2

Let's say I log in to gmail on untrusted computer using two factor auth in Google Chrome in incognito mode.

Hypothetically some virus can read my email after this even without knowing password (.dll hijacking, non legitimate extension running in incognito) while I am logged in.

When I try to logout it can emulate sign out but actually it will not send logout request to Google servers and cookies which has been set in incognito mode can be stored somewhere and used again.

The only way to avoid this (as I think) to log in on trusted computer and click button 'Sign out all other sessions'.

Am I correct?

Improve this question
2
  • 1
    If there is malware on the untrusted computer they may have grabbed your password using, for example, a keylogger.
    – SilverlightFox
    Commented Dec 14, 2015 at 9:37
  • 1
    It does not matter because I use twofactor auth, so they also need access to my phone.
    – changer
    Commented Dec 14, 2015 at 10:02

1 Answer 1

Reset to default
3

If you are using two factor authentication, then any malware sniffing your password would not be able to login in future.

However, as soon as you do log into an untrusted computer, your session is exposed. Any malware with access to the session could export your whole mailbox in the time it takes you to sign out other sessions using a trusted computer. They could also do other things on your Google account such as forwarding all future mail to them using Filters, or disabling two factor authentication totally. The former would show a warning message for a few weeks when logging into the Gmail web application though.

They also might be able to lock you out of your account by changing your password. All in all it is not really safe to log into an untrusted computer using a sensitive account.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .