10

I received Google's "Suspicious sign in prevented" email, and verified that it is legitimate, and this is definitely not my login attempt. I immediately changed my Google password, however, the email is very light on details, and it is not clear whether my password was in fact compromised, or someone just tried to login with a wrong password (e.g. nothing to worry about).

My Google password is not guessable, not used anywhere else, not written anywhere, not known to anyone else, so if someone knows it this means I've got a keygen or some other malware on one of my computers.

So, does anybody know what Google's tried to use an application to sign in to your Google Account actually means? What kind of a credential (password, OAuth token, etc.) was compromised, if any?

Improve this question
7
  • I'd assume that they used your e-mail but got the password wrong and as it was also from a different IP it would generate the warning. However, that's just guesswork.
    – ChrisF ♦
    Jan 29, 2013 at 23:25
  • @ChrisF: I tried that: Trying to log in into my own account via proxy with a wrong password does not generate any warning email for me (this does not prove anything, of course).
    – haimg
    Jan 29, 2013 at 23:28
  • Maybe they tried multiple times in a short while.
    – ChrisF ♦
    Jan 29, 2013 at 23:29
  • 1
    Note that Google probably won't be too forthcoming about your question (when it comes to security, less is usually more). IMO you've taken the right after-measures. You might also want to consider Google 2-step verification: support.google.com/accounts/bin/…
    – Dave Clausen
    Jan 30, 2013 at 2:39
  • 2
    @DaveClausen: I'm convinced this is a true break-in attempt, it's not a false alarm. Problem is, if my password is known to someone else, then these measures are not nearly good enough, I have a much deeper and wider problem since the only way the password could have been stolen is via some kind of malware. And I cannot understand why Google cannot say if my password has been used in that auth attempt or not (this is my account after all).
    – haimg
    Jan 30, 2013 at 3:10

2 Answers 2

Reset to default
2

Reading from your question, I would say that your password isn't compromised. As Google has stated, it was an attempt by the hacker to gain access to your account, and Google identified it as suspicious and prevented it from continuing. This does not necessarily mean that the hacker has gotten hold of your password and all the contents in your email.

You can check the recent login details at the bottom of your inbox page to see where you have logged in to your account. Most likely in this case it would just show details of your own computers and no one else's. Of course, if you see something different and you are certain that you have never logged in from that computer before, sign that specific session out and change your password.

Improve this answer
2
  • 1
    I tend to agree... The phrase "tried to use an application to sign in" probably indicates that an OAuth token was used to try to get access, and it was prevented (and OAuth token was probably obtained from a hacked third-party web site). Still, I wish Google's wording was a little bit clearer.
    – haimg
    Feb 24, 2013 at 18:42
  • I too received this notification from Google and it appears that they are directing users to change their passwords if it's just a failed attempt with an incorrect password. I find this quite irritating, since it's creating a false panic. Google's ambiguity on this combined with my unique and secure password choice made me concerned that perhaps my password manager was hacked.
    – glenviewjeff
    Oct 26, 2013 at 19:02
2

Google is unlikely to suggest a change of password because of a hacker "attempt", or lots of googlers would be changing perfectly good passwords. Someone actually used your real password, but was it you?

In my case the login was legitimate, but blocked due to a suspicious location reported for my iPhone's ip address (two states away) ...

I bought an iPhone on a Sprint plan, and while setting up the Gmail account I received Google's "Suspicious sign in prevented" message, including the offending IP address and general location of the offender (a different state than where I live). Then, to check my iPhone's ip address, I simply used the iPhone's Safari web browser to browse to "arin.net", and at the top of that web page was my ip address, from the iPhone, the same as the offending ip address reported by Google. It was me! The iPhone Wi-Fi must be off to do this, or the iPhone browser will use the "local Wi-Fi ISP provided ip address" instead of the "Sprint provided ip address". Another good website to view your ip address (there are many) is "DNSstuff.com".

I enjoy Google's service, but I'm not terribly excited about protection against myself without mobile device ip address verification instructions, like the above.

Improve this answer
1
  • I agree that there is no good reason to change the password just because of an attempt, but I too received this notification from Google and it appears that they are directing users to change their passwords anyhow. I find this quite irritating, since it's creating a false panic. Google's ambiguity on this combined with my unique and secure password choice made me concerned that perhaps my password manager was hacked.
    – glenviewjeff
    Oct 26, 2013 at 19:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.