not mentioned in the original post is that the change password field also gives you the option of entering the answer to your 'secret question' rather than your

not mentioned in the original post is that the change password field also gives you the option of entering the answer to your 'secret question' rather than your password as the second token. you replace the password query params with: &group1=IdentityAnswer&IdentityAnswer=ANSWER_GUESS not as improbable to guess since Google do not enforce a standard on the secret question answer (ie. with 'place you were born' you could just list major cities and probably get a hit every so often) if you had access to a high traffic site (thank-you wordpress hax) you would probably harvest a number of accounts using this in an IFRAME pretty quickly. you just need to add some javascript to somehow inform you which ones were a success.