Unexpected gmail account name disclosure on calendars
I came across a an interesting blog post showing how to get the name of a Gmail account. Since the bug was visible through Google Calendars I hoped that it was maybe limited to users who had signed up for Google Calendar. This is not the case. The steps that I followed:
1)Register brand new gmail account with default settings
register new Gmail account
2)Go to google calendars (as a different user) select a calender invite the user to share one of my calendars (click on the down arrow next to your calendar)
choose a calendar to invite the user to share
3)Invite the user
Invite the user to share your calendar
4)Save the changes (note that it indicates the user isn't registered for Google Calendars) & go back
Invite user to Google Calendars
5)See the users name
see the username
Normally I'm all for notifying the company of the problem before public disclosures, but the cat is well out of the bag and having a walk around.
It apparently works regardless of whether the user is signed up for Google Calendars.
For me this isn't much of a problem, I'm incredibly easy to track down and my e-mail address has my name in it, but I know for others this could be quite an unwelcome surprise. Lets hope Google fixes this soon.
With that being said if you don't use google calendar you can see if anyone has used this to find out your name because you will get a google calendar invite.
(note: you can click through for a larger version of any of the images)
Update:This works not only on GMail accounts but also on Google App Domain accounts. Perhaps something for universities considering outsourcing their mail to consider.
1)Register brand new gmail account with default settings
register new Gmail account
2)Go to google calendars (as a different user) select a calender invite the user to share one of my calendars (click on the down arrow next to your calendar)
choose a calendar to invite the user to share
3)Invite the user
Invite the user to share your calendar
4)Save the changes (note that it indicates the user isn't registered for Google Calendars) & go back
Invite user to Google Calendars
5)See the users name
see the username
Normally I'm all for notifying the company of the problem before public disclosures, but the cat is well out of the bag and having a walk around.
It apparently works regardless of whether the user is signed up for Google Calendars.
For me this isn't much of a problem, I'm incredibly easy to track down and my e-mail address has my name in it, but I know for others this could be quite an unwelcome surprise. Lets hope Google fixes this soon.
With that being said if you don't use google calendar you can see if anyone has used this to find out your name because you will get a google calendar invite.
(note: you can click through for a larger version of any of the images)
Update:This works not only on GMail accounts but also on Google App Domain accounts. Perhaps something for universities considering outsourcing their mail to consider.
Comments
:)
-The man
http://www.worldlydecor.com
worldly Decor
What does that even mean you worthless piece of crap? Why are you posting on the internet you stupid, stupid child.
Check it in the dictionary.
It's like Color/Colour or Theater/Theatre.
Thank you for bringing this to the world's attention. I hope Google fix it soon.
gram´mer (grăm´mẽr)
n. 1. Grammar; - a common misspelling.
Webster's Revised Unabridged Dictionary, published 1913 by C. & G. Merriam Co.
After the hole is closed, you can still present screenshots or even a video taken prior to the issue being fixed.
SnooPING AS usual I see.
PINGAS
I would appreciate it if SHUT THE FUCK UP, GTFO and kill yourself.
...wow, your choice of definition is fresh like a month old carton of milk left in the sun...
btw: I am posting anonymously because I'm assuming my Blogger ID would give the same info away
he said it was already disclosed.
I AM TRYNG TO GET A GMAIL EMAIL ACCOUNT!
PLZ SNED INFO! CALENDAR@PENISPILLS.COM
PLZ HLP!!!!!!!!!!!!!!!
THANK YOU!!!!!!!!!!!!!!!
I see someone is bent out of shape that the only hack they knew, has now become public.
Lay off the kid, its not like this is grammer class. Its a blog, and your annoying..
/ o \ / __\ / \ / \ / \ / ___\ / \
| __/ | |__ | \ | | | | \ \ | |
| | | ___\ | \| | | | \ \ \_/
| | | |__ | |\ | | | | _\ \ _
\_/ \____\ \_/ \__/ \_/ /____\ \_\
http://en.wiktionary.org/wiki/grammer
If you can't click on the link here's a quote:
"Common misspelling of grammar"
http://how-to-spell-its.com
http://www.detroithardcore.com/lensman.jpg
so THATS what the gaping hole in gmail looks like...
Hahaha! Caught by your own foolishness, and then caught making lame excuses.
Posting anonymously wouldn't have changed anything 'cept for the name above the post, do you realize that? You still choose to trash a place on the internet instead of writing something beautiful. You could better take responsibility for you writing all times even posting anonymously... because you want to do the right thing and make this world a better place, aye?
Also, you cannot blame slashdot for *your* actions...! Just because slashdot links to a page doesnt mean you have to trash it with immature crap like that. What's you're logic anyways? Slashdot is an immature site posting about penises and now i have to do the same? What?
Lets / Let's (contraction of "Let us).
Go to the site, do a search for an email address. If that finds someone you will get their name and picture if available.
;-)
are you a member of the 'special people club'? sure! XD
The name that comes up is the same name that is sent with every email a person sends from their gmail account.
This is not secret information.
It does *not* show the first and last name of the user; it shows the identifying text that the user has chosen to display next his email address in the "From" line of emails, which happens to be the first and last name for many people, but can be changed to whatever the user wants.
If the user has ever emailed a publicly-archived mailing list, then this information is already out in the public.
The only hole here is that, before, the user only gave out this info when he sent an email and, now, someone else can get the info without the user intentionally sending an email. But this request will cause an email notification to be sent to the user -- so it can't used to secretly get someone's identifier.
So ... what are we worried about?
But still it was fun to know this, thanks for the post!
Though I'm a little bit sad for most of the comments up there. :(
It’s amazing how many people write to thank me for helping them with their “grammer.” It’s “grammar.” The word is often incorrectly used to label patterns of spelling and usage that have nothing to do with the structure of language, the proper subject of grammar in the most conservative sense. Not all bad writing is due to bad grammar.
jaja
order viagra
discount viagra
cheap cialis
buy levitra online viagra
low cost viagra
msn nickleri, avatarlar, clipler, emo nickleri, müzikler, videolar, nickler, güzel sözler, resimler
this coversation is so going on failblog.com
EPIC WIN
You've been /.ed. I'd advise a quick spell/grammer check 'cause the world is watching. Your 15 minutes has begun (prior to the horde crashing your host server).
It's actually spelled, "GRAMMAR" =)