Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who is accessing your Gmail account?

antoniocangiano.com

Post reply on HN
Print view View original

31–40 of 52 posts

Re: Who is accessing your Gmail account?

#31

Post by allyt »

drivebyacct wrote: post #27
acangiano wrote: post #21

Earlier quoted context omitted.

I did specify that the IP address is not clearly associated with Etacts, though it turns out that it probably is them. However, that's not the point. My post is an an invitation of sorts to check one's Activity Window, plus my suggestions in terms of what steps can be taken when an intrusion is suspected. BTW, the tone of my post was not meant to be outrageous nor accusatory of Etacts. > Also, wiping your computer or…

Changing my password that I've given to a website hardly qualifies as "revoking access". I have no problem using my Google Account as a login mechanism when it's through oAuth or xAuth or whatever Google is using these days for that pass through, but the Facebook give-us-your-login-temporarily style stuff is unacceptable.

the Facebook give-us-your-login-temporarily style stuff is unacceptable

Agreed. IMO, asking for your password when there are API's readily available is alone enough to disqualify a company from being "trustworthy". Just the idea of keeping a bunch of GMail passwords in some decryptable database is quite a bit scary.

Re: Who is accessing your Gmail account?

#32

Post by drivebyacct »

acangiano wrote: post #30
drivebyacct wrote: post #27

Earlier quoted context omitted.

Changing my password that I've given to a website hardly qualifies as "revoking access". I have no problem using my Google Account as a login mechanism when it's through oAuth or xAuth or whatever Google is using these days for that pass through, but the Facebook give-us-your-login-temporarily style stuff is unacceptable.

Google actually gives you the ability to revoke access. It's under your Google account settings.

Not if you give your username and passwords to websites. I feel like you don't understand this distinction all up and down this thread...

Also, man, what is the point of DBANing your install? Is software that is no longer accessible to the OS or likely even any consumer level hardware going to magically log your keystrokes, I mean make you give your usernames and passwords to websites and then be surprised that they use them?

Re: Who is accessing your Gmail account?

#33

Post by 10ren »

TallGuyShort wrote: post #28
10ren wrote: post #24

For the last week or so, I've had a bunch of "Delivery to the following recipient failed permanently:" emails, for email that was apparently sent from my gmail account - I assumed that someone started using my return address for their spam. At about that time, gmail asked me to sign in with a CAPTCHA - I assumed that google had just added that. I use an older (faster) version of gmail on my (slower) netbook, which do…

Did you check your 'sent' folder, by any chance? If there are copies of the emails there, then most likely they simply accessed your account directly with your password - which is much more concerning (albeit easy to fix by changing all your passwords)

Whoa, thanks, I should thought of that! They sent one on the day of the access (10 June).

There are 17 other potential ones, but I had moved them to my spam folder, so I can't tell where they came from originally. Looking closer, the first email in each chain seems to come from my account, but they are spread over several days, not just the day of the access.

Unfortunately, they could have potentially accessed any other services whose "forgotten password" emails go to this one, and then deleted the replies. But it looks like an automated spam attack.

When I realized today, I now logged out all other users (there didn't seem to be any) and changed my password. Maybe I should check all my linked accounts.

EDIT The header of their email has:

    Received: from PC-201004061503 ([116.30.36.239])
Where that IP is the hacker's IP. Comparing with mail I've sent, the Received line includes my IP and "with HTTP". So it looks like they weren't using the web interface, but some direct one (IMAP? POP3?). If they're a spammer, it would be automated. BTW their emails all had the same content, most of them with the subject " 请在这里编辑主题...", which I'm guessing is "buy viagra" in Chinese.

Re: Who is accessing your Gmail account?

#35

Post by fierarul »

acangiano wrote: post #26
fierarul wrote: post #22

So after you are giving you email password to external websites you need to watch the Gmail Account Activity for suspicious access?

Correct. That's a reasonable thing to do. You sign up with a service you trust because it's convenient and useful to you (e.g., Etacts), and then you make sure that your trust isn't abused. You do the same with your credit card whenever you purchased from a site or in a store. You trust them, but then verify that you are not being screwed over.

Actually the correct thing would be not to give your email password to 3rd party website especially if you know will panic afterwards for every strange IP you'll see in your logs.

The credit card comparison doesn't really make sense as credit cards were especially designed to be used the way we use them.

Email accounts haven't been designed to be used in such a fashion as to allow 3rd party applications access them. Especially not the kind of email services where you don't have access to the server / firewall. What Google is providing is a nice thing but you only get the see the last 10 entries or so. What happens when you go on vacation ? What happens if you use some other email provider ?

My point is that the main conclusion of your blog post should be about how you control this but how you should avoid doing this in the first place.

Re: Who is accessing your Gmail account?

#36

Post by acangiano »

drivebyacct wrote: post #32
acangiano wrote: post #30

Earlier quoted context omitted.

Google actually gives you the ability to revoke access. It's under your Google account settings.

Not if you give your username and passwords to websites. I feel like you don't understand this distinction all up and down this thread... Also, man, what is the point of DBANing your install? Is software that is no longer accessible to the OS or likely even any consumer level hardware going to magically log your keystrokes, I mean make you give your usernames and passwords to websites and then be surprised that they…

>Not if you give your username and passwords to websites. I feel like you don't understand this distinction all up and down this thread...

I've never given my username and password directly to websites, except for Etacts. For the other sites, I simply authorized them (through the Google interface) to access certain functionalities. Behind the scenes Google doesn't provide them with my password: https://www.google.com/support/accounts/bin/answer.py?answer...

They also put such sites on a list of that is accessible from your account. You can remove sites from that list at any time.

> Also, man, what is the point of DBANing your install?

Yeah, that's sort of unrelated. I've been planning a clean install for a while.

> you give your usernames and passwords to websites and then be surprised that they use them?

When THEY use them? No. When someone else does, yes.

Anyway, we have beaten this horse to death many times over.

Re: Who is accessing your Gmail account?

#37

Post by studer »

TallGuyShort wrote: post #28
10ren wrote: post #24

For the last week or so, I've had a bunch of "Delivery to the following recipient failed permanently:" emails, for email that was apparently sent from my gmail account - I assumed that someone started using my return address for their spam. At about that time, gmail asked me to sign in with a CAPTCHA - I assumed that google had just added that. I use an older (faster) version of gmail on my (slower) netbook, which do…

Did you check your 'sent' folder, by any chance? If there are copies of the emails there, then most likely they simply accessed your account directly with your password - which is much more concerning (albeit easy to fix by changing all your passwords)

The alert mechanism looks for successful logins, not spam seen in the wild with his account as the sender, so yes, someone has definitely accessed his account...

Re: Who is accessing your Gmail account?

#40

Post by percept »

10ren wrote: post #24

For the last week or so, I've had a bunch of "Delivery to the following recipient failed permanently:" emails, for email that was apparently sent from my gmail account - I assumed that someone started using my return address for their spam. At about that time, gmail asked me to sign in with a CAPTCHA - I assumed that google had just added that. I use an older (faster) version of gmail on my (slower) netbook, which do…

That's happened to me several times. In my case I'm sure it was spamming (nothing sent, no account access other than my own, for an account with a single word name).
Post reply on HN