{"id":6847,"date":"2018-01-17T12:57:04","date_gmt":"2018-01-17T12:57:04","guid":{"rendered":"https:\/\/dev.adambowie.com\/?p=6847"},"modified":"2018-07-24T12:21:19","modified_gmt":"2018-07-24T11:21:19","slug":"critical-security-alert","status":"publish","type":"post","link":"https:\/\/dev.adambowie.com\/blog\/2018\/01\/critical-security-alert\/","title":{"rendered":"Critical Security Alert"},"content":{"rendered":"

Last week I got a worrying email in my Gmail account. <\/p>\n

\"\"<\/a><\/p>\n

Either this was a genuine Google email, or it was a phishing attempt. What’s especially worrying is that it suggests someone actually has<\/em> my password!<\/p>\n

I wasn’t born yesterday, so the first thing I did was hover my mouse over the “Check Activity” button. But that seemed to lead to a Google domain. I copied the URL into Notepad and had a look:<\/p>\n

https:\/\/accounts.google.com\/AccountChooser?Email=xxxxx@xxxxxxxxxxxx&continue=https:\/\/myaccount.google.com\/device-activity?long_code_removed_here<\/code><\/p>\n

That’s definitely a legitimate Google domain. I clicked through, and it wanted me to sign in.<\/p>\n

But here’s the thing, it wasn’t my regular @gmail.com account. Instead it used a personal domain that I’ve had for a number of years (certainly pre-dating Gmail). And while it’s true that I’ve since added that domain to Gmail to allow me to use Gmail to send and receive email to that address, I still use my overall Gmail account to sign into Google services.<\/p>\n

This was odd.<\/p>\n

One thing was certain, and that was that I was unable to sign in. I had two attempts at a password and then Google stopped me. <\/p>\n

The process to reclaim the account was based around getting a verification code sent to the email which worked fine, but then being asked when I set up the account by month and year. <\/p>\n

This I honestly didn’t at first know. I got my Gmail account quite early on, chasing an invite from a friend who worked at Google I recall. Or maybe it was another tech-savvy colleague who got one and then was able to invite me. Either way, that would have been my Gmail account, not my personal domain.<\/p>\n

I tried again to recover the account, and I think I even now know the password. But I was unable to recover the account.<\/p>\n

So I started Googling.<\/p>\n

The best guess was this thread<\/a> with some responses by someone with the same problem, receiving the same alerts.<\/p>\n

He thinks it’s an old Google Answers account. That was a service that let you either post questions or provide paid-for answers. It began in 2002, crucially before<\/em> Gmail was created (2004). Therefore in creating an account you would have had to use a non-Google email address. I’d have certainly used my own one. <\/p>\n

I have an email from a precise date confirming that I’d set up a Google account then. However since Google’s automated account recovery service dropdown only goes back to 2004 – i.e. after<\/em> the date I created the account, I can’t recover it via that method.<\/p>\n

Now on the one hand, I don’t really need this account. I happily use my main Google Account to which I’ve applied plenty of security, but those security alerts worry me that someone, somewhere is attempting to break into this account. I can’t lock it down, delete it altogether, or do anything about it. <\/p>\n

They’ve now had at least two attempts to get into it, and they seem to have a password. I suspect the email\/password combination comes from another leak sometime. I used<\/em> to commonly use the same combination a bit too much.<\/p>\n

Outside of the automated account recovery process, I an aware of no phone or email resource that allows Google account recovery. So I’m kind of resigned to getting these Google security alerts on a regular basis, and being powerless to do anything about them.<\/p>\n[UPDATE – July 2018] I’ve continued to receive these emails over the months, but I can’t recover the account to delete it entirely or do anything else with it. Very frustrating.<\/p>\n","protected":false},"excerpt":{"rendered":"

Last week I got a worrying email in my Gmail account. Either this was a genuine Google email, or it was a phishing attempt. What’s especially worrying is that it suggests someone actually has my password! I wasn’t born yesterday, so the first thing I did was hover my mouse over the “Check Activity” button. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11],"tags":[853,305,257,219,852,851],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/dev.adambowie.com\/blog\/wp-json\/wp\/v2\/posts\/6847"}],"collection":[{"href":"https:\/\/dev.adambowie.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dev.adambowie.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dev.adambowie.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.adambowie.com\/blog\/wp-json\/wp\/v2\/comments?post=6847"}],"version-history":[{"count":8,"href":"https:\/\/dev.adambowie.com\/blog\/wp-json\/wp\/v2\/posts\/6847\/revisions"}],"predecessor-version":[{"id":7156,"href":"https:\/\/dev.adambowie.com\/blog\/wp-json\/wp\/v2\/posts\/6847\/revisions\/7156"}],"wp:attachment":[{"href":"https:\/\/dev.adambowie.com\/blog\/wp-json\/wp\/v2\/media?parent=6847"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dev.adambowie.com\/blog\/wp-json\/wp\/v2\/categories?post=6847"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dev.adambowie.com\/blog\/wp-json\/wp\/v2\/tags?post=6847"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}