3 ms·
It works because they aggressively monitor for session stealing attempts and immediately shut them down. So it's long lived but with an impressive amount of mon
by mentat 12y ago
It works because they aggressively monitor for session stealing attempts and immediately shut them down. So it's long lived but with an impressive amount of monitoring that really isn't within reach for non-Google companies.
- kuschku 12y agoI can tell you: They do not. I made a small program to access Google Keep automatically. Because I was too lazy to implement proper authentication, I just hardcoded my session keys. The app is started from a different IP, using a different user agent and is STILL able to access the site after weeks! (Nowadays I have proper authentication in there, but it’s still worrying that stealing sessions from Google is so easy. Especially because some Google services submit their sessions keys via HTTP, without SSL)
- abalone 12y agoThat is not enough evidence to conclude that Google does not monitor for session stealing. Lots of people have dynamic IPs and user agent strings are easily spoofed. They're going to be looking at other factors, like where the IP is located.
- mentat 12y agoI can tell you they do. Within seconds of clicking on a compromised URL they had locked down my account requiring a text to unlock it. I was deeply impressed.
- PythonicAlpha 12y agoI don't think, that such a scheme can work, when somebody else is using my laptop. Sometimes the simplest attacks are the most effective.