Hot answers tagged

304

Google uses BSSID information from your WLAN Access Point to get an approximation of where you are located, even with GPS and WiFi turned off. Taken from “How does Google Maps estimate my location without GPS?”: Google and others like Apple and Skyhook build a Database which links WLAN BSSIDs to a geographic location. A BSSID is like the MAC address of a ...


204

If displaying the wrong URL in the tooltip requires Javascript, how did tech-supportcenter get their Javascript onto the Google search results page? The scammers did not manage to inject JS into the search results. That would be a cross-site scripting attack with much different security implications than misleading advertisement. Rather, the displayed ...


197

NOTE: I work at Google now. I didn't work there when I wrote this. This is my own opinion, not Google's. But it's the only opinion that makes any sense. It's also probably the most important think I've written on this site; you must understand this to understand what online privacy is. Advertisers use what information they have to try to best guess what ...


194

Loading that page loads https://www.googleadservices.com/pagead/conversion.js https://www.googletagmanager.com/gtm.js?id=GTM-WPPRGM https://stats.g.doubleclick.net/dc.js The reason Google can track you is that the website shares details of your visit with them - in this case via loading Google JavaScript code for their ads service. *To expand on this - ...


178

Google Authenticator supports both the HOTP and TOTP algorithms for generating one-time passwords. With HOTP, the server and client share a secret value and a counter, which are used to compute a one time password independently on both sides. Whenever a password is generated and used, the counter is incremented on both sides, allowing the server and client ...


172

It's not just about you. By forcing users to use TLS, they're creating a more secure environment for everyone. Without TLS being strictly enforced, users are susceptible to attacks such as sslstrip. Essentially, making unencrypted connections an option leads to the possibility of attackers forcing users into unencrypted connections. But that's not all. ...


130

Your password was not stolen. As you pointed out, Opera Mini uses proxy servers. Per the link provided in thexacre's answer, Google incorrectly identifies the servers as being in Nairobi, Kenya: When you use Opera Mini, you're connected to Opera servers, which download websites you want, compress and transform them, and at the end they are sent to ...


127

They're not being precise because they don't have to, and precise language might confuse some users. They could say, for example, "You should not share unused codes that are less than an hour old with anyone else and no one from Google will ever ask for this code." You and I would know what they mean. My father in law and grandpa won't know why, though. ...


121

A lone password is not necessarily verifiable by itself. In particular, if the server does things properly, then it stores not the passwords themselves, but the output of a password hashing function computed over the password. A password hashing function (as opposed to a mere hash function) includes some extra features, including a salt (for very good ...


105

This may be a case of "do what I say, not what I do". Note that Chrome complains about use of SHA-1 for signing certificates whose validity extends beyond the end of year 2015. In this case, Google's certificate is short-lived (right now, the certificate they use was issued on June 3rd, 2015, and will expire on August 31st, 2015) and thus evades Chrome's ...


103

This is obviously a spamming or scamming site, either setup on purpose or a hacked legitimate site. If visited without Referer header it will show some seemingly innocent site: $ curl http://www.circaventures.com ... <title>Circa Ventures | helping you close the loop</title> If visited with a Referer from a search engine it will show spam: $ ...


98

Passwords are revealed every time you use them: if you have two passwords and you type them into a fraudulent web form, they are both stolen. The shared secret can't be calculated from a single OTP (or even from a set of them**), so a stolen OTP is only valid for limited time. The shared secret is never transferred during the authentication, so stealing it ...


95

You should assume that they can. There are various ways they can do it, but whether they actually do it depends on company's standards and practices. Some of the options: It's possible to install additional root certificates on company's machines and use that to MITM all the traffic (traffic goes through company's gateway/proxy anyway, and having friendly ...


94

You can change your Google Ads Preferences by visiting http://www.google.com/ads/preferences/. This includes changing your interests, demographics, or opting out of having personalized targeted advertising in general. You can check if opting out was successful by verifying that the web history list at the Google opt-out page is empty. You need to allow ...


90

Let me rephrase your question with a few extra details, which are implicit but maybe not obvious to everybody: "Isn't Google being Evil by providing me with a free email service and gigabytes of storage and forcing me into a secure connection when I access that service which they have generously granted to me and that nobody forces me to use even if I don't ...


85

Google says it's not a security problem and that you don't have to worry. After investigation they issued a statement in the Google product forums: What happened? During routine maintenance [from 1pm to midnight PST yesterday], a number of users were signed-out from their Google accounts. This may have resulted in you being signed out of your ...


83

For one thing the server would not know if the password alone matched any accounts. In a secure system, passwords are salted and then hashed. In a simplistic demo, suppose I had three users: Username Password bob foobar alice foobar maggie foobar When these passwords are set, a salt is added and a hash is generated: Username Salt ...


72

This seems unlikely but not unthinkable. From the information in your question and the supplied screenshot, it seems that the Google ad domain was or currently is compromised. What to do now? Firstly, make sure that you have antivirus and anti-spyware software installed and that this software (including your operating system) is up-to-date. It is a good ...


70

I guess I receive those mails because I use a VPN (always same public IP) and some privacy plugins in Firefox. Yes, this is likely the reason. You use these plugins in order to prevent that the other side can detect that you are the same user on the same device as the previous time. And that's exactly what the mail from Google says: it detected a login from ...


56

Excellent question. Yes, your understanding is correct, as well as your rationale behind it. Staggering roll outs for new features often makes good sense. Staggering roll outs for security patches rarely is a good idea. As you pointed out, this gives even more opportunity for the vulnerabilities to be exploited. Perhaps even more importantly, the ...


56

You disabled WiFi and GPS, but you still have cellular data turned on. That means that the phone is in communication with the local cell towers. Android uses cell tower geolocation to estimate your current location. Each cell tower has a set of ID numbers that identifies them to the phones. It broadcasts its identity constantly so that phones can connect ...


48

Google has access (obviously). The police will have access if they have a valid search warrant. A national security letter will give the FBI secret access. Various three-letter agencies may have access, depending on how they're doing at circumventing Google's encryption. (Google started encrypting its internal traffic after it was revealed that the NSA was ...


48

In my understanding, "less secure apps" refers to applications that send your credentials directly to Gmail. Lots of things can go wrong when you give your credentials to third party to give to the authentication authority: the third party might keep the credentials in storage without telling you, they might use your credentials for purposes outside the ...


48

Google Drive is no more or less safe than any other web-based service with a single logon. Your company must decide for itself whether it is willing to put the data online (albeit behind Google's authentication) At the very least, I'd recommend that 2-factor authentication is used Any data travelling outside the organisation is encrypted. Google Drive is ...


45

Seeing as you're using Opera Mini this is a likely explanation: Unlike straightforward web browsers, Opera Mini fetches all content through a proxy server and reformats web pages into a format more suitable for small screens. https://en.wikipedia.org/wiki/Opera_Mini Of course it's difficult to be certain, and 2FA is still vulnerable to certain ...


43

Google tries to figure out if you are a bot or not. If it's in doubt, it serves you a CAPTCHA to check. Exactly how this is done is part of Google's secret sauce, and I don't think they will tell you. But here are some ingredients I guess that they mix together: Your IP: Has it been identified as a bot already? Is it a Tor exit node? The resources you load: ...


42

This is a common abuse in paid advertising (note the "Ad" icon at the tail of your left arrow). Advertisers want to track people who click on Google ads, partly to independently confirm Google's click billing, and partly to give away free cookies. So they request search engines to send users to a ClickURL which does that, and then forwards to the proper ...


39

First things first, change your password and make sure the new password is secure (10+ characters, a number somewhere other than the last character, a capital somewhere other than the first character, not an iteration on your past password, etc). This is good to do periodically anyway. GMail has tools for seeking suspicious account activity. Specifically, ...


38

If you consent, Firefox gathers information about nearby wireless access points and your computer’s IP address. Then Firefox sends this information to the default geolocation service provider... https://www.mozilla.org/en-US/firefox/geolocation/ Firefox knows the IP address, which is used to connect to the VPN provider. Many geolocation services, however, ...


37

Working: Authenticator implements the Time-Based One-Time Password (TOTP) algorithm. It has the following ingredients: • A shared secret (a sequence of bytes) • An input derived from the current time • A signing function Shared Secret : The shared secret is what you need to obtain to set up the account on your phone. Either you take a photo of a QR code ...


Only top voted, non community-wiki answers of a minimum length are eligible