problems again with pop peeper - gmail access

[pop_pepper]

once again the errors have started appearing and all my gmail account are actng like someone has my passowrds or the IP that pop peeper has used to access the account has changed and gmail has thrown a fit and is now asking me for proof of my accounts. this by the way is about the 15th time in the past year or so this has happened. its definitely pop pepper causing it because i never change anything and suddenly the yellow error symbol appears. Gmail is in meltdown right now, it is asking me to prove my location, change my password and all kinds of other stuff which makes me wonder is it all bloody worth all the annoyance. 15 different password i have used for one account now

[pop_pepper]

all i keep getting is this

Verify it's you

Something seems a bit different about the way you're trying to sign in. Complete the step below to let us know it's you and not someone pretending to be you. Learn more.

so annoying, every few weeks, hissy fit

[pop_pepper]

then i get an email

Why are we sending this? We take security very seriously and we want to
keep you in the loop on important actions in your account.
We were unable to determine whether you have used this browser or device
with your account before. This can happen when you sign in for the first
time on a new computer, phone or browser, when you use your browser's
incognito or private browsing mode or clear your cookies, or when somebody
else is accessing your account.

now you may think this is Gmail. however the problem starts with pop peeper. i am sure it does something like change its IP or redirects or does something that makes gmail think its being hacked.

[mjs]

Refer to this Google link: Google Account Help > Privacy and Security > Suspicious activity > Detecting suspicious activity on your account.

Refer to bullet point #5 on this page which is the most likely cause.

> "Your Last account activity shows sign-in activity at unusual times or from unusual computers."


Also take a look here: Google Account Help > Suspicious activity > Security notification settings > Security notification settings, expand on the third link on this page: "Common problems with alerts".

[pop_pepper]

can i just point out that the accounts are not compromised. I am pretty sure pop peeper is being detected by the gmail servers, which in turn lock down the accounts?

why do i think this???

because this happens all in one go.... a whole load of accounts are detected as being suspicious, whats the link??

Pop Peeper checking the accounts, it's the only possible explanation

[mjs]

How many Gmail accounts do you have?

What is your "Mail Check" Polling Interval set at?

What "Server type" are you using for your Gmail accounts?

Most importantly: Are you or anyone else using Pop Peeper on more than one computer to check these same Gmail accounts?

[pop_pepper]

15 gmail accounts

i only use one PC with Pop Peeper on it (leared that lesson a few months ago)

mail check polling is the default setting


post are using the gmail server, some are setting to the imap.gmail.com

maybe i should change them all to that....maybe Hmmm

[Jeff]

some are setting to the imap.gmail.com

maybe i should change them all to that....maybe Hmmm

Yes, yes you should. As was suggested here:
http://www.esumsoft.com/Forums/viewtopi ... 148#p30290
and here: http://www.esumsoft.com/Forums/viewtopi ... 244#p29200
and here: http://www.esumsoft.com/Forums/viewtopi ... 759#p28776
and here: http://www.esumsoft.com/Forums/viewtopi ... 635#p28550

Not that I'm counting or anything...

I have publicly stated that POP Peeper will cause this problem whenever your IP address changes:
http://www.esumsoft.com/blog/gmail/
That was almost 2 years ago and I have been encouraging everyone to switch to IMAP ever since, *especially* since POP Peeper v4 came out because it makes it so easy to switch to IMAP.

[pop_pepper]

lol at counting, I am doing it now. although having issues locating in gmail where i actually allow Imap to be enabled

[pop_pepper]

have had to change it back, gmail through a hissy fit and refused to work despite me changing the setting in gmail

[mjs]

lol at counting, I am doing it now. although having issues locating in gmail where i actually allow Imap to be enabled

Go to Gmail (on the web) "Settings" (look to upper-right for "gear", click on it and select "Settings") and then click on the "Forwarding and POP/IMAP" tab, look for "IMAP status" and select "Enable IMAP" (radio button). You should then see - Status: IMAP is enabled. You were probably getting "Login Error ([ALERT] Your account is not enabled for IMAP use. Please visit your Gmail settings page and enable your account for IMAP access. Failure)" errors w/out this setting enabled.

This should solve your problem. ... Please post back on your progress or if you have any more questions.

Gmail Settings: Enable IMAP

[Jeff]

There are a couple of other likely scenario, after IMAP is enabled:
1) You have to allow "less secure apps" setting:
https://www.google.com/settings/security/lesssecureapps

2) If you're using 2-step verification, you have to create a unique password for IMAP access:
https://support.google.com/mail/answer/ ... hl=en&rd=1

[pop_pepper]

cheers i am having to do it now as all the email accounts i changed the passwords for the other day are again reorting errors, it makes my head spin all this, maybe i'm just a bit ditzy if thats the right word

[pop_pepper]

i have done all of the above and still had to turn it back to gmail

[pop_pepper]

found out why, i use Mozilla, and this is not set as my default broswer because i dont wish it to be because certain thing i use like dreamweaver i want to check in Internet explorer. However i have windows 10 this has a new browser called Microsoft edge, after signing in from that and then trying Imap it worked.

[jmjsquared]

Pardon my butting in but, five minutes ago, I finally figured out the cause of, and the solution to, my identical problem.

When Not-being-evil Google detects any unusual or unfamiliar activity in accessing your account, it wisely blocks access until you permit that access, much like a good software firewall. However, Google provides no working way for you to say, "All is well. Allow the access." because its automated system opaquely "locks" your account for approximately 24 hours. Each time you re-attempt (and fail) to access through POP Peeper, you actually are resetting that 24-hour clock. The links provided in the POP Peeper notification message do not lead to a genuine solution because, after you follow their instructions and Google unblocks access, it immediately opaquely/silently reblocks access the next time you try access with POP Peeper or any other third-party aggregator, for that matter.

Allowing "Less secure apps" is not a wise soulution, IMO. However, if you enable 2-Step Verification for the email account https://www.google.com/landing/2step/ and then create an App Specific Password https://security.google.com/settings/se ... ppasswords for POP Peeper, Google's enhanced security is maintained and POP Peeper works as expected on any device and with any IP Address. Just keep that App Specific Password handy.

This also helps keep Google from freaking out, if, for example, you change ISPs, use a hotspot, tether your computer to a smartphone, dongle, etc.

I hope my lengthy opinion-sharing helps someone else.

[Jeff]

It should be noted that allowing "less secure apps" is the same security settings as virtually every other email service -- that is, it allows SSL/TLS access to the account. Two-step verification is probably the better choice, in general; however, it should be noted that there are several steps involved, including a voice/sms confirmation to enable it.

I was under the impression that you still had to enable less secure apps with 2-step, but I've done some testing and, you're right, it's not necessary. I have now updated the relevant FAQ and I'm recommending the use of 2-step over less secure apps.

[jmjsquared]

Jeff, I was not faulting your Less-Secure-Apps recommendation per se, nor faulting POP Peeper at all. And, based on my limited experience with apps similar to POP Peeper, you are right: The two similar apps that I looked at run into the same issue with Gmail, and their developers, like you, recommend the same "Less Secure Apps" workaround. To their credit, Google offers an elegant solution to the inherent problem of 2-Step Authentication + Automatic Access/Retrieval; that is, Application Specific Passwords. The issue arises only because it is not clear to users like me and, apparently, the OP where precisely the problem occurs; and because Google's reset-application-access link is useless.

I only discovered this (new?) problematic interaction of Gmail and third-party applications because, after several years of daily use, I had not used POP Peeper for about 6 - 7 months. Yesterday, I (re)installed POP Peeper on a new Windows installation and ran into the OP's problem with only one of the Gmail accounts I always had accessed successfully with PP. So, I waited 24 hours for Google's "hidden" semi-lockout to expire and, after jumping through all the usual troubleshooting hoops, still had the problem. That's when I recognized that that Gmail account was the only one with which I did NOT use Google's 2-Step Authentication.

Pardon if I sounded accusatory.

[Jeff]

I didn't take any offense at all. My one concern with your post was, "Allowing Less secure apps is not a wise solution" for which I partially disagree because it's the same level of security that every other email service provides that uses SSL/TLS. Both Hotmail and Yahoo have 2-step verification which results in the same level of security as GMail. If someone wants to take the extra time and effort to enable 2-step, then I would say go for that option. But, for some people, it could be more trouble than it's worth (beyond the initial setup). Personally, I think GMail should have allowed SSL/TLS by default, and perhaps, upon the first SSL/TLS visit, send a one-time email saying, "wouldn't you rather use 2-step?" and I'm sure that in 90% of the cases, the answer would be "no" and then their account gets hacked and then they're complaining about how insecure GMail is...


But, getting back to the problem that you had -- are you saying that you had enabled SSL/TLS ("less secure") for GMail *before* or *after* the problems started occurring? There seems to be 3 cases (you, the OP, and another thread) where GMail seems to be behaving differently than what I would expect. That is, before now, I've never heard of a problem occurring once SSL/TLS is enabled, and it sounds like you're suggesting that GMail is still blocking access after that for 24 hours?

And, that being the case, when you enabled 2-step on those accounts and created an app-password, was POP Peeper able then to immediately access the account?

[jmjsquared]

While we agree that most (all?) apps like POP Peeper resort to some variation of the more easily implemented Less-Secure-Apps approach/workaround to the issue/problem being discussed, I still maintain that, given the option to take advantage of the more secure 2-Step Authentication + App Specific Password solution available with Gmail (and, perhaps, some others), it is not wise to opt for the less secure approach which lowers the security bar for ALL apps accessing that account.

To answer your questions: As I recall, I always only used IMAP + SSL/TLS to access all my email accounts with POP Peeper, including (I think) the recently problematic Gmail account which DID NOT have 2-StepAuth enabled before today. I never had any problem.... again, to the best of my recollection. That is why I only hinted at the possibility that, sometime during my 6- to 7-month vacation from POP Peeper, Google may have changed something on their backend. HOWEVER and once again, I cannot be absolutely sure that the one, problem Gmail account I mentioned (which I use as a trash-collecting account) was one that I used to check with POP Peeper before today. It is very possible that I only discovered this issue yesterday because I had never used POP Peeper to access that account before.

That being said, Yes: Immediately that I enabled 2-Step Authentication and set up an Application-Specific Password, I was able to access that account with POP Peeper as expected. No issues since.