It looks like this is a known issue, and Google is on top of it.
From the product forums:
We've gotten reports about some users being signed out of their accounts unexpectedly. We're investigating, but not to worry: there is no indication that this is connected to any phishing or account security threats.
Please try to sign-in again at accounts....
What the actual problem is:
Whilst it is possible to unlink other computers through the web interface, as slhck noted, this leaves all of your files where you don't want them. Depending on the sensitivity of your files (and how much work you want for yourself) you can:
Back up all Dropbox files locally
Delete any sensitive files from your Dropbox
Wait for the sync to remove these ...
Google found that security questions were not really secure at all as most of the answers can be found with a simple Google search. For example Sarah Palin had her Yahoo! account hacked because someone simply Googled her birthday, ZIP code and where she met her spouse.
Google has completely removed support for security questions and one only had the ...
The OAuth tokens for Google are at https://accounts.google.com/b/0/IssuedAuthSubTokens (it's different from Linked Accounts).
When I tried it, Facebook created a popup with a OAuth prompt the first time and only briefly opened a blank popup on subsequent attempts. De-authorizing Facebook makes the prompts appear again.
No! Don't give your portrait to Gravatar. Regardless of whether you trust Gravatar Corp, site owners can carelessly betray the identity of users posting under pseudonyms. A cautionary tale:
Hashim in Saudi Arabia secretly reads an American blog about homosexuality. One time, the blog discusses the Middle East, so Hashim comments describing his own ...
Go to https://www.dropbox.com/account#security and here under My devices, unlink the machines you no longer own:
Note that the computer, according to Dropbox:
will no longer stay in sync, but it will keep a copy of any file it currently has.
Google offers quite a few tools to help you keep unwanted persons out of your account, but some of them only work if you activate and use them.
Keep your Account Recovery Options up to date
Mobile telephone number: If you forget your password, or if there is unusual activity on your account, Google can send you a security code via SMS for you to prove you ...
According to Google Support:
Removing trusted computers from your list
You can remove computers from your set of trusted computers at any
time. To do so, sign in to your account and go to your 2-step
verification settings page. Under the “Advanced” section, you’ll have
the choice to remove the computer you’re using at the time or all
You can generate one time codes that can be used as part of two-step verification that doesn't require your phone. You can print out a bunch before you go and stick them in your wallet or luggage to use as needed.
Other than that, there are a number of guides with suggestions for trying to stay secure. Make sure you are using HTTPS (default now) and if you ...
Alternatively, go to https://myaccount.google.com > Apps with account access > Manage Apps
You will be prompted for your password. After that, you're shown a list of all sites you've used Google to authenticate with, and applications that have access to your account.
You need to be authenticated to actually view any emails.
Just to show you how sure I am, here is a link to one of my emails.
Unless you are authenticated as the user who "owns" that email, it will just redirect you to the inbox (tested with another account).
I'm the Gmail Community Manager. I spoke with our team about what you described.
What you are seeing is a bug in our system related to the use of IPv6. Very specific types of logins to do with mobile phone syncing that come in over IPv6 are not currently treated correctly. We're in the process of fixing this issue and I apologize for the inconvenience.
Clear the browser's cookies (and perhaps cache/history).
'Trust this computer' option doesn’t work
For computers you trust, Google recommends you select the "Trust this computer" option when you are asked for a verification code. When you check this box, you won’t have to enter a code every time you sign in to your account from that computer.
You can create redundant code before your device is lost or a reason.
Deactivate MFA, then configure and enable a virtual MFA device for use. Make a secure backup of the secret configuration key or QR code.
For example, if you lose the smartphone where the virtual MFA app is configured.
Google Authenticator → Set up account → Enter provided key
I have found the answer here.
In Calendar: Click the gear, select "Settings",
Find the "Automatically add invitations to my calendar" section,
Set its value to "No, only show invitations to which I have responded".
It depends on the network setup Google has. You can check the route your email took by checking the message headers. In GMail, you can do this by:
Log in to Gmail
Open the message you'd like to view headers for.
Click the down arrow next to Reply, at the top of the message pane.
Select Show Original.
Look for the Received headers. Those identify the ...
That's an IPv6 address. Someone is connecting from a host with an IPv6 address, rather than one with the usual IPv4 addresses you're probably accustomed to.
To find out where an IPv4 or IPv6 address is located, you can start with querying WHOIS.ARIN.NET. If it's not in North America, you will see a reference to the appropriate network numbers registrar.
From Gmail Help:
Last account activity shows you information about recent activity in your mail. Recent activity includes any time that your mail was accessed using a regular web browser, a POP1 client, a mobile device, etc. We'll list the IP address that accessed your mail, the associated location, as well as the time and date.
That means your mail was ...
Authenticator works even when you don't have any sort of network available for your smartphone.
I don't know about your mobile provider, but I don't trust mine to deliver SMS messages in anything that resembles a timely manner.
Beyond that, it is more secure, as you've noted.
You really can't stop them from trying but you can make your account more secure. For GMail / Google account I would setup the 2 step authentication. The 2 step process links your smartphone to your account so when you log in and get through, google will also send you a pin to your smartphone from which you will then verify. Much more secure.
As far as I can tell, you can't directly change your password the web site or the Android app (I don't know about iOS). You can, however, request that they reset your password.
Log out of the web site (if you're currently logged in)
Instead of logging back in, click "Forgot password"
Follow the instructions
No, not everything with everyone. That would be wrong and insane
Here's from official documentation: (click on link to see everything, I'll just quote up a few paragraphs)
WITH OTHER PAYPAL USERS
When transacting with others, we may provide those parties with
information about you necessary to complete the transaction, such as
your name, account ID, ...