facebookSecurity
Apparently my Facebook login notification emails me if someone has logged-in to my account, without any approval link/code in the email they send me.
Is that really the way it's supposed to work?
Because if it is, then I think it's quite useless since the unauthorized user already gained access anyway.
Or, does it have an approval link/code that I am missing?
You can configure Facebook to always ask you to register the device whenever you log in to a new location. It then shows a log of where you have recently logged in from. Note that when you log in it asks you to choose the location name yourself, so it's possible that an attacker could get a lucky guess as to what you would set it to yourself, but this can help determine if people might be accessing your account without your permission.
To enable this setting, click on the Account dropdown in the upper right, then click Account Settings. Then click "manage" next to the Security section. There you can enable tracking and see where you've logged in from and when.
account security http://cl.ly/ad11c9c96b3692e57a75/content
Since I originally posted this answer, the tool has been updated, and now shows the location you last logged in from, based on GeoIP. If you hover over the estimated location, it will tell you the IP associated with that login. It will also tell you what type of device you were logged in from, for example, chrome on Windows 7. You can terminate any other sessions which may be unauthorized activity.
Google is probably using information that it has not specifically requested of you during the password reset process in order to verify your ownership of the account. Specifically, tokens stored on your computer, and your IP address.
I had a similar experience to yours, which initially alarmed me, and tested the above theory by using the Tor browser to perform the reset. This browser redirects a Web session through Tor's own servers in Europe, making your session more anonymous.
The result was a much more aggressive set of questions. The first time I attempted to reset the password, I just blew them off, and hit a brick wall. I tried a second time, and once I had answered the questions somewhat correctly, I was presented with an emailed link to a reset page. When I clicked that link, since I have two-step verification set up, I was presented with a demand for a number provided by the Google Authenticator app on my phone. I provided that number and only then was I allowed to reset the password.
This experience gives me more confidence in the process. Google, while fallible, is not a huge corporate playpen full of idiots. Password security is a critical feature of Google's business, and I'm sure that they have thought long and hard about how best to allow legitimate users who are schleppy enough to lose passwords to get them back without allowing thieves to run off with all the Google accounts.
Best Answer
The email messages you are talking about are sent as login notifications and it really is how they're supposed to work. It is a separate feature from login approvals, which require to enter a code received by SMS.