2

I recently visited a forum using non-secure protocol (HTTP) - Chrome flagged a warning at the top saying I shouldn't enter any passwords or personal information onto the site, as they could be intercepted by attackers.

The forum has an option to authenticate via Google. If I use this authentication method without entering my password, can attackers still intercept it?

2

They probably can't intercept credentials, but you might have a problem with tokens if you are using insecure pages and they could potentially authenticate in your name in future instances (as the Facebook Hack of last year).

0

No, this authorisation method is still secure because OAuth 2.0, which Google uses, requires TLS to be used when transmitting access tokens.

However, if the access token is used after authorisation by the site without SSL / TLS, an attacker could intercept the token and gain access to that site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.