immediately.
user avatar
  • 5,060
14 votes

Is gmail-to-gmail still insecure? Why?

In the Snowden revelations it showed that the NSA had tapped into the fibre cables connecting Google's datacenters together. You can refer to the image below and make your own deductions about whether ...
user avatar
  • 663
12 votes
Accepted

Can my ISP read my gmail even when using HTTPS? Is there a way to prevent that?

No, they can only see the encrypted traffic flowing from yourself to Google's servers. They cannot see the actual content of the traffic (your emails). However, if your ISP forces you through a web ...
user avatar
  • 136
12 votes
Accepted

How is it possible that this spam mail came from Google Forms without revealing their sender address?

The spammer in question is abusing a Google Forms feature called Response Receipts. If you create a Google form and turn on response receipts, then whenever anybody fills in and submits the form, a ...
user avatar
  • 10.8k
11 votes
Accepted

Imitation Gmail account created - what's the threat?

There are three possibilities that I see: honest mistake. John Q. Samenameasyourparents set up an account, came up with your parents' name, was warned by Google and suggested "...51" as an ...
user avatar
  • 22.5k
10 votes

New Gmail login system—going against conventional wisdom?

I'm sure that rule developed in the days of 'big iron', when all accounts were on big corporate or government systems. Since the system doled out the account names, the use of a sign-up page to look ...
user avatar
  • 201
10 votes

New Gmail login system—going against conventional wisdom?

There's a more important reason for prompting for username first and then prompting for password: it allows Google to offer a different UI for accounts that are using passwordless authentication or ...
user avatar
  • 101
10 votes

How to detect self destructing emails? How to prevent from self destruction?

Self-destructing emails, like email read receipts and mail services which tell you they can tell you which recipients have read your message and which have not, are at best misleading and at worse a ...
user avatar
  • 3,242
10 votes

Someone shared their google account with me, am I vulnerable?

Google login works in a very not mysterious way. You log into google, and your device remembers it's logged into google. If you have multiple accounts on your device, then you have multiple accounts ...
user avatar
9 votes

New Gmail login system—going against conventional wisdom?

Knowing which username exists or not is not important, because an attacker can also check it from the sign up page. Google does not allow that an attacker runs an attack like brute force attack for ...
user avatar
  • 2,694
9 votes
Accepted

Gmail lets me use my old password

Unfortunately, this seems to be a poorly done configuration on the school's part. I also have a Gmail account managed by the school that is tied to the school's SSO. The only thing you can do is talk ...
user avatar
  • 4,737

Only top scored, non community-wiki answers of a minimum length are eligible