Harvesting email addresses surreptitiously

http://arvindn.livejournal.com/122550.html

by dangoldin • 17 years ago

68 26 17 years ago

arvindn.livejournal.com

tyohn• 17 years ago

Has anyone tested this? If it works it seems like a very interesting security hole.

dangoldin• 17 years ago

I plan on messing with it later tonight to see if works. I'll be the only testing it though since no one ever visits my site =)

It seems like a pretty bad oversight on Google's part to allow this.

randomwalker2• 17 years ago

I got the idea for this post when I looked at this: http://news.ycombinator.com/item?id=1036360 :-)

A further comment:

Suppose you implement this and lots of people are visiting your page, then you may have a problem determining which visitor corresponds to which email address, since each query to Google docs will return multiple addresses. One way to get around that would be to create 10 documents; for each visitor, embed a random subset of the documents. This way you can uniquely identify visitors as long as you have fewer than 1024 visitors within a minute or two.

elcron• 17 years ago

1023 if no documents are embedded you can't harvest their email address.

tjoozeylabs• 17 years ago

this would only be useful if u have bot

megamark162• 17 years ago

I liked that single comment to the post:

"You just convinced me to not stay logged on to Google. Ever!"

So Chrome has a "New Incognito Window" option, what about a "New Anonymous Window" option that would be like incognito but without any of your sessions/cookies/whatever, like a seperate sandbox or something.

adamsmith• 17 years ago

Incognito already runs without cookies or sessions, fortunately.

They don't even allow cookies within an incognito window.

megamark162• 17 years ago

Wow, you learn something every day! I don't hit incognito mode much, I hadn't tried going to my gmail or gdocs. So there you have it, when browsing sites you may not be able to trust (like Arvind Narayanan's blog ;-) be sure to do so in an incognito window.

pyre• 17 years ago

I've been logged into GMail in an incognito window, and done a Google search in another tab on the same window only to have my email address show up at the top of the search as 'logged in' (same with Google Maps).

daeken• 17 years ago

Cookies are allowed within incognito windows, they're just kept in memory and flushed when all incognito windows are close.

amalcon• 17 years ago

I use a completely different browser to use things that require me to be logged into Google. Just add this to the list of reasons to do that.

bliss• 17 years ago

I'll admit to being worried about this, I stay logged into google most of the time... I think I'll get used to hitting the logout button - probably good general practice anyway

jsdalton2• 17 years ago

Is it really true that one can view a list of the email addresses of the logged in gmail users who are visiting a document one owns? I can see a list of usernames of people actively viewing a document I own, but not email addresses.

Because if so, that's the problem right there. It's not a security "design flaw" of some kind -- it's a flat out failure of Google to protect the privacy of its users -- and I have to imagine a violation of its privacy policy.

I don't know, maybe I'm missing something though.

olefoo2• 17 years ago

For google docs, usernames are email addresses.

jsdalton2• 17 years ago

I see.

It should be noted that this assumption is usually, but not always, true.

It's possible to create a google account with a non @gmail.com address (I have two myself). I just tested and confirmed that Google Docs shows the local part of the email address but not the domain.

So you couldn't be 100% sure that "john.doe" is john.doe@gmail.com, though it would obviously be a pretty solid guess.

edw519• 17 years ago

Run, don't walk, away from anything that involves the word "surreptitiously". What may seem slick today may become a public relations nightmare tomorrow.

There are plenty of ways for good hackers to be successful while still being open, honest, and forthright with everyone else. Don't be tempted to take a shortcut that someone else might consider dishonest or underhanded. It just ain't worth it.

euroclydon• 17 years ago

Yeah, this would be a great white hat hacker post, but as an actual suggestion for use, it's bad stuff.

randomwalker2• 17 years ago

I think you misunderstood the post. I wasn't suggesting anyone do this. I do privacy research and I was pointing out what should be considered a security hole in Google docs. I'm surprised it was confusing; I did use the word "malicious."

billybob• 17 years ago

I just emailed the Gmail team to tell them.

est• 17 years ago

I guess spreadsheets is a different team. Even the multi-user chat is using a different gateway than gtalkgadget.

bobbyi• 17 years ago

It's not their problem. It's Google Spreadsheet who is exposing people's information without them knowing.

sambeau• 17 years ago

Why?..

..please don't.

ohashi• 17 years ago

I think it's a pretty clever idea though a gross violation of privacy.

Harvesting email addresses surreptitiously

Related Stories