http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/ Engadget Comments for http://www.engadget.com/media/feedlogo.gif http://www.engadget.com en-us Copyright 2012 Weblogs, Inc. The contents of this feed are available for non-commercial use only. Blogsmith http://www.blogsmith.com/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/
Its been in BETA too long. And I would have expected more of google then to allow this blatant error.]]>Jan 1st 2007 6:29AMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/
http://blogs.zdnet.com/Google/?p=434
]]>Jan 1st 2007 6:33AMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/]]>Jan 1st 2007 8:06AMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 7:53AMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/
Thomas]]>Jan 1st 2007 8:07AMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/]]>Jan 1st 2007 9:17AMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 10:04AMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 10:17AMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 11:18PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Feb 24th 2007 3:29PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/]]>Jan 1st 2007 10:37AMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 11:04AMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 11:09AMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 11:31AMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 3:41PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/
If spammers are able to access any .js files that is in a Gmail or Google.com page, then it seems to me that this is a security flaw in the BROWSER, and that ANY web page that uses JS files is at risk.

Maybe I'm wrong, but I smell a hoax.]]>Jan 1st 2007 11:53AMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/





Fucking spammers]]>Jan 1st 2007 12:34PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 1:23PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/
Could be dodgy, for sure.

I also noted that if I closed a Gmail page, then clicked on the Gmail bookmark, I go back into the previously open account without out needing a log-on name & password. I assume that feature times out if inactive.]]>Jan 1st 2007 1:29PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/
It's yet another reason why being constantly logged in to Google is a bad thing - they also record all of your searches and keep those attached to your account also. That's a recipe for disaster too, as the AOL debacle showed, but this would be even bigger if that data ever got out.

My problem is I use Google's gmail notifier, so unless I want to lose that, I basically have to stay logged in. But at that point, I may as well just go back to using Outlook, because I need to know when I get email. (Yeah, I know I can use Outlook with gmail, and I do have that set up... but the point is I hate Outlook!)
]]>Jan 1st 2007 1:39PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/ Try Thunderbird.]]>Jan 1st 2007 4:23PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 1:49PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/=(]]>Jan 1st 2007 2:01PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Is there anything to protect people that use IE or Netscape?]]>Jan 1st 2007 2:10PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 2:18PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Thanks to Google for fixing this issue so fast.]]>Jan 1st 2007 2:11PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 2:23PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/another thing,.. pretty much anyone can write a script that reads your contacts from your email account.. from a computer that you are logged into

3rd point .. who really cares if that one folder called SPAM is filled... does that little number beside it scare you? you feel like theres little aliens comming to get you if there is alot of spam? like are we a bunch of little baby girls?
suk it up, its the world wide web, it will never be 100% secure.. unless there is nothing free on it, and only people who spend alot of money on their sites can have them hosted
just deal with it]]>Jan 1st 2007 3:12PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/
I would imagine that Google's fix likely involved checking the referrer that is requesting the JavaScript URL and, as a result, is only including the private information if the URL is being requested by one of Google's own sites. A way Google could make this even more secure is to include some unique ID (that has a short life-span) in the URL of the request... in other words, an additional layer of authentication that is URL-based.

This was a problem for Google to fix, yes... but they also fixed it rather quickly. No programming team (nor programmer) is 100% perfect. The best any company can do is be quick to respond when problems are uncovered. Microsoft often takes quite a bit of time to solve problems and even then, may wait up to a week before finally applying the fix. Google will often apply fixes within hours of being discovered. That is a very good sign.
]]>Jan 2nd 2007 3:13AMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/
The URL in your update doesn't prove anything. Of course there are URLs which will display a user's Google data when they click them. If there weren't, they wouldn't be able to use any Google services. You can post a link to the Gmail page and any user can click it and see their own e-mail if they are logged in. Does that mean that you (Engadget) can see that person's e-mail? Of course not.

The issue is whether or not javascript running in the context of a non-Google domain can acquire and transmit a user's personal Google information (contacts, whatever) to a non-Google domain.]]>Jan 1st 2007 3:48PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/
google ({
Success: false,
Errors: []
})]]>Jan 1st 2007 3:49PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 4:13PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/google Success: false, Errors: []

tried in safari and firefox.???]]>Jan 1st 2007 4:13PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 4:17PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/google ({
Success: false,
Errors: []
})
When tried in Safari and Firefox in both XP and OSX
When tried in IE7 It tries to save it as an extentionless file called contacts]]>Jan 1st 2007 4:20PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 4:22PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 4:23PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 4:26PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 4:27PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 4:28PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 6:21PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 1st 2007 9:58PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/
And thank you Google, because I've been enjoying your email service ever since it started and I have only received 6 SPAM messages as a result of using Craigslist -- luckily it was an anonymous address that quits functioning after the ad is deleted.

Happy New Year.

dijitul]]>Jan 2nd 2007 6:21AMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Sense when is anything reported on Digg?]]>Jan 2nd 2007 12:35PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 2nd 2007 1:08PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/
google ({
Success: false,
Errors: []
})

So does that mean it's all fixed then? Hope so...]]>Jan 2nd 2007 7:31PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 2nd 2007 2:38PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/
VastOne]]>Jan 2nd 2007 4:08PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/Jan 2nd 2007 7:05PMhttp://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/http://www.engadget.com/2007/01/01/gmail-bug-exposes-your-mail-account-to-spammers/I even tried logging into my different gmail accounts, and doing it again.
I think it may be fixed.]]>Jan 3rd 2007 5:18PM