full-disclosure - Possible Google Account loophole

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 28 May 2008 16:18:17 +0500
From: Cryptreaper <cryptreaper@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Possible Google Account loophole

Hi,

There is a slight possibility that an attacker can guess password of a
google account due to a possible loop hole in their captcha system.

It happens when a user tries to login to a Google account with a wrong
password for a number of times, the system challenges the user with a
captcha. If the attacker enters both wrong password and captcha they
are given a warning that they have entered wrong username/password as
well as captcha text not being correct. Also if only the user
name/password if wrong, the warning message says wrong password. But
if the user name password combination is correct but ONLY captcha test
fails, the user is given only the captcha warning. This means that
user name /password combination was correct and thus the attacker
(which could be an automated bot) need not provide correct captcha
text in order to figure out the password.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/