Further Reading New Chrome extension warns you when your Google password gets phished

On Thursday, Ars reported that a new service that warns when Google account users' passwords are phished had been bypassed by a drop-dead simple exploit , just 24 hours after Google had rolled out the Chrome plugin. Within hours of publication, Google issued an update that blocked the exploit. Now the same researcher has figured out a way to block the new version, too.

The first bypass required just seven lines of code to completely obfuscate the warning that the older Password Alert extension displayed when Chrome users entered their Google account password into a non-Google website. The warning told users their Google password had been intercepted by bad guys and advised users to change it right away. The first exploit relied on a JavaScript-based timer that searches the loaded webpage for instances of Google’s warning screen and simply removes it. Technically, the warning window still appears, but the exploit prevented the user from ever seeing it.

The newer exploit, which circumvents Thursday night's release of version 1.4, relies on just three lines. It works by refreshing the browser page after each password character is entered. That causes a browser to behave as if only one character of the password has been entered. Consequently, the warning is never displayed. The newer exploit has limitations, however. If the phishing target types the password too slowly, the browser will catch up to the constant refreshing and display the warning as Google engineers intended. Still, the bypass works about 90 percent of the time, said Paul Moore, the UK-based security researcher who devised both attacks. It wouldn't be surprising to see Google release yet another patch that may or may not be bypassed yet again.

The back-and-forth between Google and Moore highlights the cat-and-mouse struggle of security. A defender builds a lock of sorts, an attacker figures out a way to break it, the defender responds with refinements that block the attack, the defender works around the refinement, and so on. The process can be repeated for years, decades, or even centuries. The Password Alert travails also demonstrate the asymmetry of security, where a lone attacker can easily breach the security of a defender with vastly greater resources. Don't count on this struggle being resolved anytime soon.