Posté par: igor51 le mars 02, 2013, 11:20:44
Attackers could - until Google issued a fix last Thursday, that is - bypass Google accounts' two-step login verification, reset a user's master password, and gain full profile control, just by capturing a user's application-specific password.
Source: Google patches bug that allows attackers to slip past two-factor authentication (http://feedproxy.google.com/~r/nakedsecurity/~3/Ply91kVQ-l0/)