Let me tell you a story. A story of a person who has an Gmail account and a domain registered to his name.That person checks Gmail regularly for new emails and uses the same browser to visit other websites and services as well.
It is convenient to stay signed in as you do not need to type your password or email address anymore when you go back to Gmail to check for new mail. Maybe Gmail is open all the time in another tab for even further comfort.
To stay signed in after you close the browser (end the session), simply check the Stay signed in -checkbox on the login screen (as Fischer said ).
While on vacation in India the person received some disturbing notifications about his domain from some of his friends. The website was not loading anymore but redirecting all visitors to a new website that seemingly had no connection with the original domain whatsoever.
He investigated the matter and discovered that he was no longer the owner of the domain name which happened to be his name dot com. First he thought that the domain might have expired but soon thereafter he discovered that a Gmail hack had been used to change the owner of the domain name.
It works like this. If you stay logged in at Gmail and visit a prepared website afterwards your Gmail filter list can be altered. In this case all mails from the domain provider was forwarded to another mail account and deleted on Gmail afterwards so that the owner of the account would not receive information about it or stumble upon it on the site.
The new password request was forwarded to the hacker who was then able to initiate the domain transfer at the webhoster.
Since all mails regarding the transfer were immediately redirected and deleted the victim had no idea what was going on. The only possibility would be if he would have logged into the webhosters website and take a look at the tickets that had been created to transfer the domain.
Gmail Won't Stay Signed In
You can read the long version on David Arey's Website. This hole has been fixed apparently but filters that have been set before can still be in place. If you use Gmail you should check your filters asap and make sure that they have not been altered in any way.
Since this is probably not the last security hole you should make sure that you always log off when you are finished.
Another possibility would be to use an email program like Thunderbird instead.
The same goes for accessing accounts on local computer systems. If you need to sign in, you better make sure that the information are not stored by the web browser and that you sign out when you are finished and clear the cache and cookies as well to be on the safe side.
Advertisement