6 ms·
Got it from a Google+ post. https://plus.google.com/103943309878727777440/posts/DCdBqZX3bvQ https://plus.google.com/103943309878727777440/posts/DCdBqZX3... ==
by dannyr 15y ago
Got it from a Google+ post.
https://plus.google.com/103943309878727777440/posts/DCdBqZX3bvQ https://plus.google.com/103943309878727777440/posts/DCdBqZX3...
====================
remember this url: https://accounts.google.com/sesame https://accounts.google.com/sesame . next time you want to check your gmail on a public computer, don't trust even the incognito window because an installed keylogger can record your keystrokes, which unsurprisingly, include your password. use your phone to scan the qrcode on the sesame web page and hit the resultant url -- the desktop browser will automagically redirect to your logged-in gmail without entering your password. yes, i think you do need an android phone with a properly configure google account for this to work.
====================
- danielhunt 15y agoThat seems particularly open to abuse. Couldn't I just link someone to a copy of the QR code and be automagically logged in as them?
- resnamen 15y agoIt raises an approval screen on the phone. It says By proceeding, you give another computer access to the following accounts: * blah@gmail.com STOP! Only proceed if you arrived at this page by scanning a login barcode at google.co. Otherwise, do not proceed! (start with GMail) (start with iGoogle)
- danielhunt 15y agoAh, I see. Thanks for adding that info
- waiwai933 15y agoThere's a bright highlighted warning that says "STOP! Only proceed if you arrived this page by scanning a login barcode at google.com. Otherwise, do not proceed!" Will users read the warning? I would—and did—it really grabs your attention given the fact its background is yellow and takes up so much of the iPhone screen. I suppose there are probably other safeguards as well, given that this is Google—maybe timed expiration?
- wiradikusuma 15y agoI left the page open and after finished reading comments (a minute or two) in HN, the page gave me this popup dialog: [Alert] Login session has expired. Press Ok to reload.
- deleted 15y ago[deleted]
- sabret00the 15y agoThis + 2 Factor-Authentication = Pretty Damn Secure.
- Achshar 15y agobut those two are different things. They are not complimentry (from what i understand)
- sleepyhead 15y agoI assume it is valid for only a short period like the code generated from the Google Authenticator app.
- baby 15y agoI've always been scared about keyloggers in internet coffees or public computers in university/hotels. I really wonder if there's a way around. Especially since, if you can scan this with your cellphone it supposes you have internet on your cellphone.
- VMG 15y agogoogle also offers two-factor authentication
- markkum 15y agoYou can sign in without username and password to OpenID enabled sites with your smartphone and Mepin; https://www.mepin.com/ https://www.mepin.com/
- lell 15y agoHere's a trick: as you are typing in your l/p, click somewhere on the screen to defocus the textbox and then type some random characters and then click back on the textbox. And also type random characters into the textbox, and then select them with the mouse and overwrite them with correct characters. Do this a bunch. Almost all keyloggers just log all key strokes, then people scan for stuff that looks like "john@example.comLkd98/x,". There's still the chance that your internet cafe has a more sophisticated logger on it. But if you do this you've made a real step to fight keyloggers in internet cafes.
- harshadura 15y agoyeah but as i know there are more dangerous key loggers than these kinda ones :@ anyway I appreciate your good idea!
- akronim 15y agoIf I was writing one I'd just be logging posted form fields with a transparent proxy, almost seems easier than a key logger.
- mvermaat 15y ago
- ot 15y ago> i think you do need an android phone with a properly configure google account for this to work. Works fine on my iPhone with RedLaser to scan the QR. It just redirects to Safari which "remembers" my login info.
- username3 15y agoAlso works fine with Google's iOS app.
- nl 15y agoyes, i think you do need an android phone with a properly configure google account for this to work. That's not the case. Presumably accessing the QRCode generates a single use URL, which you can access in the computer browser. There is no client side logic. (Also, Google generally ships stuff on both iOS and Android) (Also, it goes against Google's interest to restrict Google account features to Android)
- jf 15y agoThis works just fine from my Windows Phone.
- rplnt 15y ago> There is no client side logic. There have to be some though. I.e. you have to be logged in to Google on your phone.
- irunbackwards 15y agoNaw, you can technically scan this link w/ another laptop using its webcam.
- wingspan 15y agoWorks fine on my windows phone; remembers my login info from IE.