Hackers have discovered a way to access Google accounts without a password
www.independent.co.uk
‘Exploit enables continuous access to Google services, even after a user’s password is reset,’ researcher warns

Hackers discover way to access Google accounts without a password::‘Exploit enables continuous access to Google services, even after a user’s password is reset,’ researcher warns

  • fatalicusEnglish
    17•1 year ago

    So it is session hijacking, something that has been known for a while?

    • @[email protected]English
      9•1 year ago

      The main difference that makes this worse is that they can get persistence and maintain access even if the user resets their password (i.e. revoke session tokens). Hackers are usually limited to the fairly short lifetime of the session token (usually a few hours).