4 ms·
If it is just auth tokens instead of email password, should google be able to invalidate all these auth tokens in their backend immediately? Force those uses
by tonyplee 10y ago
If it is just auth tokens instead of email password, should google be able to invalidate all these auth tokens in their backend immediately? Force those uses to re-login and get new auth tokens?
- KingMachiavelli 10y agoThe malware is still installed and would just capture the new auth tokens. And forcing the user to login would also give the malware an opportunity to capture the actual password.
- deleted 10y ago[deleted]
- tonyplee 10y agoI see. Google should log other signatures such as device id, ip, network, region where the request coming from and use those data as additional layer of security in the backend to help id the folks/org behind hack.