What should I do about Gmail ad asking me for password?

This seems unlikely but not unthinkable. From the information in your question and the supplied screenshot, it seems that the Google ad domain was or currently is compromised.

What to do now?

Firstly, make sure that you have antivirus and anti-spyware software installed and that this software (including your operating system) is up-to-date. It is a good idea to let your antivirus and anti-spyware software run a full system scan.

Secondly, even if you didn't fill in your credentials, I'd recommend to change your password as soon as possible with an ad blocker (like Adblock Plus, Adblock, uBlock Origin or similar) installed and enabled in your browser. It is recommended to enable two-factor authentication on your Google account (if you didn't do that already) to prevent (future) leaked credentials from being misused.

Thirdly, contact Google about this and supply them with details like your IP, URL, screenshots, date/time and as much information as you have. You can contact Google about this at "goo.gl/vulnz" or check https://www.google.com/about/appsecurity

Additional information

Alternative explanation

Another explanation for this could be (although this would be unlikely and amateurish for a company like Google) that the developers overlooked a mistake in the development, testing and releasing process.

Also (as mentioned in different comments) this result could possibly be caused by some kind of man-in-the-middle attack (like a hacked proxy) or a malicious browser extension.

Why change your password if you didn't fill in your credentials?

The site showed an unusual but visible "basic auth" prompt from an external domain. Assuming that the domain was compromised (at least until it is proven not) the attackers could as well include other code that was not directly visible. Maybe persistent in cache? Maybe some kind of malware? Since we can't exclude that possibilities also, and since a password change or virus/malware scan won't hurt anyone, these are extra measures, just to be sure.

Is doubleclick.net really owned by Google?

Yes! As described in this Wikipedia article and as shown in the WHOIS information of doubleclick.net. Registrant Organization: Google Inc.


As web developer, I agree with Andrew it all points that it was a developer's mistake. They probably password protected some of the resources required for some of the ads (for example, css, js, a font, an image, a json, etc).

I tried with my gmail account and is also happening. The protected link is:

https://googleads.g.doubleclick.net/pagead/drt/si?ogt=1&pli=1&auth=bgN4B9npCUq44nAGCAS6CK9DwN2HLgJWDF_NXi4wRqkGyC8mp1_mF5KWfi_pZjAwWn9zCg.

Note: I changed the "auth" value as I don't know if contains private information in it.

But trying to open it directly fails (it must have some kind of verification. See the "auth" parameter).

It is not asking for your gmail credentials. If they were trying to get your credentials, instead of "Google" it would have said: "Please enter your gmail user and password".

Just don't enter your credentials. Maybe there is already some report about that going on.

Its very strange that they haven't fix that already.

UPDATE

I reported the issue here: https://support.google.com/mail/contact/gtag?hl=en

UPDATE 2

The problem seems to be gone in my account.

Looking into more detail, "doubleclick.net" is a subsidiary of Google and it seems it doesn't have a great reputation.

Is not the first time that this "password pop-up" happens with this company, here is a report back in Jun 22 and 2005.

BTW, someone else reported it too in SO.


This is an HTTP(S) Auth window. It looks like a Google Ad is misconfigured.

You should report it to Google immediately.