New research has pulled back the curtain on a "deficiency" in Google's "Sign in with Google" authentication flow that exploits a quirk in domain ownership to gain access to sensitive data. "Google's OAuth login doesn't protect against someone purchasing a failed startup's domain and using it to re-create email accounts for former employees," Truffle Security co-founder and CEO Dylan Ayrey said in a Monday report. "And while you can't access old email data, you can use those accounts to log into all the different SaaS products that the organization used." The San Francisco-based company said the issue has the potential to put millions of American users' data at risk simply by purchasing a defunct domain associated with a failed startup and gaining unauthorized access to old employee accounts related to various applications like OpenAI ChatGPT, Slack, Notion, Zoom, and even HR systems. "The most sensitive accounts included HR systems, which contained tax documents, pay stubs, insurance information, social security numbers, and more," Ayrey said. "Interview platforms also contained sensitive information about candidate feedback, offers, and rejections." OAuth, short for open authorization, refers to an open standard for access delegation, allowing users to grant websites or applications access to their information on other websites without having to give their passwords. This is accomplished by making use of an access token to verify the user's identity and allow the service…Read More