3 ms·
Also Google requires you to re-enter your password. The fact that his browser was set up to auto enter passwords without any prompt (not the default) and the fa
by pat2man 6y ago
Also Google requires you to re-enter your password. The fact that his browser was set up to auto enter passwords without any prompt (not the default) and the fact that his machine was open to the internet means that Google probably had enough security here.
- ryanianian 6y ago> Google requires you to re-enter your password And it does it at unpredictable and often inconvenient times. The periodic check is undeniably good for security. But google's impl doesn't give the user any indication of when it will happen, and it doesn't allow the user to preemptively re-auth to restart the clock. This means that I always end up having to re-auth right in the middle of sharing my screen or right when I'm trying to quickly find a thing and in a state of flow. On good days 1pw is already unlocked and can autofill the login. On bad days I have to manually unlock 1pw and/or hunt for the pw and hope my colleagues don't see my other saved sites and then hope that I don't accidentally paste my password in a doc or something - let alone worry about destroying what was on the clipboard before google decides to do this. Security and convenience are always at odds, but that doesn't mean you need to give a middle finger to basic UX in the name of security.
- andrewxdiamond 6y agoWhy cant you just log out and back in to preemptively trigger the login?
- ryanianian 6y agoThat screws up your default account order if you have multiple google accounts for work vs personal
- kelnos 6y agoAlso IIRC you can't just log out of one account; signing out signs you out of all accounts. That makes it even less likely that I'd ever want to do that.
- aspenmayer 6y agoYou can run multiple browser profiles, or use something like Firefox Containers to sidestep this pain point. I use my own profile on a hot seat shop PC, and every user has their own desktop shortcut, which directly opens the appropriate profile in the browser. I can be signed in to multiple different Google accounts simultaneously in this way. Signing out signs out for every Google account in that browser profile; adjacent browser profiles' sign-in state is not affected by signing out on first profile. Hope this helps.
- kccqzy 6y agoIt might be a recent change but I think you can log out of individual accounts now.
- EE84M3i 6y ago>it doesn't allow the user to preemptively re-auth to restart the clock. AFAICT there are separate clocks for separate high-privileged actions, and some actions require re-authentication every time. As an example, accessing a saved password on passwords.google.com requires re-authentication for each item you want to access.
- occamrazor 6y agoIIRC it has a very short reauth delay, but not zero (i.e. I can look at two or three passwords in a row, but not more)
- EE84M3i 6y agoI tried it on my laptop in chrome (via the web interface) before posting that and was prompted before looking at the second password. It's possible the interface in the chrome native settings or the passwords.google.com interface via chrome on android (which somehow uses native lock screen auth??) are slightly different.
- lordlimecat 6y agoYou're saying they "probably had enough security" in an article where a reused token was sufficient to fully compromise the account and disable 2fa.