1

I just received an email from "Have I been pwned" to say my credentials have been made public via a breach. The quoted text is:

"The exposed data included names, email addresses, genders, spoken language and either a bcrypt password hash or Google auth token."

I would like to know what someone could do with a Google auth token. The rammifications of leaking a bcrypt password hash would also be of interest but is not the primary question.

I vaguely recognise the app provider involved and don't currently have that app installed. I have changed my Google password since I last used the app and have MFA active.

6

Martin's answer has good info and steps to prevent further potential risk.

Concerning the authtoken it’s pretty straight forward.
For example, when you use your Google account to login to a site, using the following button : GMAIL API

Google generates a token using what's called the OAuth 2.0 protocol, allowing this website to login via Google without them ever having knowledge of your password.

Imagine a triangle in which information is exchanged from each of the three angles (3 people, illustrated as P), but information can't flow from P1 to P3(or P3->P1) without passing through P2, which funnels data.

That is the main purpose of the authtoken, a single-use (one site only) hash/token that basically allows : P1(site) to identify themselves on "behalf" of P2(you) to the platform of P3(google)

On some apps/sites, upon first use of "Google sign in", you have to choose and accept how much data/control this particular API has over your Google account.
Nowadays, it is usually limited to seeing your email address (the address only), and some public/private info such as name, DOB and address.

So regarding security concerns, I don't believe there are any. Not only do tokens expire (meaning after prolonged time of no use, you will need to revalidate permissions, aka re-auth), but also, in the manner of cryptocurrency, this is a three way exchange where whatever site had a data leak has its own token used to identify to Google.

Let's imagine a worst case scenario where a malicious attacker manages to recreate (doubtful..) or spoof the site's token, and then used yours to identify to Google.
Their power would be limited to whatever permissions that site had on your Google account (they can vary), but remain restricted. They do not have access to the Google account itself.

Now it's safe to assume that upon discovery of the data leak, all token authorizations from this particular site were revoked; either by demand of the former or by Google, as a preventative measure.

But for peace of mind(and because knowledge is awesome!), it is worth checking the following link which shows all the apps you have tokens with and what they're allowed to do. https://myaccount.google.com/permissions

For more information about the authtoken process: https://developers.google.com/gmail/api/auth/about-auth

Hope this answered your question!

Just to be clear: authtokens do NOT store your password

  • 1
    "Google generates a token using what they call OAuth 2.0 protocol". Does Google desviate from OAuth 2.0 specs? If it has not, you could consider rewording that sentence. – bradbury9 Sep 19 at 14:33
  • 1
    Never use "above" or "below" to refer to an answer. Always use a link, or "the answer from Martin Bonner". Answers get re-ordered, and yours in now above mine :-) (Admittedly, in this particular case, s/above/below/ is likely to remain the case indefinitely) – Martin Bonner Sep 19 at 15:48
3

With a bcrypt password hash (and presumably the salt) the attacker can fire up John the Ripper (or other password cracking tool) and try to guess your password. If it is a common(ish) password (that is, in their million word dictionary, or a leet-speak variant of a word in their dictionary, or with a few symbols appended), they will succeed.

Once they have guessed the password you used on that site, they can then

a) try to use the password + email address on other sites of interest;

b) try to use the password with any email address they have on their list (because it is obviously a password that people use).

If you used a password manager (so that you have a randomly generated unique password on each site) all you have to do is change the password on that site.

If you don't use a password manager, now is a really good time to start doing so. (I use the free version of LastPass, there are plenty of others). Anyway, you need to change the password on that site, and on all other sites where you used the same password.

I have no idea what they can do with a google authentication token. I would love to know.

  • This does not answer the question. OP is asking about leaking the auth token, not the hashed password. – ThoriumBR Sep 18 at 14:19
  • @ThoriumBR It does not answer the question in the title. However it does answer half the question in the text: "I would like to know what someone could do with a bcrypt password hash and / or a Google auth token." (my emphasis). – Martin Bonner Sep 18 at 15:03
  • You are right, OP is asking 2 different things at once... – ThoriumBR Sep 18 at 15:09
  • OP has updated the question accordingly. – Oliver Burdekin Sep 19 at 14:25
0

The correct answer depends on which Google OAuth Token, there are three: Access, Refresh, and Identity.

Google Access and identity Tokens are only valid for one hour. This means one hour after creation they are worthless.

Google Refresh Tokens do not expire and can be used to recreate the other two. It is very common for "dumb" sites to store the Refresh Token unsafely so that you do not have to log in over and over.

If the breach does not involve the Refresh Token you are OK. If the breach involves a Refresh Token, go to your account and cancel all linked authorizations. Assume that the breach does involve the Google Refresh Token.

I recommend canceling all linked authorization on a periodic basis (monthly, quarterly, ...).

You do not need to worry about your Google Account password. That is never shared with a third party. However, a good practice is to change your password on a regular basis. Now would be a good time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.