The only way that they no longer have access to your e-mail is if you closed that e-mail address , just because you wiped it from the games data doesn't mean someone couldn't simply of copied it on to a piece of paper long ago
Comment has been collapsed.
This type of issue is happening all over net, and not just with google, but Steam and other sites.
While session hijacking is a known type of attacks, the vulnerability discussed is specific to google accounts and exploits an undocumented google oauth endpoint
Comment has been collapsed.
Session hijacking is was I was referring to with the sentence and not the specific exploit with the Google accounts. I'm updating the OP to make that clear, sorry about the confusion.
Comment has been collapsed.
That's my strategy too.
As a bonus, I don't get locked out when someone steals my phone 👀
Comment has been collapsed.
Same. This is an incredible risk of getting locked out.
Sure it improves the security of geniuses who use "1234" as a password on every website, but when you do have strong and unique passwords, it's more debatable.
Issues include:
It's nice to have 2FA as an option, but it's not a one-fits-all thing. People should be able to make their choice and should be provided with as many 2FA options as possible (SMS, e-mail, OTP, etc). And ideally be able to pick combinations of methods. And companies shouldn't drop all their security checks just because someone passed 2FA.
But it's complex and requires a bit more critical thinking than just shoving a ReCaptcha and mandatory SMS down everyone's throat and calling it a day
Comment has been collapsed.
First of all, to steal cookies - they need access to your PC, like running a trojan or something. If they managed to do it - well, your steam account may be the least of your problems then. Also, changing your password will still help if the service you use invalidates existing sessions when you change password. Steam, for example, does this, and in this particular case there was other exploit specifically on google, that allowed to bypass it, and only because of that additional exploit it's kinda more dangerous than usual. Other than that - nothing new, this attack vector is as old as computers.
Comment has been collapsed.
Lovely, thanks for the post. It gains my awareness... Will try to check how they doing upon this hijacking.
Comment has been collapsed.
48 Comments - Last post 1 minute ago by BlazeHaze
1,444 Comments - Last post 36 minutes ago by PicoMan
6 Comments - Last post 47 minutes ago by FranckCastle
96 Comments - Last post 1 hour ago by TacoTues
13 Comments - Last post 1 hour ago by Sh4dowKill
2,113 Comments - Last post 4 hours ago by Landhammer
257 Comments - Last post 4 hours ago by Golwar
813 Comments - Last post 4 minutes ago by JustinPhan
11 Comments - Last post 10 minutes ago by AllTracTurbo
15,214 Comments - Last post 11 minutes ago by Operations
90 Comments - Last post 15 minutes ago by philipdick
366 Comments - Last post 23 minutes ago by natz777
2,320 Comments - Last post 31 minutes ago by hyrokey
5 Comments - Last post 55 minutes ago by Mayanaise
Some people like myself are aware this has been going on for a bit with cookies, but a lot of people out there don't know. Session hijacking is a big issue that can bypass Multi-factor Authentication is happening all over net, and not just with google.
Malwarebytes put out an article yesterday about an exploit that's targeting Google accounts. This is definitely something you should read even if you don't have one, but especially if you do. Hackers are bypassing multi-factor authentication and getting access to accounts and even changing your password won't prevent them accessing it.
https://www.malwarebytes.com/blog/news/2024/01/info-stealers-can-steal-cookies-for-permanent-access-to-your-google-account
I've provided links to two articles below that talk further about session hijacking, one by Imperva and one by Kasperky.
https://www.imperva.com/learn/application-security/session-hijacking/
https://www.kaspersky.com/resource-center/definitions/what-is-session-hijacking
Comment has been collapsed.