There's an iOS device attached to my Google account and I own no Apple products
penguindreams.org
penguindreams.org
First verify you don't have an iPhone (or whatever) in your recently used devices: https://security.google.com/settings/security/activity
1. Open Chrome incognito window
2. Open devtools
3. Toggle device mode to iPhone (or whatever)
4. http://google.com
5. Log in
Occam's razor implies PEBKAC.
A changed user agent on a browser is pretty small, it wouldn't surprise me if Google didn't email for things like that.
That's what two factor authentication is for. And not emailing the same account for login notifications. I just don't find this to hard to believe.
In the article he states he uses his own email server, not gmail, so logging in to his google account wouldn't allow this.
And then moments later: "I currently don’t have two factor authentication."
Just seems like there's two people behind this post: one who is concerned about security and one who doesn't fully leverage tools to enhance their security.
Not ragging on the author. This just stuck out at me. I'm genuinely curious and would love a follow-up if author can discover what happened.
Edit: Assuming that someone only crafts 9-plus-character passwords that don't show up in dictionary attacks and aren't reused across sites, is 2FA going to secure that person much more? I'm not challenging 2FA. Actually, I'm just trying to motivate myself to use it.
Sites can log invalid password attempts, and unscrupulous sites could include attempted usernames and passwords. That basically gives them a dictionary of accounts to try, because let's face it, most people use the same password for multiple services. Sometimes people's muscle memory kicks in and they accidentally type their password into the wrong site, or the wrong field.
With Google's 2FA, you need access to either a pre-printed list of emergency codes, or the ability to see the person's incoming texts. That's where the "if done properly" caveat comes in. Google Voice is generally a bad idea. If someone accidentally gets into your email because you left it open, they also have access to your incoming texts.
I remembered the advice, but not the reason. It's because you can easily lock yourself out of any way to get your otp. So maybe it's too secure?
Mostly because I'm lazy and want to copy paste from hangouts on the computer.
I've run my own postfix/dovecot stack since 2004 and have never had the same problems, but a sample size of two is a poor pool to derive results out of. I wouldn't be surprised if their email server might have been configured as an open relay accidentally at one point, or even a neighbor on the same or near the same subnet been a flagrant source of spam. Coming from nothing, mail servers are somewhat hard to get running correctly and securely. Much more so than standing up Apache.
I would also like a follow up, as there seems to be a very skewed story, or some kind of information is missing about both of these situations.
Android doesn't use glibc.
why would I go over the hassle to see cat videos? the worst that can happen is someone steal my like or generate fake ad revenue.
not everyone have their life attached to a google account.
...or log in with an iOS device and freak you out, leading you to write a blog post about it.
This is a blog post about possibly unauthorized access to a Google account, pointing out the lack of 2FA is perfectly valid given the context.
2FA would have stopped that from happening. It doesn't matter what you use your Google account for. 2FA is a must.
The end.
From what I have seen assisting others with compromised Google accounts (most likely due to a phishing attack, but unconfirmed), emails that would give away the compromise are usually deleted---either manually or via a filter[1].
Sometimes these deleted mails can be retrieved because they not purged completely, but deleted mail does not show up in GMail search.
[1]: If you believe your account has been compromised, check your email filters, I've seen weird delete filters added to accounts.
"I currently do not have a Gmail account associated with my Google account"
Given that; I'm not sure any Gmail search settings or filters apply in this situation.
I wondered how someone could hack so easily. The passwords were not easy and I can not believe that anyone could guess that. I also checked the last access time in gmail and there were no suspicious activity there.