News for hackers. Stuff that matters.

A comment on Bypassing Google’s Two-Factor Authentication. Parent comment

Re:Bypassing Google’s Two-Factor Authentication by sneak on Monday February 25, 2013 @04:09PM (#5281817)
No, ASPs can only be used to access account data available over imap, smtp, xmpp, and other non-web protocols that don't allow cookies/asking for the OTP.
[ Parent | on HN ]
Re:Bypassing Google’s Two-Factor Authentication by akgood on Monday February 25, 2013 @04:37PM (#5281994)
Not true. Read the article :)
[ Parent | on HN ]
Re:Bypassing Google’s Two-Factor Authentication by sneak on Tuesday February 26, 2013 @02:02AM (#5284408)
The article says it's fixed.
[ Parent | on HN ]
Re:Bypassing Google’s Two-Factor Authentication by akgood on Tuesday February 26, 2013 @11:27AM (#5286526)
The fix that Google rolled out blocks ASP-based logins from accessing a few highly-sensitive pages on https://accounts.google.com, but otherwise, little has changed. With a quick API request, you can still use an ASP to skip just about any other Google web-based login anywhere on the web. Google might have to completely eliminate their Chrome/Android auto-login feature to actually prevent this sort of thing...
[ Parent | on HN ]