Conversation

Notices

1. Embed this notice
   Jan Wildeboer 😷:krulorange: (jwildeboer@social.wildeboer.net)'s status on Wednesday, 15-Jan-2025 05:05:28 JST Jan Wildeboer 😷:krulorange:

   #Oops. "Login with Google" can be abused if you buy a domain name that formerly had accounts, e.g. from a failed startup.

   "At the time of writing, there is no fix."

   https://trufflesecurity.com/blog/millions-at-risk-due-to-google-s-oauth-flaw

   • Embed this notice
     Chris (cy@chaos.social)'s status on Wednesday, 15-Jan-2025 05:17:43 JST Chris

     in reply to

     @jwildeboer same for buying old domains where the email has been used too register an account without SSO, and can still be used to reset the password, what’s new?
     aside of the fact that lots of services do not allow your sso provider to be changed