Hot answers tagged

101

Email is historically considered insecure for two reasons: The SMTP network protocol is unencrypted unless STARTTLS is negotiated, which is effectively optional The mail messages sit unencrypted on the disk of the source, destination, and any intermediate mail servers Google mail servers all speak STARTTLS if possible, so for gmail-to-gmail the ...


77

From that link: Select a secured connection Check with your other mail service for their recommended port number and authentication type. Here are some common combinations: SSL with port 465 TLS with port 25 or 587 The difference, then, is that "SSL" means SMTP over SSL-or-TLS on port 465, and "TLS" means SMTP with STARTTLS on port ...


72

This seems unlikely but not unthinkable. From the information in your question and the supplied screenshot, it seems that the Google ad domain was or currently is compromised. What to do now? Firstly, make sure that you have antivirus and anti-spyware software installed and that this software (including your operating system) is up-to-date. It is a good ...


64

For smaller sites, you don't want to allow hackers to enumerate your user lists, but for Google, the site is so large, one can assume almost everyone has an account or several accounts. So, the risk is minimized after a threshold of ubiquity. It is still a good idea for most sites to not disclose whether a username exists, but the risk needs to be weighed ...


52

For your average home user, services like GMail (that are run over TLS) would not leak information like the username to the ISP or network administrator. If you're using a machine that is also administered by the LAN administrator (e.g., a work computer attached to a domain run by the company), then you have to assume they can read anything you do on it. ...


46

Jeff Atwood, when making the login for Discourse, had this to say on the subject: This was the source of a long discussion at Discourse about whether it made sense to reveal to the user, when they enter an email address in the "forgot password" form, whether we have that email address on file. On many websites, here's the sort of message you'll see after ...


40

First things first, change your password and make sure the new password is secure (10+ characters, a number somewhere other than the last character, a capital somewhere other than the first character, not an iteration on your past password, etc). This is good to do periodically anyway. GMail has tools for seeking suspicious account activity. Specifically, ...


36

For Gmail, you can determine whether an account exists simply by sending an email to an @gmail.com address. If it bounces, that account does not exist. This is true of many email providers. Here, usernames are not considered secret. If a user has the email address foo@example.com everybody knows that foo has an account at example.com with username foo@...


32

To complement @David's and @Steve's answers: If the attacker ("Adam", in your case) has administrative access to your machine, then he can learn all your secrets. Installing an extra root CA, under his control, to run routine MitM interception on your SSL connections is a popular tools for honest (but nosy) sysadmins: it is a one-time installation which won'...


32

For starters, that article misuses terminology. Whatever vulnerability they may be referring to it seems pretty blatant that it is not "brute force" as that would contradict the premise of that very sentence. As another answer suggested it's possible that some form of social engineering was employed, but in this case any rounds of "guessing" left would not ...


30

Since you didn't enter your second factor code from your phone, and since you didn't say that you received a text requesting the second factor, you should be safe. However, if you want to be sure that all bases are covered (or if you hadn't enabled 2 factor authentication), there are a few things to check to be sure that you haven't been compromised and ...


24

As web developer, I agree with Andrew it all points that it was a developer's mistake. They probably password protected some of the resources required for some of the ads (for example, css, js, a font, an image, a json, etc). I tried with my gmail account and is also happening. The protected link is: https://googleads.g.doubleclick.net/pagead/drt/si?ogt=1&...


24

Emails, sent through SMTP, have no way of "self-destructing" internally built in to them. They're basically just text files that hang around for eternity until all copies are manually deleted. The fact that you still have the email's headers is proof enough; if messages could self-destruct, their entry would be entirely removed from your mail client, as if ...


19

As David says, the provider of your network usually can't see data passed over https connections. However, your Gmail address is not necessarily passed only over https connections. For example, if you log into StackExchange using your secret Gmail account and visit the http (not https) version of your user profile page, then your Gmail address is sent to ...


19

I have now added this : v=spf1 include:_spf.google.com ~all The ~all at the end just causes a soft fail, that is that mail will still be delivered. If you want to have a permanent fail use -all. Of course this only affects mail server which check the SPF records, which are not all.


17

It is not possible to create a digital communication that will self-destruct after a certain amount of time (or upon sender's command). This because of the nature of the message, which once reaches the recipient' machine can be copied at will. This applies to email as well as instant messages. Therefore any service promising you messages that self-...


17

This is an HTTP(S) Auth window. It looks like a Google Ad is misconfigured. You should report it to Google immediately.


16

A lot of this hinges on what you mean by "insecure". Traditionally e-mail was considered an insecure transport as it was transferred over an unencrypted protocol (SMTP) and typically you had limited control over how the e-mail actually reached it's destination, so you wouldn't necessarily know about the security of the systems that it traversed. These ...


12

The hack preventing side is pretty much covered by the dual factor authentication that was recently introduced and the use of the "Always use HTTPS" setting (on by default in gmail) for accessing google, to avoid ssl-stripping attacks. Now, when you have a compromised account and want to claim it back, Google has a structured procedure to verify you are the ...


12

In the Snowden revelations it showed that the NSA had tapped into the fibre cables connecting Google's datacenters together. You can refer to the image below and make your own deductions about whether anything on Google's network is actually secure. They may have improved the situation since then, but it would be hard to prove to customers exactly what they'...


11

There are three possibilities that I see: honest mistake. John Q. Samenameasyourparents set up an account, came up with your parents' name, was warned by Google and suggested "...51" as an alternative, blindly clicked "Yes, yes" without reading, re-entered your parents' account as backup address (never do that), and thus created an "orphan" account he will ...


10

No, they can only see the encrypted traffic flowing from yourself to Google's servers. They cannot see the actual content of the traffic (your emails). However, if your ISP forces you through a web proxy and makes you use their certificate, they could then see the content of your traffic. I would be cautious if you see untrusted certs when going to gmail....


9

I'm sure that rule developed in the days of 'big iron', when all accounts were on big corporate or government systems. Since the system doled out the account names, the use of a sign-up page to look for account names wasn't an issue. Thus, keeping the list of account names was feasible & useful. Now that we're dealing with self-sign-up sites, it is ...


9

Self destructing emails, like email read receipts and mail services which tell you they can tell you which recipients have read your message and which have not are at best misleading and at worse a con perpetrated on ignorant managers, executives and uses who don't understand how email works. In general, all of these schemes rely on the recipient buying ...


9

Unfortunately, this seems to be a poorly done configuration on the school's part. I also have a Gmail account managed by the school that is tied to the school's SSO. The only thing you can do is talk to your school's IT department, and hopefully they will fix their mistake. In the mean time, enabling 2-factor sign-on will protect your account from ...


9

From the mail it looks like they are sending from a google account, circumenting the SPF record.Misread the respective headers. It's not the case My recommendation would be to roll out DMARC and DKIM. This allows you to ask the receiving servers to discard or quarantine mail if it wasn't sent and signed by your server. I don't know if DKIM is possible ...


9

I think this is a very novel way to send spam. The gmail account listed basically has set some ad text as their display name and you as the backup email. This can be done very quickly via APIs and will obviously trigger Google to send you an email from their domain (which most spam filters will trust). No doubt Google will quickly ban the account/API key, ...


8

Knowing which username exists or not is not important, because an attacker can also check it from the sign up page. Google does not allow that an attacker runs an attack like brute force attack for obtaining a username list.


8

There's a more important reason for prompting for username first and then prompting for password: it allows Google to offer a different UI for accounts that are using passwordless authentication or other experimental login mechanisms without revealing beforehand which accounts are using it. It's similar to how Google's 2Factor auth UI isn't displayed until ...


8

It is more likely that your email address is being spoofed than your account is actually hacked, though either is a possibility. Spoofer scenario: Because there are users from your contact list being sent emails from your account, it means that a spoofer likely got access to some of your emails and stole the recipient lists from them. They do this because ...


Only top voted, non community-wiki answers of a minimum length are eligible