4 ms·
But it's not device-specific, which is exactly what makes it less secure. If anybody is able to sniff your password (e.g. due to initially trying to connect wi
by mikelward 9y ago
But it's not device-specific, which is exactly what makes it less secure. If anybody is able to sniff your password (e.g. due to initially trying to connect without TLS accidentally) or MITM your connection or get privileged access to your device (either locally or remotely), then they get access to your email, even from their machines.
- mi100hael 9y agoAny mail client in the wild today will support STARTTLS and won't submit any credentials to Gmail until a TLS connection has been established. If your connection is MITM'd and you accept the bad certificate error or your laptop is totally pwnd, you're screwed regardless of how you're authenticating. In those situations an attacker could still hijack sessions, exfil data, act on your behalf, etc regardless of whether you went through their browser auth flow with MFA.