3 ms·
Yes, that's the way it works. But what's stopping a bad actor from putting up a bogus "Sign in with Google" form on their website solely to harvest credentials
by jgalt212 4y ago
Yes, that's the way it works. But what's stopping a bad actor from putting up a bogus "Sign in with Google" form on their website solely to harvest credentials?
- joshuamorton 4y agoWhat credentials could they harvest? If I'm asked to sign in with google via oauth, I never type in my password (or username!).
- funstuff007 4y agotrue, but that's only the case if you're currently authenticated with Google. Not true after deleting cookies and/or local storage. But more importantly, less savy tech folks might not be aware that they should not have to re-enter credentials if they have recently logged into gmail or other google owned services.
- mukesh610 4y agoI'm confused. In your first comment you seemed to refer to legitimate sites harvesting credentials using Google SSO (whatever that means) Now you're talking about phishing sites. Can you clarify which kind of websites you're referring to?
- deleted 4y ago[deleted]
- jgalt212 4y agoI was always talking about bad actors (i.e. phishing sites).