Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Google Doc email virus?

news.ycombinator.com

Post reply on HN
Print view View original

211–220 of 220 posts

Re: Ask HN: Google Doc email virus?

#211

Post by ademarre »

ademarre wrote: post #99

I reported this attack vector to Google back in 2012. They awarded a modest bounty, and then a few months later I heard this: > "We're deploying some abuse detection and reactive measures to deal with impostors that might try to abuse this sort of attack. Given this, we do not intend to perform validation that the URL matches the branding information." That last part was in reference to one of my proposed mitigations…

To be clear, I'm not criticizing Google. Just presenting an interesting piece of information that shows the approach they've taken on this type of phishing attack in the past.

Phishing is a hard problem, and any technical solution will only go so far. The main criticism I have with many OAuth authorization dialogs, not just Google's, is that they often don't show enough information for technical users to vet the authenticity of the app. It's like if a web browser didn't show the address bar.

Re: Ask HN: Google Doc email virus?

#212

Post by wmil »

amenghra wrote: post #191
wmil wrote: post #142

Earlier quoted context omitted.

Did they ever solve the privacy issues with browser client certificates?

TLS 1.3 may solve some things. It depends what you lean by "the privacy issues"...

I'm not an expert or even particularly up to date, but I heard that other websites could see the client certificates installed. So a third party website might recognise the client certificate and know things about the user.

Re: Ask HN: Google Doc email virus?

#215

Post by os400 »

G Suite customers have been asking for the ability to whitelist OAuth clients/scopes for their domains for years, for this exact reason. So far, Google hasn't really given a shit.

I guess that might finally change now.

Re: Ask HN: Google Doc email virus?

#216

Post by glubGlub »

Scea91 wrote: post #195
glubGlub wrote: post #180

Earlier quoted context omitted.

Complexity doesn't reduce security. Complexity can both improve and reduce security depending on specifics, and thus generalizes to "no correlation" demonstrating that generalizations are often misleading.

Your claim that it generalises to "no correlation" is not supported by your assumptions.

Uh, begging pardon, but what are my assumptions again?

Re: Ask HN: Google Doc email virus?

#219

Post by machine-wisdom »

paulddraper wrote: post #113
ademarre wrote: post #99

I reported this attack vector to Google back in 2012. They awarded a modest bounty, and then a few months later I heard this: > "We're deploying some abuse detection and reactive measures to deal with impostors that might try to abuse this sort of attack. Given this, we do not intend to perform validation that the URL matches the branding information." That last part was in reference to one of my proposed mitigations…

Unicode domain names, Google OAuth phishing...changing my passwords every 30 days is looking less and less important. It's sad we can't seem to provide good, usable secure software.

When you change your Google password, all OAuth tokens are revoked. The next time you use an OAuth connected App you will have to authorize it again, hopefully not making the same mistake twice.

Re: Ask HN: Google Doc email virus?

#220

Post by kelnos »

Alex3917 wrote: post #88
kelnos wrote: post #71

Earlier quoted context omitted.

> The gmail account you use to talk with people shouldn't be the same one you use to send password resets to. The vast majority of services don't support setting a separate password reset email, so that would be a showstopper for most people. You'd end up just having another email account you have to check all the time (since non-reset email would also go to this account), and could still easily get bitten by this so…

> You'd end up just having another email account you have to check all the time You'd need an extra tab open in your browser that you'd need to check multiple times per day. But most automated messages don't require a response within fifteen minutes or whatever, so there isn't much extra cognitive overhead. And for most people you probably also don't need that email address authed on your phone.

The cognitive overhead is not my objection (and I agree it wouldn't be much). The problem is that most people's personal email isn't primarily about correspondence anymore; it's about interacting with the various services where you have accounts or subscriptions. So your special password-reset email is also the place where you receive your social media notifications (because your social media account doesn't let you set a separate email for notifications and password resets). So now your password-reset email account is just as vulnerable to phishing because it's _not_ just your password-reset email, and there's no way to make it so.
Post reply on HN