I came across a an interesting blog post showing how to get the name of a Gmail account. Since the bug was visible through Google Calendars I hoped that it was maybe limited to users who had signed up for Google Calendar. This is not the case. The steps that I followed:
1)Register brand new gmail account with default settings
register new Gmail account
2)Go to google calendars (as a different user) select a calender invite the user to share one of my calendars (click on the down arrow next to your calendar)
choose a calendar to invite the user to share
3)Invite the user
Invite the user to share your calendar
4)Save the changes (note that it indicates the user isn't registered for Google Calendars) & go back
Invite user to Google Calendars
5)See the users name
see the username
Normally I'm all for notifying the company of the problem before public disclosures, but the cat is well out of the bag and having a walk around.
It apparently works regardless of whether the user is signed up for Google Calendars.
For me this isn't much of a problem, I'm incredibly easy to track down and my e-mail address has my name in it, but I know for others this could be quite an unwelcome surprise. Lets hope Google fixes this soon.
With that being said if you don't use google calendar you can see if anyone has used this to find out your name because you will get a google calendar invite.
(note: you can click through for a larger version of any of the images)
Update:This works not only on GMail accounts but also on Google App Domain accounts. Perhaps something for universities considering outsourcing their mail to consider.
Wednesday, July 16, 2008