Then oauth based attacks like this come along and your password (however strong it may be) and two-factor auth are bypassed completely... It's interesting Apple can scale personally vetting apps for the app store but Google apparently can't be bothered to do the same for apps that could actually ruin businesses and lives with the data they could scoop up

It is not quite a virus, it works more akin to a trojan and exploits people not thinking about what they're clicking.

In 10s, why would Google docs ask for an oAuth prompt with big permissions?

People click through security dialogs, it is a known fact.

Funny that you'd ask that, as when developing Google Script automation scripts, Google Docs asks for exactly that.

(Of course, this is a different situation and all, and there is a lot of sense in your comment that mine doesn't at all invalidate.)

Or made up Malayalam words such as Melcow!

cs91PvMVtET37V%eKEMut0LI^kQYp3e&jSuCGl!9Lp

Lastpass.

All I see are asterisks, weird.

Bravo. Masterclass username for this comment. I'm dying.

(For those who may have missed it in this HN crowd, let me momentarily invoke a veil of joke-explainer and offer this http://knowyourmeme.com/memes/hunter2 of the joke.)

Haha, I've been around for a while but that one I missed. Awesome.

HackerNews: Where the subtlety of a comment's humor is inversely proportional to the size of the cognitive DDOS it initiates.

Oh. I just grabbed what would have been my next random 42 character password, hoping that would be sufficient to prove the point that (almost) ridiculously long one time use passwords is the way to go.

Appropriate username indeed!