Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who is accessing your Gmail account?

antoniocangiano.com

Post reply on HN
Print view View original

21–30 of 52 posts

Re: Who is accessing your Gmail account?

#21

Post by acangiano »

andreyf wrote: post #19

Am I missing something here? From their website, it looks pretty clear that Etacts advertises checking your e-mail to remind you to keep in touch with people. Just like I wouldn't be surprised that Mint.com accesses my bank account online, this is hardly as outrageous as he makes it seem. Also, wiping your computer or using 1Password isn't going to stop you from giving your password to random web apps...

I did specify that the IP address is not clearly associated with Etacts, though it turns out that it probably is them. However, that's not the point. My post is an an invitation of sorts to check one's Activity Window, plus my suggestions in terms of what steps can be taken when an intrusion is suspected. BTW, the tone of my post was not meant to be outrageous nor accusatory of Etacts.

> Also, wiping your computer or using 1Password isn't going to stop you from giving your password to random web apps...

I'm not incautious with my password in the least. It's generally not hazardous to sign in with Google elsewhere, provided you trust the site. You can make an assessment of the risks and benefits of singing in through your Google account yourself on a site-by-site basis. If you have reason to believe that they've violated your trust or that a security breach has happened, you can revoke access (from that site) and change your password (or even decide to be paranoid and never login elsewhere again).

Re: Who is accessing your Gmail account?

#23

Post by jonknee »

acangiano wrote: post #20
jonknee wrote: post #8

If you're concerned enough about email privacy that you're going to wipe your computers for keyloggers, why in the world would you ever grant a SaaS access? That's just asking for trouble.

I trusted the SaaS applications I signed up with. One of them is used by the jQuery team, another one has just been acquired by Twitter, and the last one is a YC startup. I wasn't exactly tossing my password around. When evidence of a possible intrusion emerged, I revoked access (from those apps) and took steps to prevent a worst case scenario.

You gave your password to several companies and then freaked out when your account got accessed and assumed that someone camping outside your house must have cracked your WiFi connection and decided to wipe your computers while hardwired into your internet connection... I think Occam's razor applies here and the account was accessed by someone you gave the password to, though your paranoia is amusing.

It's pretty simple to keep someone out of your email, don't give anyone the password.

Re: Who is accessing your Gmail account?

#24

Post by 10ren »

For the last week or so, I've had a bunch of "Delivery to the following recipient failed permanently:" emails, for email that was apparently sent from my gmail account - I assumed that someone started using my return address for their spam. At about that time, gmail asked me to sign in with a CAPTCHA - I assumed that google had just added that.

I use an older (faster) version of gmail on my (slower) netbook, which doesn't have the "account activity" link. After reading this article, I switched versions and checked: 6 days ago, there was an alert about an access from China with this IP: 116.30.36.239

The emails in question have stopped for the last couple of days. It seems that google automatically detected and solved the problem, without me even being aware of it. Good google.

Re: Who is accessing your Gmail account?

#25

Post by acangiano »

jonknee wrote: post #23
acangiano wrote: post #20

Earlier quoted context omitted.

I trusted the SaaS applications I signed up with. One of them is used by the jQuery team, another one has just been acquired by Twitter, and the last one is a YC startup. I wasn't exactly tossing my password around. When evidence of a possible intrusion emerged, I revoked access (from those apps) and took steps to prevent a worst case scenario.

You gave your password to several companies and then freaked out when your account got accessed and assumed that someone camping outside your house must have cracked your WiFi connection and decided to wipe your computers while hardwired into your internet connection... I think Occam's razor applies here and the account was accessed by someone you gave the password to, though your paranoia is amusing. It's pretty sim…

First, I'm not freaking out, nor am I paranoid. I clearly stated that I believe that the most likely explanation is to be found with the reputable applications I granted access to.

Of course if I suspect an intrusion, I'm going to ensure that proper action is taken to cover all of my bases. I was planning a cleanup of my laptop anyway, so I may as well do it now.

Don't read too much into my changing the password on a wired desktop. It was one of the computers at hand, so I went with the most secure option, however unlikely it may be to make a difference (doing so didn't require any extra effort on my part).

> It's pretty simple to keep someone out of your email, don't give anyone the password.

This will be a moot point when Google will implement OAuth for IMAP.

PS: At this point, I believe it was a legitimate access by Etacts.

Re: Who is accessing your Gmail account?

#26

Post by acangiano »

fierarul wrote: post #22

So after you are giving you email password to external websites you need to watch the Gmail Account Activity for suspicious access?

Correct. That's a reasonable thing to do. You sign up with a service you trust because it's convenient and useful to you (e.g., Etacts), and then you make sure that your trust isn't abused.

You do the same with your credit card whenever you purchased from a site or in a store. You trust them, but then verify that you are not being screwed over.

Re: Who is accessing your Gmail account?

#27

Post by drivebyacct »

acangiano wrote: post #21
andreyf wrote: post #19

Am I missing something here? From their website, it looks pretty clear that Etacts advertises checking your e-mail to remind you to keep in touch with people. Just like I wouldn't be surprised that Mint.com accesses my bank account online, this is hardly as outrageous as he makes it seem. Also, wiping your computer or using 1Password isn't going to stop you from giving your password to random web apps...

I did specify that the IP address is not clearly associated with Etacts, though it turns out that it probably is them. However, that's not the point. My post is an an invitation of sorts to check one's Activity Window, plus my suggestions in terms of what steps can be taken when an intrusion is suspected. BTW, the tone of my post was not meant to be outrageous nor accusatory of Etacts. > Also, wiping your computer or…

Changing my password that I've given to a website hardly qualifies as "revoking access". I have no problem using my Google Account as a login mechanism when it's through oAuth or xAuth or whatever Google is using these days for that pass through, but the Facebook give-us-your-login-temporarily style stuff is unacceptable.

Re: Who is accessing your Gmail account?

#28

Post by TallGuyShort »

10ren wrote: post #24

For the last week or so, I've had a bunch of "Delivery to the following recipient failed permanently:" emails, for email that was apparently sent from my gmail account - I assumed that someone started using my return address for their spam. At about that time, gmail asked me to sign in with a CAPTCHA - I assumed that google had just added that. I use an older (faster) version of gmail on my (slower) netbook, which do…

Did you check your 'sent' folder, by any chance? If there are copies of the emails there, then most likely they simply accessed your account directly with your password - which is much more concerning (albeit easy to fix by changing all your passwords)

Re: Who is accessing your Gmail account?

#29

Post by David »

yanw wrote: post #9
maigret wrote: post #2

At least the Gmail access overview is a nice feature, far from being universal for all webmail providers. Every provider should have it.

They've also recently added suspicious activity alerts depending of geographic regions which I though was a nice touch: http://gmailblog.blogspot.com/2010/03/detecting-suspicious-a...

A very nice touch. About a month ago, I got an alert that my account had been accessed from China... Never would have known I was at risk otherwise.

Re: Who is accessing your Gmail account?

#30

Post by acangiano »

drivebyacct wrote: post #27
acangiano wrote: post #21

Earlier quoted context omitted.

I did specify that the IP address is not clearly associated with Etacts, though it turns out that it probably is them. However, that's not the point. My post is an an invitation of sorts to check one's Activity Window, plus my suggestions in terms of what steps can be taken when an intrusion is suspected. BTW, the tone of my post was not meant to be outrageous nor accusatory of Etacts. > Also, wiping your computer or…

Changing my password that I've given to a website hardly qualifies as "revoking access". I have no problem using my Google Account as a login mechanism when it's through oAuth or xAuth or whatever Google is using these days for that pass through, but the Facebook give-us-your-login-temporarily style stuff is unacceptable.

Google actually gives you the ability to revoke access. It's under your Google account settings.
Post reply on HN