News for hackers. Stuff that matters.
Re:Ask HN: Gmail account security by 1vuio0pswjnm7 on Sunday January 23, 2022 @09:39PM (#30053075)
"We don't have an easy workaround (besides a sketchy cookie hack that took hours to reverse engineer) right now and have been trying to get in touch with them."

First thing I do when creating a new Gmail account, using a "supported" browser, is to save the required parameters of the cookie in a text file then convert the file to a simple shell script, powered by netcat and TLS proxy. This only takes me takes seconds. Then I close the supported browser without logging out. The word "sketchy" seems applicable because unlike, e.g., a bank website, companies like Google and Facebook will let users stay "logged in" for some ridiculously long period like one year. Yikes.

Two ways to disable the script are 1. log out of that session (://mail.google.com/mail/logout?ec=ABCDEF, ://accounts.google.com/Logout?service=mail&continue=https://mail.google.com/mail/, ://mail.google.com/accounts/ClearOSID) or 2. change the password.

This tiny script can be transferred to any computer and used to check and send mail from the command line. No browser, Javascript or password required.

Netcat, the browser of the future! :)

There are no comments on this comment yet.