3 ms·
One of those recent widespread google docs attack used this strategy to get into lots of business g accounts. https://news.ycombinator.com/item?id=14205432 htt
by soared 9y ago
One of those recent widespread google docs attack used this strategy to get into lots of business g accounts.
https://news.ycombinator.com/item?id=14205432 https://news.ycombinator.com/item?id=14205432
- colemickens 9y agoThat's rather specifically not the same attack. One uses the normal OAuth flow and mis-represents a valid application identity in order to get the user to grant permissions normally. The other flow, that the grandparent refers to, redirects users to a phishing domain and steals credentials.