Recent searches
Search options
Administered by:
@jwildeboer@social.wildeboer.net#Oops. "Login with Google" can be abused if you buy a domain name that formerly had accounts, e.g. from a failed startup.
"At the time of writing, there is no fix."
(ignore the clickbait exaggerations on "millions" of at risk accounts etc. Some will claim this is expected behaviour, but Google decided after a bit of back an forth to treat is something that should be fixed and paid a bounty)
https://trufflesecurity.com/blog/millions-at-risk-due-to-google-s-oauth-flaw
@jwildeboer same for buying old domains where the email has been used too register an account without SSO, and can still be used to reset the password, what’s new?
aside of the fact that lots of services do not allow your sso provider to be changed
@jwildeboer I have nearly all of my "login with..." accounts converted into native service logins again, since it's a hell if you decide to give up an account that is used for dozens of OAuth logins. A well working password manager gives you the same comfort as "login with bigbrother" logins, but lets you stay independant. The cases reported here confirm me to recommend giving up these kind of logins.
@StefanMuenz
@jwildeboer
Stefan, I appreciate your suggestion to return to "native service logins".
My trust in the competence, maybe integrity, of Apple, Google, MS is weak.
Are you trusting the biometric system on your devices to allow on-device saved passwords to be used in logins?
BTW, I add two-factor authentication for legal/transactional sites.
@jCarttarBrooke On my mobile device, I use fingerprints to unlock things. But I think I'll never use face recognition, because that simply means that the camera is spying all the time, waiting for me to look at it. And yes, for any really important site two-factor is a good idea.
@jwildeboer
Like an email address that is neglected, that should never expire, the same applies to domain names.
DNS is flawed design.
I run all masters with postgresql streaming to sync updates in seconds. Back in olden times when i used master/slave with zone transfers it was just nuts. Over complicated and slow and much more network congestion.
I don't know what they were thinking with bind 10, it was like mad scientist mode
@jwildeboer I think those "login with" share an issue if you can get a domain at the provider you can create accounts; it does mean you need to get temporary control of the DNS.
e.g. register example.com at Google, adjust example.com's DNS to say you own it then be able to login on websites the rely on that authenticator.
There was an article about this method a few months ago.