4 ms·
Does 2FA help in this situation? If the token signs in from a previously unknown device/server wouldn't it prompt for authentication details?
by knz 10y ago
Does 2FA help in this situation? If the token signs in from a previously unknown device/server wouldn't it prompt for authentication details?
- ec109685 10y agoNo. The malware steals a secret stored on the device that gives the attacker the same access to your google account as your own phone.
- haswell 10y agoFTA: > While Google implemented multiple mechanisms, like two-factor-authentication, to prevent hackers from compromising Google accounts, a stolen authorization token bypasses this mechanism and allows hackers the desired access as the user is perceived as already logged in. The trouble is that auth tokens are generally not tied to a specific device or IP. There aren't really any mechanisms for this in standard OAuth 2.0 flows (if indeed this is what they're using).
- rolodato 10y agoNo, but this would be solved if Google and client applications implemented OAuth token binding: https://tools.ietf.org/html/draft-jones-oauth-token-binding-00 https://tools.ietf.org/html/draft-jones-oauth-token-binding-...