4 ms·
I don't get this: > Nothing I did would technically be considered an ‘exploit’ Erm, yes it can? It's exploiting a glaring vulnerability in Google's auth flow,
by petargyurov 6y ago
I don't get this:
> Nothing I did would technically be considered an ‘exploit’
Erm, yes it can? It's exploiting a glaring vulnerability in Google's auth flow, or at the very least a dodgy way to expose master tokens.
- londons_explore 6y agoI believe this flaw was closed last year. Google no longer allows web auth inside app-controlled browsers. If an app can inject JS, Google won't let you log in from it on mobile. It led to outcry from people who have custom compiled browser builds that were also caught up in the restrictions.
- anon321321323 6y agoI was wondering why Google did this. Still seems disturbing that the master token is something that once acquired is still useful even after hours of use. Even if they did plug the web auth hole via app-controlled browsers. I'm surprised a limited time + per app + per user code isn't used, where limited time is enough to be useful for app purposes but not worth storing for long enough to be swept up in some data grab.
- londons_explore 6y agoTime limited tokens don't lend a lot of security. Someone malicious can simply scrape your entire account in the 15 minutes or whatever the validity period is. Scope limited is far better, and something android is bad at. I suspect they are highly constrained by the need to maintain compatibility all the way back to Android 1.0. In my opinion, they should drop support for old android versions by default, and if you want the ability to sign into an old non-updated device, force you to go to a real browser and enable some option like "allow insecure devices".
- ethanblake4 6y agoAuthor here, the exact same thing that I did is possible for any 3rd party SSO on mobile apps. It's not a Google exploit, it's an exploit in the idea of SSO.