3 ms·
> If your account was affected, you no longer need to do anything. How do you figure? An unknown actor presumably had full access to your email inbox for a non
by ghostly_s 10y ago
> If your account was affected, you no longer need to do anything.
How do you figure? An unknown actor presumably had full access to your email inbox for a non-zero amount of time and the proper remediation is "nothing"? If I was concerned this had affected me I would right now be changing my passwords to ____everything____.
- bitskits 10y agoWhat attack vector does changing your password help with? Are you concerned they could have recovered the account password via the Oauth scope?
- motti 10y agoChanging your password is the fastest way to ensure all authed sessions on any device is logged out. Google offers a "log out of any sessions" button somewhere in account settings, but most other services don't. If your email account is compromised, any service that do password resets via email confirmation, are potentially compromised by whoever has access to your email via OAuth.
- bitskits 10y agoI'm pretty sure that changing your password does NOT revoke your oauth scopes, which was the attack vector here.
- askvictor 10y agoThe greater issue is the passwords of other accounts, which could now be 'recovered' as the attacker has your access to your email
- bitskits 10y agoYes, I agree, although revoking the scope should remove the access (and I assume Google did that for everyone already).
- _pergosausage 10y agoAfter looking at the source code, it looks like all it does is send a copy of itself to somebody in your inbox, and nothing else.
- deleted 10y ago[deleted]
- shmed 10y agoWe dont really have any proof that this is the only code that got executed. Whoever owned the OAuth account had direct access to your information from google's servers, he wouldnt need to go through you as a client to get it.
- Buge 10y agoWell change the passwords to everything except the google account that was compromised. I don't think you can recover the password of a google account through its own gmail inbox. Although I guess if you had a circular recovery chain of this google account depending on a different email that depended on this google account, the attacker could use your email to recover the other email then use the other email to recover this google account. So it might be wise to change the passwords to everything.