Its a malicious OAuth client (multiple clients?) that calls itself "Google Docs" and fooled user into giving access to read emails, while pretending to show as

Its a malicious OAuth client (multiple clients?) that calls itself "Google Docs" and fooled user into giving access to read emails, while pretending to show as if it was needed by GDocs itself to access a Document, enabling launch of among other things password resets on other websites. the root problem seems to be that the identity of OAuth Servers is not authenticated/clearly shown, i.e. a malicious app can claim that its name is Google Docs even though it is not endorsed by Google. IMPORTANT NOTE: If you are running any website that has "Reset my password" it might be used by attacker, since even though the attacker does not have access to password, the attacker had access to email inbox. Thus the email password reset flow will allow attacker to compromise other websites that rely on Gmail account for password resets. https://twitter.com/zachlatta/status/859843151757955072?ref_src=twsrc%5Etfw&ref_url=https%3A%2F%2Ftwitter.com%2Fzachlatta%2Fstatus%2F859843151757955072 https://twitter.com/zachlatta/status/859843151757955072?ref_... https://www.dropbox.com/s/l024nggmcizub40/Screenshot%202017-05-03%2016.01.26.png?dl=0 https://www.dropbox.com/s/l024nggmcizub40/Screenshot%202017-...