3 ms·
Regarding the answer: >It's worse than that. Web performance tools and similar not only read your credentials but they read the credentials you type and then d
by he0001 7y ago
Regarding the answer:
>It's worse than that. Web performance tools and similar not only read your credentials but they read the credentials you type and then delete. Very nasty. You might be able to get away with not typing, always pasting your credentials. But the javascript has access to your DOM so it can just read every element. The only way to stop that is not to use credentials but to use oAuth and hand you life over to Google. What could go wrong.
What’s the technical explanation how OAuth is safe in this context? If the DOM is accessible wouldn’t other things be accessible?
- L3viathan 7y agoThe authentication happens on a different site (the Google login site) then, and you only get back a token. The worst the ad could do is steal your token then, which will only be valid for a little while.