6 ms·

If somebody uses my laptop, my Gmail account is not compromised; I'm being dolphined. Of course 5 days is quite a long time, but this is just to clarify what yo

• mimikatz 5y ago
  If I use your laptop to get access to your Gmail isn't your Gmail account compromised? I might not have access to your Gmail username and passwords (and MFA), but I can read your email, I can send email as you, etc etc. I feel like I have compromised your gmail account. If I steal your secure token and log into you through a cloned browser session and access your gmail have I compromised your gmail? It feels like it. Maybe it is just a distinction without a difference.
  • tomnipotent 5y ago
    > your Gmail account compromised The access is transient and you remain in ownership over the credentials and account, because the credentials were not compromised (just the programs/browsers with pre-existing auth). Though with physical access it's probably only a mater of time before local admin passwords are brute forced and access to keychain/browser saved logins is inevitable? > If I steal your secure token It's more like you just logged in using your secure token then someone stole the device and took advantage of that. I think we can all agree there's a difference between having access to the laptop and access to the account without the laptop.
    • shkkmo 5y ago
      > I think we can all agree there's a difference between having access to the laptop and access to the account without the laptop. There is a difference, but that difference is not the one you seem to be implying. An account can be compromised even it it hasn't been fully and permanently taken over. The temporariness of an account being compromised does not mean the account was not compromised. You can make a distinction and clarify that the account was compromised but that the account credentials were not. However if you extend that to saying that the account was not compromised when attackers did have temporary access, then you are simply lying.
    • hota_mazi 5y ago
      If someone has access to your email account, they more than likely will be able to password reset quite a few accounts (I'd start by searching your inbox for which banks/stock trades you use and take it from there).
• warp 5y ago
  "had access to a support engineer’s laptop" is very vague, they could have: 1. some kind of remote access to the support engineer's session on that laptop 2. physical access, no login 3. physical access as a different user 4. physical access, logged in as the support engineer If I have access to your laptop, logged in as you, and you have Gmail open in a browser, then your Gmail account should be considered compromised. (e.g. I could set up a forwarding address in your Gmail settings, set up a POP/IMAP password, steal your session/remember me cookies, install some dodgy software which makes sure I have remote access to your laptop in the future, etc..).
  • nopcode 5y ago
    Access to the laptop could also be completely unrelated. The threat actor used a breached Thin client to access Okta...
• hdlothia 5y ago
  what does dolphined mean. is this a cyber security term?
  • ASalazarMX 5y ago
    It might be a new term that denotes someone who thinks a stranger having access to their computer doesn't compromise their accounts.
  • Khaine 5y ago
    if its a cyber term, its not common. I've never heard it before.
  • vault 5y ago
    https://www.urbandictionary.com/define.php?term=Dolphining https://www.urbandictionary.com/define.php?term=Dolphining
• ralmeida 5y ago
  If someone has access to your laptop with a logged-in Gmail account, they could change your password and log you out of your other devices, effectively gaining total control of your account and locking you out.
  • glckr 5y ago
    Typically services will have you confirm your current password before allowing you to change it (for exactly this reason).