Sunday, September 06, 2015

Weirdness with Yosemite Google accounts and email configuration: "This message may not have been sent... Report phishing"

I noticed my daughter was receiving email sent from my iPhone with my email address but the sender name of “Gmail personal”.

It took a while to figure out that this sender name was coming from how I named one of the user accounts for Mail.app … on OS X.

I really don’t understand this, but a Google search somehow sent me to this seemingly unrelated conversation ...

Fortunately, I know better than to ignore the nsAI of our time (non-sentient AI) - so I started poking around the configuration of my “Internet Accounts” (Yosemite, click Details after choose account name) and my OS Mail.app Account settings (which are sort of like the “Internet accounts” and sort of not like them).

There I found some oddball settings for Outgoing Mail Server — on a freshly configured machine (I didn’t migrate from prior machine):

Screen Shot 2015 09 06 at 8 57 01 PM

Screen Shot 2015 09 06 at 8 57 29 PM

I deleted the odd outgoing mail server .. .and Mail.app stopped sending email.

There’s a problem with Yosemite and multiple Google accounts on one OS X user account. i’m still figuring this out. I suspect the keychain is involved...

Update: It seems to be working at the moment. I had to create a unique SMTP server for each account and entering my Google credentials (2F bypass password for one of ‘em). I don’t think it’s supposed to work this way. I think in theory there’s a typical Apple hack whereby one does Google authentication in OS X System Preferences and OS X is supposed to create keychain entries Mail.app uses. In practice this appears to fail when a user has more than one Google account...

An AskDifferent thread also implications the keychain, and since the keychain is iCloud synced its configuration can poison multiple clients. i suspect Apple (engineer? product?) simply decided to ignore people with multiple Google accounts.

Update 9/26/2015

In much the same thread I ran into a similar configuration problem on a different Yosemite Mac. This time a correspondent reported Google was warning him my email was suspicious:

Screen Shot 2015 09 26 at 3 03 46 PM

I figured that Google was seeing a mismatch between the stated sender domain and the SMTP sending service domain. When I looked in Mail.app account configuration (not to be confused with OS X account configuration) I found this:

Screen Shot 2015 09 26 at 3 00 02 PM

I have two Google accounts configured, one a Google Apps account (single factor) and another a Gmail account (2FA). The “Home” (2FA) account was using the SMTP server I’d labeled “Gmail Work”. Wrong one.

I switched the the Gmail Home (my definition) SMTP server, which was setup this way by OS X. NOTE the lack of password. Despite the UI displayed here OS X doesn’t actually use the account password. It does some other form of authentication for this 2FA account, possibly via some OAUTH token magic stored in the OS X keychain (which is synchronized between devices, and since Google looks for matches between device and credentials I suspect that causes issues):

Screen Shot 2015 09 26 at 3 05 20 PM

After switching the SMTP service to this one (“Gmail Home”) my next email did not generate a phishing warning.

No comments: