7 ms·
Harvesting email addresses surreptitiously
- tyohn 17y agoHas anyone tested this? If it works it seems like a very interesting security hole.
- dangoldin 17y agoI plan on messing with it later tonight to see if works. I'll be the only testing it though since no one ever visits my site =) It seems like a pretty bad oversight on Google's part to allow this.
- randomwalker 17y agoI got the idea for this post when I looked at this: http://news.ycombinator.com/item?id=1036360 http://news.ycombinator.com/item?id=1036360 :-) A further comment: Suppose you implement this and lots of people are visiting your page, then you may have a problem determining which visitor corresponds to which email address, since each query to Google docs will return multiple addresses. One way to get around that would be to create 10 documents; for each visitor, embed a random subset of the documents. This way you can uniquely identify visitors as long as you have fewer than 1024 visitors within a minute or two.
- elcron 17y ago1023 if no documents are embedded you can't harvest their email address.
- tjoozeylabs 17y agothis would only be useful if u have bot
- megamark16 17y agoI liked that single comment to the post: "You just convinced me to not stay logged on to Google. Ever!" So Chrome has a "New Incognito Window" option, what about a "New Anonymous Window" option that would be like incognito but without any of your sessions/cookies/whatever, like a seperate sandbox or something.
- adamsmith 17y agoIncognito already runs without cookies or sessions, fortunately. They don't even allow cookies within an incognito window.
- megamark16 17y agoWow, you learn something every day! I don't hit incognito mode much, I hadn't tried going to my gmail or gdocs. So there you have it, when browsing sites you may not be able to trust (like Arvind Narayanan's blog ;-) be sure to do so in an incognito window.
- pyre 17y agoI've been logged into GMail in an incognito window, and done a Google search in another tab on the same window only to have my email address show up at the top of the search as 'logged in' (same with Google Maps).
- agl 17y agoAll incognito windows share a profile, so share cookies etc. It's not the case that each tab is a clean profile.
- daeken 17y agoCookies are allowed within incognito windows, they're just kept in memory and flushed when all incognito windows are close.
- amalcon 17y agoI use a completely different browser to use things that require me to be logged into Google. Just add this to the list of reasons to do that.
- bliss 17y agoI'll admit to being worried about this, I stay logged into google most of the time... I think I'll get used to hitting the logout button - probably good general practice anyway
- jsdalton 17y agoIs it really true that one can view a list of the email addresses of the logged in gmail users who are visiting a document one owns? I can see a list of usernames of people actively viewing a document I own, but not email addresses. Because if so, that's the problem right there. It's not a security "design flaw" of some kind -- it's a flat out failure of Google to protect the privacy of its users -- and I have to imagine a violation of its privacy policy. I don't know, maybe I'm missing something though.
- olefoo 17y agoFor google docs, usernames are email addresses.
- jsdalton 17y agoI see. It should be noted that this assumption is usually, but not always, true. It's possible to create a google account with a non @gmail.com address (I have two myself). I just tested and confirmed that Google Docs shows the local part of the email address but not the domain. So you couldn't be 100% sure that "john.doe" is john.doe@gmail.com, though it would obviously be a pretty solid guess.
- olefoo 17y agoThat's interesting, I would like to know what percentage of Google accounts fall into that category. I find the prospect of linking my casual browsing on sites other than ones I have explicitly allowed being able to resolve my identity for the site owner to be quite irksome. I would take steps against any site that I discovered engaging in such practices on a regular basis. Now looking for a chrome plugin similar to NoScript.
- dangrossman 17y agoI have no Gmail address at all, yet I use quite a few Google Account services. There's no requirement to have a Gmail account or use it as your Google Account login.
- edw519 17y agoRun, don't walk, away from anything that involves the word "surreptitiously". What may seem slick today may become a public relations nightmare tomorrow. There are plenty of ways for good hackers to be successful while still being open, honest, and forthright with everyone else. Don't be tempted to take a shortcut that someone else might consider dishonest or underhanded. It just ain't worth it.
- euroclydon 17y agoYeah, this would be a great white hat hacker post, but as an actual suggestion for use, it's bad stuff.
- randomwalker 17y agoI think you misunderstood the post. I wasn't suggesting anyone do this. I do privacy research and I was pointing out what should be considered a security hole in Google docs. I'm surprised it was confusing; I did use the word "malicious."
- billybob 17y agoI just emailed the Gmail team to tell them.
- sambeau 17y agoWhy?.. ..please don't.
- ohashi 17y agoI think it's a pretty clever idea though a gross violation of privacy.