2

Let's say I log in to gmail on untrusted computer using two factor auth in Google Chrome in incognito mode.

Hypothetically some virus can read my email after this even without knowing password (.dll hijacking, non legitimate extension running in incognito) while I am logged in.

When I try to logout it can emulate sign out but actually it will not send logout request to Google servers and cookies which has been set in incognito mode can be stored somewhere and used again.

The only way to avoid this (as I think) to log in on trusted computer and click button 'Sign out all other sessions'.

Am I correct?

  • 1
    If there is malware on the untrusted computer they may have grabbed your password using, for example, a keylogger. – SilverlightFox Dec 14 '15 at 9:37
  • 1
    It does not matter because I use twofactor auth, so they also need access to my phone. – changer Dec 14 '15 at 10:02
3

If you are using two factor authentication, then any malware sniffing your password would not be able to login in future.

However, as soon as you do log into an untrusted computer, your session is exposed. Any malware with access to the session could export your whole mailbox in the time it takes you to sign out other sessions using a trusted computer. They could also do other things on your Google account such as forwarding all future mail to them using Filters, or disabling two factor authentication totally. The former would show a warning message for a few weeks when logging into the Gmail web application though.

They also might be able to lock you out of your account by changing your password. All in all it is not really safe to log into an untrusted computer using a sensitive account.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.