(OT) Google: "Somebody knows your password"

[Ralf Mardorf]

On Fri, 04 Aug 2017 07:02:10 +0200, Volker Wysk wrote:
>The login was blocked, because of the device being 
>unknown to google.

Hi,

they check device strings? Did you ever confirm a device string? I
suspect that this sentence is an evidence for phishing.

Assuming they should care about what browser you are using and/or that
you are perhaps using "User-Agent: KMail/5.2.3 (Linux/4.4.0-87-generic;
KDE/5.36.0; x86_64; ; )" to access Google mails. What happens if you
update KMail, the Kernel or KDE.

Assuming they should verify the IP, then why do they call it another
device and not another location or IP?

On Fri, 4 Aug 2017 15:05:16 +0900, Joel Rees wrote:
>Or, if you are not using plaintext, the displayed URL can be different
>from the actual link.

We should explain that. Joel isn't talking about plain text for mails
the original poster sends, what he is talking about are mailers that
display HTML emails by using HTML and sometimes even by
automatically downloading remote content.

However, usually such mailers show the real URL in the status bar, it
at least is shown by viewing the message source.

FWIW phishing mails are usually not very tricky, the authors usually
don't spend time to camouflage anything, so much likely the links shown
in the status bar, if you hover the mouse pointer over the link in the
message, is the real link and much likely the "Received" path shown by
the message source is useful, to see if the mail was send from Google.

Btw. did you send a request to Google support? Not by using a link of
the mail, simply by visiting a website from Google.

Did you care about Google FAQs, e.g.
https://support.google.com/accounts?ctx=gcp#topic=3382296 ?

Chances are close to 100% that the mail is a phishing mail.

Regards,
Ralf