2

I recently visited a forum using non-secure protocol (HTTP) - Chrome flagged a warning at the top saying I shouldn't enter any passwords or personal information onto the site, as they could be intercepted by attackers.

The forum has an option to authenticate via Google. If I use this authentication method without entering my password, can attackers still intercept it?

2 Answers 2

2

They probably can't intercept credentials, but you might have a problem with tokens if you are using insecure pages and they could potentially authenticate in your name in future instances (as the Facebook Hack of last year).

0

No, this authorisation method is still secure because OAuth 2.0, which Google uses, requires TLS to be used when transmitting access tokens.

However, if the access token is used after authorisation by the site without SSL / TLS, an attacker could intercept the token and gain access to that site.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .