A feature that allows Android users to authenticate themselves on Google websites without having to enter their account password can be abused by rogue apps to give attackers access to Google accounts, a security researcher showed Saturday at the Defcon security conference in Las Vegas.
And with that information, the attacker has access to “Google Apps, Gmail, Drive, Calendar, Voice and other Google services.”
Oh, ok. Then I’m not paranoid, when I thought that this was crappy. Not that I use android 🙂
And Android fans talk smack about Apple. I haven’t seen this kind of flaw pop up in iOS
The most interesting part of this to me was February. Even assuming it’s February 2013, that’s a horrendous amount of time for this to be open when it could be closed on the server.
That’s the thing I really hate about single sign-on for all these services. I want to be able to control access better.
Yep…this is an SSO issue, not Android. If they were asking for drop box, fb, twitter, etc and you had your credentials remembered…you be susceptible to this problem.
http://www.zdnet.com/iphones-most-vulnerable-among-smartphones-7000013129
Just in case you were thinking iOS was without flaw. 😉
android itself is a flaw. or a theft. depends who you ask.