Hot answers tagged

313 votes

How does Google know where I am?

Google uses BSSID information from your WLAN Access Point to get an approximation of where you are located, even with GPS and WiFi turned off. Taken from “How does Google Maps estimate my location ...
INV3NT3D's user avatar
  • 3,987
206 votes

How did "tech-supportcenter" phishers trick Google?

If displaying the wrong URL in the tooltip requires Javascript, how did tech-supportcenter get their Javascript onto the Google search results page? The scammers did not manage to inject JS into the ...
Arminius's user avatar
  • 44.7k
193 votes

How did Google know I looked something up?

Loading that page loads The reason Google can track ...
Hector's user avatar
  • 11k
126 votes

Why can't I share a one use code with anyone else?

They're not being precise because they don't have to, and precise language might confuse some users. They could say, for example, "You should not share unused codes that are less than an hour old ...
Ghedipunk's user avatar
  • 6,050
104 votes

Possible reason for displaying two different websites on single domain?

This is obviously a spamming or scamming site, either setup on purpose or a hacked legitimate site. If visited without Referer header it will show some seemingly innocent site: $ curl http://www....
Steffen Ullrich's user avatar
100 votes

How are one-time password generators like Google Authenticator different from having two passwords?

Passwords are revealed every time you use them: if you have two passwords and you type them into a fraudulent web form, they are both stolen. The shared secret can't be calculated from a single OTP (...
Esa Jokinen's user avatar
  • 18.9k
85 votes

Google account verification request

Google says it's not a security problem and that you don't have to worry. After investigation they issued a statement in the Google product forums: What happened? During routine maintenance [from 1pm ...
Arminius's user avatar
  • 44.7k
72 votes

What should I do about Gmail ad asking me for password?

This seems unlikely but not unthinkable. From the information in your question and the supplied screenshot, it seems that the Google ad domain was or currently is compromised. What to do now? ...
Bob Ortiz's user avatar
  • 6,635
69 votes

False 'Security alert' from Google - every login generates mails from '[email protected]'

I guess I receive those mails because I use a VPN (always same public IP) and some privacy plugins in Firefox. Yes, this is likely the reason. You use these plugins in order to prevent that the other ...
Steffen Ullrich's user avatar
63 votes

How does Google Authenticator work?

Working: Authenticator implements the Time-Based One-Time Password (TOTP) algorithm. It has the following ingredients: • A shared secret (a sequence of bytes) • An input derived from the current ...
Arjun Sunil Kumar's user avatar
58 votes

How does Google know where I am?

You disabled WiFi and GPS, but you still have cellular data turned on. That means that the phone is in communication with the local cell towers. Android uses cell tower geolocation to estimate your ...
John Deters's user avatar
  • 34.2k
56 votes

Are staggered roll outs of security patches bad?

Excellent question. Yes, your understanding is correct, as well as your rationale behind it. Staggering roll outs for new features often makes good sense. Staggering roll outs for security patches ...
End Anti-Semitic Hate's user avatar
54 votes

How is Google abused for DDoS attacks?

Most likely someone using Google's Cloud Platform (GCP). They have a page here where you can report abuse on their platform.
Dan's user avatar
  • 619
47 votes

What triggers Google's reCAPTCHA

Google tries to figure out if you are a bot or not. If it's in doubt, it serves you a CAPTCHA to check. Exactly how this is done is part of Google's secret sauce, and I don't think they will tell you. ...
Anders's user avatar
  • 65.5k
41 votes

How did "tech-supportcenter" phishers trick Google?

This is a common abuse in paid advertising (note the "Ad" icon at the tail of your left arrow). Advertisers want to track people who click on Google ads, partly to independently confirm Google's ...
Harper - Reinstate Monica's user avatar
36 votes

Why can't I share a one use code with anyone else?

It's to prevent social engineering attacks against you. Imagine, for example you logged into your two-factor gmail account on a shady public computer where a keylogger recorded your email address and ...
dr jimbob's user avatar
  • 39.3k
35 votes

How can I trust that this is Google?

How do I trust that I am typing my password for google You do not. Apps should allow you to do that through actual Safari browser in another window, where you can see the address bar.
Greendrake's user avatar
35 votes

Is authentication using Facebook/Google considered good practice?

I am quite sure that there are some sites which require you to login with your facebook/google account on their site (so the URL shown is not facebook/google). I am sure there are some desktop ...
Out of Band's user avatar
  • 9,293
33 votes

Does backing up WhatsApp on Google Drive expose messages?

You're confusing message integrity and security with secrecy. WhatsApp provides end to end encryption, meaning the message you send can only be read by the recipient and vice versa. This protects you ...
zzarzzur's user avatar
  • 1,132
33 votes

Is cloudflare injecting tracking code for PDF requests in browsers via the browser PDF plugin?

This is not about HTML. This is the HTML of Google Chrome, and Cloudflare controls the response HTTP headers, as it should, since it's the HTTP server responding to the request. The Report-To header ...
Denis's user avatar
  • 481
26 votes

Possible reason for displaying two different websites on single domain?

As Steffen Ullrich has said, the reason for displaying different website is different Referer header; the underlying server was compromised and configured to show different content based on header (e....
Luke's user avatar
  • 385
24 votes

What should I do about Gmail ad asking me for password?

As web developer, I agree with Andrew it all points that it was a developer's mistake. They probably password protected some of the resources required for some of the ads (for example, css, js, a font,...
lepe's user avatar
  • 2,194
24 votes

What is the point of restricting a google API key by HTTP referer?

All security measures are trade offs. Is the cost of the control worth more or less than the value of what is being protected, and how much more work does it force the attacker to do. A lock on your ...
JesseM's user avatar
  • 1,942
20 votes

Is cloudflare injecting tracking code for PDF requests in browsers via the browser PDF plugin?

No, this does not look like a security or privacy issue. It seems your PDF viewer is generating an <embed> element and is adding a non-standard headers attribute. This attribute seems to contain ...
amon's user avatar
  • 1,346
19 votes

Where to find Google Authenticator backup codes?

You need backup codes to "an account" not to Authenticator itself. Authenticator has one entry for each 2FA-enabled account of yourself - without needing an account for its own use. So the concept ...
Sas3's user avatar
  • 2,658
19 votes

How did Google know I looked something up?

While Hector's answer correctly explains how Google got to know the page you visited, the real answer to the OP: How did Google know I looked something up? Is They Don't In fact, no one is ...
Mario Trucco's user avatar
  • 1,559
18 votes

How can I access the certificate transparency logs?

You can get the base URLs of known CT log providers from, however if you try to access that base URL, you'll just get a 404, instead you need to ...
Lie Ryan's user avatar
  • 31.4k
17 votes

Possible reason for displaying two different websites on single domain?

Possible infection with malicious code known as (SEO Spam). That's why it is serving with title: <title>Cheap Cialis In Usa &#8212; Get Bonus Pills</title> Maybe it was hacked due to ...
Mirsad's user avatar
  • 10.2k
16 votes

What should I do about Gmail ad asking me for password?

This is an HTTP(S) Auth window. It looks like a Google Ad is misconfigured. You should report it to Google immediately.
dr_'s user avatar
  • 5,178

Only top scored, non community-wiki answers of a minimum length are eligible