3 ms·
How are they going to get the picture? And even if they do, they can phish one person.
by deletes 13y ago
How are they going to get the picture? And even if they do, they can phish one person.
- peterkelly 13y agoIf they have a list of usernames (easy enough to get, or guess), they just have to do an automated series of bulk requests
- eli 13y agoYou're both overthinking it... How would your web browser normally get the picture from Google during a legit login? Something like submit your username to a page and get a picture back? The bad guys would use exactly the same process just with the malicious server as a MITM.
- peterkelly 13y agoGood point - this would be a very simple way to circumvent it.