21–25 of 25 posts
See the current procedures and limitations: https://support.google.com/mail/answer/22370?hl=en
An unknown computer is still showing up as gaining access to my google account AFTER I have done all the typical sanitation events to my google account: changed password, disconnected all apps and services, and using 2-Step authentication (even only using the Authentication, not SMS).
When my account was compromised ~10 days ago, the first event in the attack was some service/app being connected to my gmail account. I regretfully did not screen shot the event (google only shows the last 10 login-events on the account).
I suspect some devious 3rd party app was installed/connected to my google account and is still by by-passing all of the 2-step authentication, and "disconnect all account" actions I have taken.
UPDATE: Here is URL/info where unknown computer is showing up: https://security.google.com/settings/u/0/security/activity
Any ideas? How the hell does one contact google on this?
Earlier quoted context omitted.
The difference between your example and the article's is that in the article's example the emails are signed with DKIM and SPF by google which marks them as legit emails vs your example which is not signed.
DKIM and SPF are intended only to authenticate the originating saver, not the actual user account from the originating saver. To my knowledge, there is no reliable mechanism (beyond PGP and the web of trust) for authenticating that a certain sender actually sent an email message.
Earlier quoted context omitted.
Doing work for somebody does not automatically grant you the right to compensation. He did this on his own accord, without petition from Google. Google has no obligation to pay him at all. The reason bug bounties exist is to reward hackers for reporting severe and/or difficult-to-find security issues, so that they don't publish it before it's fixed and so the company gets good PR. In this case, the bug was clearly no…
He did this on his own accord, without petition from Google. Google has no obligation to pay him at all. Well of course, but my reading of it is still that it's a damn shame he's getting nothing. Just because someone has no right to something doesn't necessarily mean they shouldn't get something.
Earlier quoted context omitted.
The difference between your example and the article's is that in the article's example the emails are signed with DKIM and SPF by google which marks them as legit emails vs your example which is not signed.
DKIM and SPF are intended only to authenticate the originating saver, not the actual user account from the originating saver. To my knowledge, there is no reliable mechanism (beyond PGP and the web of trust) for authenticating that a certain sender actually sent an email message.