The only way that they no longer have access to your e-mail is if you closed that e-mail address , just because you wiped it from the games data doesn't mean someone couldn't simply of copied it on to a piece of paper long ago
Comment has been collapsed.
This type of issue is happening all over net, and not just with google, but Steam and other sites.
While session hijacking is a known type of attacks, the vulnerability discussed is specific to google accounts and exploits an undocumented google oauth endpoint
Comment has been collapsed.
Session hijacking is was I was referring to with the sentence and not the specific exploit with the Google accounts. I'm updating the OP to make that clear, sorry about the confusion.
Comment has been collapsed.
That's my strategy too.
As a bonus, I don't get locked out when someone steals my phone 👀
Comment has been collapsed.
Same. This is an incredible risk of getting locked out.
Sure it improves the security of geniuses who use "1234" as a password on every website, but when you do have strong and unique passwords, it's more debatable.
Issues include:
It's nice to have 2FA as an option, but it's not a one-fits-all thing. People should be able to make their choice and should be provided with as many 2FA options as possible (SMS, e-mail, OTP, etc). And ideally be able to pick combinations of methods. And companies shouldn't drop all their security checks just because someone passed 2FA.
But it's complex and requires a bit more critical thinking than just shoving a ReCaptcha and mandatory SMS down everyone's throat and calling it a day
Comment has been collapsed.
First of all, to steal cookies - they need access to your PC, like running a trojan or something. If they managed to do it - well, your steam account may be the least of your problems then. Also, changing your password will still help if the service you use invalidates existing sessions when you change password. Steam, for example, does this, and in this particular case there was other exploit specifically on google, that allowed to bypass it, and only because of that additional exploit it's kinda more dangerous than usual. Other than that - nothing new, this attack vector is as old as computers.
Comment has been collapsed.
Lovely, thanks for the post. It gains my awareness... Will try to check how they doing upon this hijacking.
Comment has been collapsed.
216 Comments - Last post 6 minutes ago by UnbakedBacon
15,430 Comments - Last post 45 minutes ago by MarvashMagalli
1,356 Comments - Last post 57 minutes ago by Tobost06
478 Comments - Last post 2 hours ago by Themnish
29 Comments - Last post 3 hours ago by OsManiaC
318 Comments - Last post 9 hours ago by CelticBatman
557 Comments - Last post 11 hours ago by jiggakills
1,192 Comments - Last post 2 minutes ago by Gelweo
20 Comments - Last post 3 minutes ago by ELGADO26
108 Comments - Last post 8 minutes ago by ormax3
211 Comments - Last post 13 minutes ago by newold321
24 Comments - Last post 28 minutes ago by Raggart
2,719 Comments - Last post 30 minutes ago by Chris76de
113 Comments - Last post 58 minutes ago by DrSlitheen
Some people like myself are aware this has been going on for a bit with cookies, but a lot of people out there don't know. Session hijacking is a big issue that can bypass Multi-factor Authentication is happening all over net, and not just with google.
Malwarebytes put out an article yesterday about an exploit that's targeting Google accounts. This is definitely something you should read even if you don't have one, but especially if you do. Hackers are bypassing multi-factor authentication and getting access to accounts and even changing your password won't prevent them accessing it.
https://www.malwarebytes.com/blog/news/2024/01/info-stealers-can-steal-cookies-for-permanent-access-to-your-google-account
I've provided links to two articles below that talk further about session hijacking, one by Imperva and one by Kasperky.
https://www.imperva.com/learn/application-security/session-hijacking/
https://www.kaspersky.com/resource-center/definitions/what-is-session-hijacking
Comment has been collapsed.