2 ms·

I'm not sure it's worse, since it requires users to type their password into a non- google.com domain. Whereas the oauth phishing, everything was on google.com

by Buge 9y ago

I'm not sure it's worse, since it requires users to type their password into a non- google.com domain. Whereas the oauth phishing, everything was on google.com so it looked legit.

TomAnthony 9y ago
That is a good point. The flip side is having the account password is far more devastating.