May 8, 2012

Google Account “Suspicious Activity” & Next Steps

JUNE 13TH GOOGLE SYNC UPDATE:

We are focused on releasing the contact and address book sync functionality
After further discovery regarding Plaxo not syncing with Google, we are finding that we will be unable to have the calendar sync functionality working.  To set expectations, we are concentrating on releasing the contact and address book sync functionality.

When we do release by June 30th, your Plaxo address book will sync with Google, but the Google calendar will not sync with Plaxo.  We feel contact sync is most critical to our customers.  We are focusing our efforts to get contacts syncing as soon as possible.  However, our engineers are currently evaluating the calendar sync feature, but we do not have a release timeline yet.

Getting the address book sync up and running is our top priority and we will have a new release for customers by June 30th.  Our customers’ privacy and the security of their data is of the utmost importance to us.  Thanks for your continued patience.  Please contact us at help.plaxo.com with any additional questions.

JUNE 6TH GOOGLE SYNC UPDATE:   We ran into Plaxo development issues while fixing Google Sync. This is our top priority and we will have a new release by June 30.  Our customers’ privacy and the security of their data is of the utmost importance to us.  Thanks for your continued patience.Please contact us at 1-866-GO-PLAXO with any additional questions.

GOOGLE SYNC UPDATE: We expect to re-enable Google Sync for Plaxo customers on Wednesday evening PT on June 6, 2012.  Please contact us at 1-866-GO-PLAXO with any additional questions.

Some Google account holders may have received an email from Google yesterday with the title “Suspicious sign in prevented”. This notification was informing recipients of precautionary measures taken by Google to protect accounts which included temporarily disabling Plaxo’s API connection to Google’s address book and calendar.

What happened?
Google and Plaxo detected a malicious party misusing Plaxo’s server connection to Google as a means to login to Google accounts using a set of credentials the malicious party obtained on their own. These credentials were not obtained from Plaxo. This party used a function we call the AB Widget which we had slated for retirement to access those accounts hiding behind Plaxo’s proxy.

Both Google and Plaxo noticed this activity and as a precautionary measure Google temporarily disabled all Plaxo’s connections to Gmail address books and calendars including the sync service associated with your account. As a result, all users of Plaxo’s Google Sync service received a “suspicious sign in prevented” message.

What measures are we taking?
Plaxo is in full communication with Google’s security team and has taken steps to prevent future attacks including the full shutdown of the AB Widget. We are now also in the process of upgrading all API connections to Google, including our sync service, to use the more secure oAuth method, which we already have in place for importing address books.

While we upgrade our Google Sync service to use the more secure oAuth method, as a precautionary measure, we will leave the service disabled until we have it in place and will notify you when available.

What should you do?
While only a subset of the Google account holders that received this message were accessed by the malicious party, we recommend as a safety measure that you change your Google password. Also for Plaxo customers, Google Sync will remain disabled until we have the more secure oAuth method available at which point you’ll be notified. This is a top priority for Plaxo, to re-enable Google Sync for our customers.

Our customers’ security and privacy is of the utmost importance to us and we are working diligently to continuously protect your data. View Plaxo’s Data Usage Practices.

Email Print

About the Author

View Plaxo Profile >>
Preston Smalley

GM and Head of Product

As GM I head the product and marketing teams. I also am an Entrepreneur at Comcast Silicon Valley where Plaxo operates. Former user experience design and product strategy leader from eBay with MBA from UC Berkeley.

Related Articles
Comments
  • Guest

    Sorry but this is not very clear. Did they obtain my user name and password or would they have to guess the password?

    • http://twitter.com/plaxohelp plaxocare

      As per the blog post, no customer information was obtained through the Plaxo servers.

      • Guest

        I read the blog and saw that comment. 

        My question was if they actually managed to access my account? I assume to access my account they would have to know my password or is the authorisation so weak that they could access without my password? I am confident in my password strength to know that they would not be able to find it unless retrieved from yourselves or somewhere else. I do not want to change my password every time somebody hacks into your services. If you are incapable of a secure operations then clearly you are in the wrong business.Furthermore the notification I received refered to an account without the period mark. My Gmail account is firstname.lastname@gmail.com but the message I received referred to firstnamelastname@gmail.com - any particular reason for this?

        • http://www.prestonsmalley.com/ Preston Smalley

          If Google did not contact you directly about your account, then there is no need to reset your password. We had offered that suggestion as additional safety measure and at no time was your Plaxo account itself hacked. 

  • http://twitter.com/richkauz Richard Kauzlarich

    Heard about this first from Google — only later from Plaxo. Makes me wonder at the value of continuing my Plaxo account since there are more features on other competitve products that don’t represent a back door for hackers.  Sorry to be negative.

  • Anonymous

    Wow. This is a totally cryptic and unhelpful message.

    Consider this a 12 hour warning.

    Provide far more details as to what may have been compromised either here or at google, what the risks are, why passwords need to be changed, what happens to users of 2-step authentication, etc. or I will be closing my plaxo account and tweeting my followers to do likewise.

  • Bytecrawler

    I would have really appreciated an email direct from Plaxo telling me what happened. Nothing in the Google email said this was related to Plaxo. I’ve spent the last 45 minutes trying to figure out why my Google sync wasn’t working and the only message I was getting from Plaxo was that my login failed and I should verify my username and password. I was thinking there might be something in my new password that Plaxo didn’t like so I’ve been changing passwords and experimenting with the connection. Finally I just gave up and started Googling to see if anyone else is having a problem and found this. So please do two things (1)  if you haven’t done so already, send every plaxo customer who is using google sync an email and let them know what’s happening and (2) change the error message for the google login from plaxo to explain why it isn’t working.

  • http://www.lmgriese.com/ LMGriese

    Regarding this statement: “While we upgrade our Google Sync service to use the more secure oAuth method, as a precautionary measure, we will leave the service disabled until we have it in place and will notify you when available.” 

    The sole reason I paid $45.00 to Plaxo was for the Google Sync service so am at a loss without it. Do you have any idea how long it will take to get it working again and will there be any compensation for this time we cannot access a service that was paid for?

    • http://twitter.com/plaxohelp plaxocare

      Yes, you will get a compensation for the period the services are affected.. Please do email us at billing@plaxo.com, so that we can help! Further, as per our latest update, we are scheduled to enable Google sync by end of May.. 

  • In the dark

    ARGH!!!  Very frustrating.  I received one of those messages and now am left with little information to gauge for myself whether my account may have been compromised.  I came to this blog post for more information but there is very little to be had.  Changing my password for my Google account is not something I want to do at this time.

    How did this hacking attempt differ from the myriad of attempts to guess my login + password combination?  Is the concern that the hackers received a list of email addresses from the Plaxo servers and used that as a starting point to guess passwords (as opposed to having to guess both)?  Did the security on Google’s end relax some of its customary safeguards (like number of failed login attempts) since it thought that the login attempts were from Plaxo?   How long as this back door been open and hence how long could this attack have been transpiring?  I prefer some substantiated information from a security expert to help me understand how to proceed without a knee-jerk reaction of “change your password just in case”.

  • Paul Ryan

    When is this likely to be fixed.  For now, I can’t sync gmail with all my other accounts, which is the reason I paid for plaxo….

    Would love a service update, or some detail on the issue so I know how long to wait, or move on.

    • http://twitter.com/plaxohelp plaxocare

      Sorry that you haven’t been able to sync Plaxo with Gmail.. Our engineers are working on fixing this problem. As per our latest update, we are scheduled to re-enable Google sync by June 6th..

  • Rafael A. Sgueglia

    Do you have any estimate date the service will be restored?

    • http://twitter.com/plaxohelp plaxocare

      Rafael – As per the current schedule, the services should be up and running by the end of May! Thank you for your patience. 

  • Randy

    I hope this gets resolved soon since my company depends upon the google/plaxo connection to update our reps in the field with new contact information.

    • http://twitter.com/plaxohelp plaxocare

      We are working hard to fix this problem sooner for our users. Our engineering team is scheduled to re-enable Google sync by June 6th.

  • pjm

    When can we expect the Plaxo Google Sync to be enabled?

    • http://twitter.com/plaxohelp plaxocare

      We are scheduled to enable Google sync again by June 6th..

  • Frank R

    Hope this will be fixed very soon, as I can’t do without synchronization of the android and Outlook calenders. And while you’re at it, perhaps you could pass reminder information to the Google Calender as it seems to be lost with your current synchronizer.

  • http://www.facebook.com/profile.php?id=695943009 Peter Mason

    When can we expect Plaxo to re-enable Google Sync?

    • http://twitter.com/plaxohelp plaxocare

      Yes..  If everything goes well, we are scheduled to enable Google sync by June 6th..

  • Rafael A. Sgueglia

    Is there any estimate on when the Google sync will be working again? I find it really useful, and I miss it!

    • http://twitter.com/plaxohelp plaxocare

      As per our latest update, we are scheduled to enable Google sync June 6th..

  • Erik D.

    Do you have an ETA – even in days/weeks/months – of when this functionality will return? This is the only reason I use Plaxo, so paying for this service when it’s not available does not make sense. Thank you.

    • http://twitter.com/plaxohelp plaxocare

      Hi Erik –  
      As per our latest update, we are scheduled to enable Google sync by June 6th..

  • Wfbjjk

    I am a Premium Member.  I had not heard about any of this at all from either Google or Plaxo. I discovered the problem myslef after wasting a great deal of time trying to deteremine why Plaxo was not synching with my Google account. This shows very poor customer service on the part of both Plaxo and Google. I ended up being locked out of mny account several times, was given ridiculoious advice by Plaxo technical support, and wated no less than 6 hours due to Plaxo’s inefficiencies and compltee lack of communicatiobn.  I note further that this is still not functioning, and even this blog hasn’t been updated for sveral days on progress or projected time frame.  Yet Plaxo continues to advertrise that it can synch with Google.

    • http://www.prestonsmalley.com/ Preston Smalley

      Sorry about your frustration. We did email all impacted customers (which should have included you) on May 8th explaining the situation above and what we’re doing to both resolve the issue and compensating premium members for the missing service (by adding additional months without charge). 

  • David Turner

    It has now been 7 days since this announcement.  I spoke to Plaxo yesterday and had not even seen this blog post.  I asked the tech questions about the GMail e-mail and the Google Sync problem.  He knew less than this blog post.  I asked for more info, he said he’d have to ask the engineers.  He did, came back and reported they said, “we’re working on it”.  I went through the roof.  What the hell?  It’s been 7 days since Plaxo disabled the GoogleSync feature and STILL they have not even sent us a message YET!!  Usually, as a Premium customer, their customer service is pretty good, but lately, they take the call, say they’ll have to research it, and will get back to you.  That is an e-mail, not a phone call.  Not cool.

    Plaxo better get it’s act together and I mean NOW!!!

  • Gaspar

    Can you guys atleast provide us with an ETA of when it will be available. Its been a while now and Google sync is the only reason I have this service. Makes no sense paying for it if it does not work. They better start thinking about refunds.

  • John

    Still Waiting!  I use this sync everyday and I have a hard time believing that this is not fixed!!!

  • Rtravers

    This is sad , I am a paying client and I get info what so ever, No update on what is going on, how long or anything. How but filling in your clients with something. Google sync is one of the mane things I use plaxo for so all my computers are synced with my phone and calendar I feel naked with out it. 

    • http://twitter.com/plaxohelp plaxocare

      Sorry about the interruption in Google sync services. Our team is closely working with Google to resolve this at the earliest.

  • Gaspar Raposo

    Any idea when this is going to be back up? This is really painful.

    • http://twitter.com/plaxohelp plaxocare

      As per the latest update from our engineering team, this should be resolved with-in 3 weeks (or less). We do apologize for the inconvenience.

      • Gaspar

        An Apology is fine but do you think i even have to pay for no service too? what are you guys doing monitory wise to compensate us, the user?

  • Gaspar Raposo

    How long does it really take to program a code? This is ridiculous. 

  • Robertontheweb

    Learned today that the new resolution date expected is June 4th. Be informed

    • http://twitter.com/plaxohelp plaxocare

      Hi Robert – We’ve updated the Blog post.. The latest date for the release is June 6th.

  • http://twitter.com/BasilRehill Basil Rehill

    I’m happy to know that Google is looking out for our private information. At times it seems like Google is against all people who are trying to make a living using the internet. Then you hear about them protecting your information and all seems well. Thanks for the update

  • http://www.facebook.com/bob742 Bob Browning

    Are you still on schedule for tomorrow evening?

  • Fabrice from France

    So… today is the 6th of june… still no sync with my Google calendar… any news?

  • Andy Pardoe

    Is this fixed yet ? I see there has been an update to Plaxo but I still cant set up my google account synch ?? What is the story / plan for this …. the Plaxo support told me this would be fixed today

  • Anonymous

    So customers have been waiting in the dark for weeks (while repeatedly being given misinformation by Plaxo tech support), and today (the day Plaxo promised the fix would be ready) we are told that in another three weeks there might be a solution and we might get access to the services we paid for and rely on? And you expect to keep us as paying customers? Let me know how that works out for you. 

  • Bill Badzmierowski

    I am not surprised that Plaxo “discovered” on the day things were supposed be “fixed” that “we ran into Plaxo development issues while fixing Google Sync” and that “this is their top priority and they will [theoretically” have a new release by June 30.”  I doubt that will happen either. I have yet to be even be contacted by Plaxo via my email address about any of this, and I am a PAID PREMIUM CUSTOMER!  I have to instead check his blog all of the time for the rare updates posted by Plaxo.  This is VERY poor customer service!

  • http://profile.yahoo.com/J64VDQAFMDEHO4W2U267ANBAWM Jeff

    So now it’s going to take over a month to fix?  Are you guys working out of your basement?  Is this a professional organization?  Has anyone found a competitive products that I can jump to?  I’ve seen ones that will sync contacts and others that sync calendars, but not both.

  • http://www.facebook.com/people/Aleš-Bulc/1712006445 Aleš Bulc

    very poor information. I have wasted hours of figuring what went wrong after I have opted for 2 step google verification and all stopped working. It took a lo t of effort to learn about wider problem at Plaxo. I have not received any info from Plaxi eventhough I am a platinum memeber for years. very poor communication

  • James

    It is now June 7th, and as far as I can tell, no resolution. I still cannot sign in and sync to Google. This is why I cancelled Plaxo the first time around, because they could not get Google straight. I guess I will have to look elsewhere for a solution as well.

  • Rtravers

    Today is the 7th and still no google sync no its slated to be releasedon the 30th OUCH!!!!!!

  • Tapani Simojoki

    I signed up for the Premium trial two days ago, only to discover afterwards that Google Sync wasn’t working, making the whole trial worthless for me. At this rate, the trial will be almost over before I have even had the opportunity to get started.

    I know this notification went up before, but it wasn’t flagged up when I signed up. New or upgrading customers have no reason to look through the blog for potential problems – they need to be made aware upfront.

  • PPatti

    Google offers a temporary workaround that is effective and results in enabling the sync with Plaxo using only a few clicks. The background sync between Google and Plaxo is awesome and needs to be reinstated ASAP, but meanwhile log in to GMAIL and follow these instructions you will find in one of the original emails they issued on the topic. Then, log back in to your Plaxo sync and it will work. I’ve been doing this since the issue started and it works fine, yes it takes a few extra minutes to sync and it is not the ideal solution, but it does work;Now, please follow the steps below to resolve the problem:Open your web browser and sign in to Gmail at http://mail.google.com/mail. If you see a word verification request, type the letters in the distorted picture and finish signing in.Visit http://www.google.com/accounts/DisplayUnlockCaptcha and sign in with your Gmail username and password. If necessary, enter the letters in the distorted picture.Click Continue.Restart your mail or sync client and try accessing sync or messages again.

  • Anonymous

    June 7 – still no resolution and you have not posted my comments from yesterday. I did not swear, I did not call names, just pointed out the inadequate information and service Plaxo has provided on this issue. Please prove me wrong. 

  • Stefan J. Buob

    It’s a shame, that this problem is not be fixed in
    a shorter timeframe….

    As a premium member and customer sine a long time
    it’s not the way of information and customer care…

    I think I’m wasting money to continue support
    plaxo….

  • Blandrealty

    I guess the new date is June 30th to get this problem fixed.  This is the main feature of plaxo and is missed.  I have wasted time fooling with this problem. Please let me know when it is fixed. 

  • Anonymous

    Can we trust the ETA of June 30 or should we make other arrangements? 

    • http://twitter.com/plaxohelp plaxocare

      Yes. Google Contacts sync should be working by June 30.

  • Guest

    please make the correction: 2 dates in the same blog

    This is our top priority and we will have a new release by June 30.

    GOOGLE SYNC UPDATE: We expect to re-enable Google Sync for Plaxo customers on Wednesday evening PT on June 6, 2012. 
     

  • Greg

    June 6th target resolution date came and went…..just checked in with support and new target for resolution is June 30th…..

  • Mid-tntoday

    Does this Google issue affect sharing Plaxo calendars to another Plaxo members calendar? Having problems adding/merging another members calendar to mine

    • http://twitter.com/plaxohelp plaxocare

      No.. This does not affect the calendar sharing between Plaxo members or non-Plaxo members.. Can you email us at helpme at plaxo dot com with your account details? We can look into the account and help!

  • Jfaia

    Is the Plaxo sync with Google still not functioning? I have tried
    it several times over the last few days and it worked one time only. I have
    tried using the normal Google password and also the application-specific password within Google, neither of which work within
    Plaxo. 

    • http://twitter.com/plaxohelp plaxocare

      Can you try now? Google contacts sync should be working now..

      • Anonymous

         I tried. I got to the select Gmail account screen, I selected my primary Gmail account, and got this error message:
        “Error: redirect_uri_mismatch
        The
        redirect URI in the request:
        https://www.plaxo.com/ab/dashboard/closeGmailOauth?service=gmail2&secure=1
        did not match a registered redirect URI”
        No joy here.

        • http://twitter.com/plaxohelp plaxocare

          Can you please email us the info to helpme(at)plaxo.com, so that we can look into it asap?

          • Anonymous

            It finally worked, so I can’t email you the info anymore. Thanks for checking.
            Gail

  • http://www.authoritydirectory.com Bruce

    So I contacted support and first it was end of may, then June 6th, then they said it would be running by the end of June and linked me to this post. Where i read that apparently only part of the service will work – maybe – by the end of June. Plaxo views that syncing my calendar is not very important as you dont even bother with telling us when that will be fixed. I guess that i can see why with your record on missing dates so far.

    I pay for this service and syncing my calendar is every bit as important as syncing the contacts. Those are the only services you offer that caused me to sign up and pay the fee. So right now your basically offering us nothing for a service but taking our money just the same. But of course as per a comment below we can contact billing and get our time credited back. SO if you know what members are affected why do we have to contact anyone? Why not just credit our accounts automatically? 

    Better yet – what is the difference between all of us just canceling your service or staying members? We get the same service provided either way and that is nothing. One way we just avoid being charged for it anymore.

    I hope that you understand why this is completely unacceptable. Businesses rely on these sync services to keep different devices updated with current calendar events and contact information.

  • Anonymous

    At least Google provides a calendar sync tool that works. I never had luck getting the Plaxo calendar sync to work right anyway. So if you need your calendar to sync between Outlook and Gmail, download and install the Google tool.

  • Todd Ham

    I am successfully synching my contacts once again.  Maybe i missed the original email about the problems, but I too wasted a lot of time trying to figure out why my service had gone down.  Would have been nice to get an email that I could at least once against start resynching my google accounts, since I had purged them in an effort to fix the problem first go around.

    Anyway, thanks for getting contacts up.  However, calendar is just as important to me.  I would like to seee a definitive statement one way or the other on whether Plaxo will remain committed to getting calendar synch working again.  The blog seems to leave it open ended.

    I have enjoyed using Plaxo for several years now.  However, if the calendar stuff isn’t up and running soon I will be be cancelling.

  • Headteacher

    You are wrong. The calendar sync is more important than the contacts sync. It is the sole reason I pay to be a premium customer. This needs sorting now I am wasting a ridiculous amount of time working between the two systems. If only google works then Plaxo is not required.

  • C W

    I am using Google calendar sync for Outlook which works quite well with Plaxo. As far as I can see, that has overcome the calendar sync problem.

  • Pascal Treuthardt

    I agree with the comment below!! For me Calendar sync is even more important that the contacts…
     
    So
    I contacted support and first it was end of may, then June 6th, then
    they said it would be running by the end of June and linked me to this
    post. Where i read that apparently only part of the service will work –
    maybe – by the end of June. Plaxo views that syncing my calendar is not
    very important as you dont even bother with telling us when that will be
    fixed. I guess that i can see why with your record on missing dates so
    far.

    I pay for this service and syncing my calendar is every bit as
    important as syncing the contacts. Those are the only services you offer
    that caused me to sign up and pay the fee. So right now your basically
    offering us nothing for a service but taking our money just the same.
    But of course as per a comment below we can contact billing and get our
    time credited back. SO if you know what members are affected why do we
    have to contact anyone? Why not just credit our accounts automatically? 

    Better yet – what is the difference between all of us just canceling
    your service or staying members? We get the same service provided either
    way and that is nothing. One way we just avoid being charged for it
    anymore.

    I hope that you understand why this is completely unacceptable.
    Businesses rely on these sync services to keep different devices updated
    with current calendar events and contact information.

    Pascal Treuthardt

  • Hfour

    Any updates on the Calendar Sync? Is this going to be worked on at all?