Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s OAuth login doesn’t protect against purchasing a failed startup domain

trufflesecurity.com

Post reply on HN
Print view View original

131–140 of 297 posts

Re: Google’s OAuth login doesn’t protect against purchasing a failed startup domain

#131

Post by red_trumpet »

nodamage wrote: post #122
stackghost wrote: post #7

It's not 100% clear to me, from reading TFA, what the actual vuln is. Suppose DankStartup folds and I, being a morally-dubious sort of fellow, purchase dankstartup.net which I then use to sign into DankStartup's O365, or DankStartup's ChatGPT as a DankStartup employee. Isn't that a failure on DankStartup's part, to not shut down their business accounts? And isn't it also a failure on e.g. Microsoft or OpenAI's parts,…

I agree, I don't think this is a problem with Google's Oauth implementation, it's a problem with the service providers who authenticate users via the mere existence of an email address ending in @company.com without checking if the email address actually belongs to an active employee. If, when you logged into Slack via Google Oauth with the email address user@company.com, Slack checked with company.com whether user@c…

If the attacker is in control of company.com, checking against this domain would not help.

Re: Google’s OAuth login doesn’t protect against purchasing a failed startup domain

#133

Post by btown »

ds wrote: post #116

Nearly a decade ago, there was a website called thehunt.com that basically ran out of money and some employees were acqui-hired by pinterest. All of the assets were left to rot and at the time the company was a good match for another startup of mine. So I reached out to the investors I found on crunchbase and asked if I could acquire everything. We worked out a deal and I did. The issue was the complete lack of peopl…

Huh - it's almost like the mere existence of a pendingDelete in the history of a domain should make every email existing on that domain at that time eligible for https://haveibeenpwned.com/ .

Re: Google’s OAuth login doesn’t protect against purchasing a failed startup domain

#134

Post by nodamage »

red_trumpet wrote: post #131
nodamage wrote: post #122

Earlier quoted context omitted.

I agree, I don't think this is a problem with Google's Oauth implementation, it's a problem with the service providers who authenticate users via the mere existence of an email address ending in @company.com without checking if the email address actually belongs to an active employee. If, when you logged into Slack via Google Oauth with the email address user@company.com, Slack checked with company.com whether user@c…

If the attacker is in control of company.com, checking against this domain would not help.

I'm not talking about checking against the domain, but checking against a directory of active users.

Re: Google’s OAuth login doesn’t protect against purchasing a failed startup domain

#135

Post by dml2135 »

paxys wrote: post #113

It's crazy just how little effort it takes to get a "Google = bad" article to the top of HN. There is no vulnerability in Google OAuth. This is exactly how every OAuth server is supposed to work. If you take over a domain, you automatically own every email address in that domain, and thus whatever external account relies on that email for login. Heck the result would be the same even if that service didn't use Google…

I think part of the issue is that this is where the abstraction that we call "account ownership" starts to leak.

You may correctly have access to an account through this scenario, but that does not make it your account. This becomes obviously when we consider an account at a bank, for example.

Re: Google’s OAuth login doesn’t protect against purchasing a failed startup domain

#136

Post by grepfru_it »

patmcc wrote: post #125
danudey wrote: post #59

Earlier quoted context omitted.

Well, think about it this way: 1. I create DankStartup and my company uses Google workspaces and Google auth for a bunch of stuff, like payroll. 2. DankStartup goes under and we close our Google accounts/let our domain lapse. 3. Someone else buys DankStartup.com, sets up a Google workspace, and attempts Google auth to log into stuff, and it works. The problem is that the original DankStartup has a Google account that…

>>>The problem is that the original DankStartup has a Google account that they create in #1, and Google goes around telling other sites (via Auth) "this is user X from company Y". Google is telling other sites that it's bob@DankStartup.com - isn't that true? Isn't this on DankStartup to close down operations cleanly?

Part of my company dissolution process is to renew the domain name for 10 years to prevent exactly this

Re: Google’s OAuth login doesn’t protect against purchasing a failed startup domain

#137

Post by batch12 »

nodamage wrote: post #134
red_trumpet wrote: post #131

Earlier quoted context omitted.

If the attacker is in control of company.com, checking against this domain would not help.

I'm not talking about checking against the domain, but checking against a directory of active users.

Where would this directory be stored?

Re: Google’s OAuth login doesn’t protect against purchasing a failed startup domain

#138

Post by radlad »

nodamage wrote: post #134
red_trumpet wrote: post #131

Earlier quoted context omitted.

If the attacker is in control of company.com, checking against this domain would not help.

I'm not talking about checking against the domain, but checking against a directory of active users.

That's what an identity provider (e.g. AD, OneLogin, Okta, Duo SSO, Google OAuth, etc.) is supposed to be, ostensibly.

Re: Google’s OAuth login doesn’t protect against purchasing a failed startup domain

#139

Post by p_ing »

stackghost wrote: post #7

It's not 100% clear to me, from reading TFA, what the actual vuln is. Suppose DankStartup folds and I, being a morally-dubious sort of fellow, purchase dankstartup.net which I then use to sign into DankStartup's O365, or DankStartup's ChatGPT as a DankStartup employee. Isn't that a failure on DankStartup's part, to not shut down their business accounts? And isn't it also a failure on e.g. Microsoft or OpenAI's parts,…

> DankStartup's O365,

If you wanted to try to re-take over a pre-registered domain in Azure/M365, you would need to involve Microsoft Support who would require you to prove via government documentation that you were the same entity for the now-abandoned Azure/M365 account.

Creating a new tenant using the same public domain won't get you access to the Azure/M365 tenant of a previous customer, you would have a different internal domain name (dankstartup2.onmicrosoft.com).

At best you could register your domain post-expiration of the previous tenant and impersonate them >90 days out.

Re: Google’s OAuth login doesn’t protect against purchasing a failed startup domain

#140

Post by nevir »

rahimnathwani wrote: post #128
nodamage wrote: post #122

Earlier quoted context omitted.

I agree, I don't think this is a problem with Google's Oauth implementation, it's a problem with the service providers who authenticate users via the mere existence of an email address ending in @company.com without checking if the email address actually belongs to an active employee. If, when you logged into Slack via Google Oauth with the email address user@company.com, Slack checked with company.com whether user@c…

If, when you logged into Slack via Google Oauth with the email address user@company.com, Slack checked with company.com How would they check that?

By looking the account up with Google's People API - https://developers.google.com/people

They would have to verify the account is active, AND the id hasn't changed

Post reply on HN