5 ms·
That's the problem though, isn't it? They don't do password specific permissions, so any leak escalates up to taking over the whole account.
by Tyr42 14y ago
That's the problem though, isn't it? They don't do password specific permissions, so any leak escalates up to taking over the whole account.
- sneak 14y agoNo, ASPs can only be used to access account data available over imap, smtp, xmpp, and other non-web protocols that don't allow cookies/asking for the OTP.
- akgood 14y agoNot true. Read the article :)
- sneak 14y agoThe article says it's fixed.
- akgood 14y agoThe fix that Google rolled out blocks ASP-based logins from accessing a few highly-sensitive pages on https://accounts.google.com https://accounts.google.com, but otherwise, little has changed. With a quick API request, you can still use an ASP to skip just about any other Google web-based login anywhere on the web. Google might have to completely eliminate their Chrome/Android auto-login feature to actually prevent this sort of thing...