Tag Info

New answers tagged

1

This is not a basic hack attempt. I think it is complicated. I have some advice for you. Did you ever backup your phone, via recovery? (is it rooted) If yes, you can restore your phone data. Send email or call support of dropbox, google, hotmail etc. You need to recover each account. Last one from my culture, "drink cold water"


0

To actually answer your question, no, Google does not provide the IP address of the user back to the original website. According to the developer documentation, Google will supply the website with a JSON object basically containing either true or false. { "success": true|false, "error-codes": [...] // optional } But none of this really even matters, ...


3

The verification is not directly performed by you, so in principle yes, Google could fake the identity of any of its users upon authentication. What happens during the authentication is that your service contact Google OpenID provider and asks: "who is this user?". Google answer will be along the lines of "this user is foo.bar@gmail.com and I have verified ...


1

You can choose whatever DNS provider you want on your computer if you are granted administrative rights on it. The only purpose of the DNS request is to get the IP of a fully qualified domain name (FQDN), that is to say translate www.google.fr to some IP address. If you manage a network of machines, you might want to : completely block DNS request on ...


4

Most likely either another administrator or some of your users have set their computers to use Google's DNS service (located at IP addresses 8.8.8.8 and 8.8.4.4). It's probably nothing to worry about. If your firewall has packet capture capabilities, you can try running a capture and then opening the capture file in Wireshark to inspect the traffic and make ...


1

The OAuth 2.0 specification prohibits the issuing of a refresh token to non-confidential clients. A client-side application is not considered a confidential client.


0

Could someone with unfettered access to Google's systems and malicious intent compromise non-Google accounts via Google Authenticator alone? No. Could they compromise non-Google accounts via several other Google services which someone using Google authenticator is likely to also use? Probably. Firstly, Google authenticator is used to implement ...


3

Well, even if Google was vulnerable to XSS, this still wouldn't be a breach. Why? Because of the HTTPOnly flag. It is the big reason for XSS's downfall. You can say there are two kinds of cookies: those that your browser gets when it recieves an HTTP response from a remote server (like google.com). They are in the Set-Cookie part of the response. ...


0

They can log in pretending to be you, your cookie is basically the token that the server gave you so that you can stay logged. So that means accessing all the google services logged in with your account. If those are your real cookie values, you should log out from you google account as soon as possible.. EDIT: I didn't notice you said you dumped the ...


0

As I stated in my question, my site is developed locally. Thus, no one (other than me and Google) has access to the key used to identify my site traffic. This is why I was initially very concerned that perhaps my local machine had been compromised. Seeing traffic like that is alarming under these circumstances. But, after feedback from here and the Google ...


1

Either your web server is internet-accessible somehow or these are bogus-requests; you should check the access logs on your web server, if it doesn't show up there, then it's an issue with GA. BTW, we have some servers in a datacenter in $someplace in western europe that shows up on GeoIP-matches as russian IPs, which gave us a huge "YIKES!!!!!!!! ...



Top 50 recent answers are included