Data from 183 million email users, including many Gmail users, leaked online

[Justanotherguybythesea]

Just remember all those sites that ask you to log in with Gmail are also risky as well, as they then have a token that can be used to log you in on any other sites you did the same on. One of them loses that all are compromisable.

 

[Tim_vb]

Warning to MYBB writers who use "Warning to" in the headline.

bad news for my MyBB editors...

 

[Swa]

Just remember all those sites that ask you to log in with Gmail are also risky as well, as they then have a token that can be used to log you in on any other sites you did the same on. One of them loses that all are compromisable.

Not exactly how I understand it to work and would be bad security. What they get is your email among other info. It's then up to the site how they handle it and any token issued would only be usable on the site.

 

[gregmcc]

Not exactly how I understand it to work and would be bad security. What they get is your email among other info. It's then up to the site how they handle it and any token issued would only be usable on the site.

Yes and no

Depends if the 3rd party site stores your refresh token.

Access is granted using oauth2 which uses access and refresh tokens. If the refresh token is compromised it could be used by another evil website to generate another access token.

This is why Google lets you revoke oauth2 access which you should regularly review to see who is using them

 

[Swa]

Yes and no

Depends if the 3rd party site stores your refresh token.

Access is granted using oauth2 which uses access and refresh tokens. If the refresh token is compromised it could be used by another evil website to generate another access token.

This is why Google lets you revoke oauth2 access which you should regularly review to see who is using them

Tokens are tied to apps or domains. If it's compromised on domain xxx you can't use it to log in to domain yyy just like domain xxx can't use it to get access to domain yyy.