Someone has your password

Over the last month or so, I kept getting this email alert from Google:





I mostly ignored it because it was "prevented" anyway but today, on my other email address, I get this:





Now I have 4 Google accounts, 1 that I check into everyday and the other 3 are "sub-folders" wherein any email that goes into them goes into this primary email address that I check. Sorry, can't remember what the term is for what I'm doing. Basically, I have account "A" and in that account, I have sub-folders "B," "C," and "D" and any email that enters B/C/D show up when I log in to account "A."

The thing is; I've forgotten the passwords for B/C/D. Sign in to "A" was prevented but the one that had my password was account "D."

Anyone else had this issue? Any advice? I use Firefox and all my passwords are saved through Firefox as well; I wonder if it's time to use some password randomizer program?

If you check the 'review recent devices' do any stand out as one that isn't anything you own?

I have been using LastPass for a password manager for a while and like it.

I have got this message, but I've only got 1 Google account.

What happened was I usually sign in only on my daily-user dual-boot OS, and one day I had some reason that I needed to check that account from my other "gaming" dual-boot OS. And that apparently counted as a new device, about which Google alerted me.

I simply clicked on the links they provide. "Review your Devices". I verified the login times/locations were by me, and on the expected device/OS.

In your case, I think you are doing email forwarding to your main account?

As above, I'd click and "Review you devices" now. If something doesn't make sense, then get in touch with Google to correct it. Regarding the lost passwords, I'm not sure what they can do about that (no experience with their support there).

If you aren't already, make sure you are using 2FA.

2FA?

2 factor authentication.

From the looks of it probably those log-in attempts were prevented because the source IP was suspicious (Malaysia, U.S.). The idiot probably didn't know the general location you were logging from (at least we can rule out any members here in Simhq cause they would've tried logging from a U.K. and Philippine IP first).

I suggest not relying on that very much. Just check the security features in google.

I've been attacked and am aware that Simhq was a source of info for my attackers.

if you are getting messages like that you most likely are or have been infected with malware at some point in the past.

the attackers most likely already know your password. you would be extremely foolish to get a message like that and NOT change your password.

a full virus, malware and hijack scan is mandatory. once the scans are complete (scan EVERYTHING, ALL files on ALL drives, USB sticks, iphones, etc) then change your passwords to something GOOD.

How would one 'activate' a 2FA login here at SimHqs?

Does the site have to offer that option?

How would one set that up?

Well how it works for Star Citizen is you have a separate e-mail from the one you use to log in with.When you attempt to log in a code is sent to that e-mail as added security.

Yes, the site has to offer it. 2 factor just means there is a second way to verify you other than just your password. It can either be an email code or a text message or even from a phone application. But the site has to support a second method which most forums do not.

OK....that's a little more clear.
Yes we offer that, I figured all sites and forums offer that.
It's 'necessary' here, to post.
Just didn't know they had a name for it....

Thanks

Think you misunderstand.

For example if you log into Steam on a new device, it will email you a security code. So not only do you need the login and password, you also need access to the email account associated with it. If you don't get the email you can't log in. SimHQ verifies your email when you register (presumably, it's been a while...), but it's not required to log in.

Google has an app I have on my phone that puts out a rotating code that changes every X seconds, I forget exactly. When the prompt appears I type that code in and I'm verified. If I don't, you can't get in.

Simple and effective.

I also use it on Steam, been good for those times when I get a password change email because someone clicked "lost password" with my username.

One time I even got kicked out as apparently someone claimed it was their account. I called Valve and had to provide some details of a credit card I used to buy a game on the account, last 4 digits or something. That satisfied them and they reactivated it. I turned on Steam Guard and have had zero issues since.



The Jedi Master