141–150 of 220 posts
Earlier quoted context omitted.
What attack vector does changing your password help with? Are you concerned they could have recovered the account password via the Oauth scope?
The greater issue is the passwords of other accounts, which could now be 'recovered' as the attacker has your access to your email
Earlier quoted context omitted.
Passwords for authentication was just always a flawed idea, typing them into the DOM and sending them over the wire even more so.
I agree. However I have yet to see a better alternative. Are there any out there?
I reported this attack vector to Google back in 2012. They awarded a modest bounty, and then a few months later I heard this: > "We're deploying some abuse detection and reactive measures to deal with impostors that might try to abuse this sort of attack. Given this, we do not intend to perform validation that the URL matches the branding information." That last part was in reference to one of my proposed mitigations…
Unicode domain names, Google OAuth phishing...changing my passwords every 30 days is looking less and less important. It's sad we can't seem to provide good, usable secure software.
Using some non-English Unicode text as password will make the password really strong. I sometimes include Malayalam text for passwords as it's my native language.
Earlier quoted context omitted.
What attack vector does changing your password help with? Are you concerned they could have recovered the account password via the Oauth scope?
Changing your password is the fastest way to ensure all authed sessions on any device is logged out. Google offers a "log out of any sessions" button somewhere in account settings, but most other services don't. If your email account is compromised, any service that do password resets via email confirmation, are potentially compromised by whoever has access to your email via OAuth.
Earlier quoted context omitted.
Passwords for authentication was just always a flawed idea, typing them into the DOM and sending them over the wire even more so.
I agree. However I have yet to see a better alternative. Are there any out there?
Here's an article: https://medium.com/@ninjudd/passwords-are-obsolete-9ed56d483...
Here's an interesting case that I encountered (~1:20pm maybe): 1) I clicked on the link on my phone's email app. It looked super believable since it was coming from a person I was expecting a Google Doc invite from. I allowed access to "Google Docs" and then the page hit a 502 gateway error. 2) I tried it again on my computer by logging in, and this time, when the page was loading (after I allowed access), I saw the…
This happened to me. An unknown person from my organization shared a Google doc. I didn't open it, and replied by saying 'what is this about?'. He said he didn't send any gdocs :|
Earlier quoted context omitted.
Unicode domain names, Google OAuth phishing...changing my passwords every 30 days is looking less and less important. It's sad we can't seem to provide good, usable secure software.
> changing my passwords every 30 days is looking less and less important. Using some non-English Unicode text as password will make the password really strong. I sometimes include Malayalam text for passwords as it's my native language.
It's a pretty nasty one, since it uses their standard OAuth flow with an app "Google Docs" to have users grant full access to their email and contacts. 1. I can't believe Google doesn't have basic filters to disallow developers from registering an app named "Google Docs" 2. Perhaps there should be some more validation/limits associated with allowing apps on the platform that can gain full access to email. A secure em…
I think they do, I got an app shut down because it was named too similar to one of their products, this was just a week ago or so.
I reported this attack vector to Google back in 2012. They awarded a modest bounty, and then a few months later I heard this: > "We're deploying some abuse detection and reactive measures to deal with impostors that might try to abuse this sort of attack. Given this, we do not intend to perform validation that the URL matches the branding information." That last part was in reference to one of my proposed mitigations…
This was particularly effective because the app was registered as "Google Docs" - to not even filter names of your own products out seems ripe picking for imposter apps.