Gmail exploit reveals users' names

[BlackKnight]

Ever wondered what name is behind some obscure gmail address? Maybe your preferred gmail address was taken and you’re wondering who took it?

Here’s a cute vulnerability in the gmail system that comes from the strong tie-ins between gmail, the google calendar and all the other services.

 

How to do it:

 

- Go to the ’share this calendar’ tab

 

- Enter the email address in the ‘person’ box

 

- Click ‘add person’ and ’save’

 

- When you return to this screen you will see the first and last name along with the gmail address

 

Verified- it works. This is a rather nasty thing to have circulating the net. Not that I care- my Gmail address includes my name anyway, but if it didn't I would be royal pissed right now.

 

 

Source: http://blogs.securiteam.com/index.php/archives/1113

[Sybarite Paladin AxL]

Ever wondered what name is behind some obscure gmail address? Maybe your preferred gmail address was taken and you’re wondering who took it?

Here’s a cute vulnerability in the gmail system that comes from the strong tie-ins between gmail, the google calendar and all the other services.

 

How to do it:

 

- Go to the ’share this calendar’ tab

 

- Enter the email address in the ‘person’ box

 

- Click ‘add person’ and ’save’

 

- When you return to this screen you will see the first and last name along with the gmail address

 

Verified- it works. This is a rather nasty thing to have circulating the net. Not that I care- my Gmail address includes my name anyway, but if it didn't I would be royal pissed right now.

 

 

Source: http://blogs.securiteam.com/index.php/archives/1113

 

You mean, it doesn't include it, right? Mine neither.

[OverlordMondo]

I think he meant his name was in the address. I'm not all too concerned about someone knowing my name, really.

[Sybarite Paladin AxL]

I think he meant his name was in the address. I'm not all too concerned about someone knowing my name, really.

 

Well that doesn't sound right to me, if his name is included in the address, then the person doing the procedure above would find it out. If his name isn't included in his address then adding him will reveal nothing. Correct my logic, it's 8 AM after a sleepless night.

[OverlordMondo]

I think he meant his name was in the address. I'm not all too concerned about someone knowing my name, really.

 

Well that doesn't sound right to me, if his name is included in the address, then the person doing the procedure above would find it out. If his name isn't included in his address then adding him will reveal nothing. Correct my logic, it's 8 AM after a sleepless night.

His name is already in his address, so he doesn't care that someone can use this exploit to find out what it is.

[BlackKnight]

Yeh I mean my Gmail address is John.J.Smith@Gmail.com. So it would be pretty obvious what my name is, if someone knew the address to begin with.

[Sybarite Paladin AxL]

Yeh I mean my Gmail address is John.J.Smith@Gmail.com. So it would be pretty obvious what my name is, if someone knew the address to begin with.

 

So if they use this procedure, then gmail would simply pull out your name from your profile settings and show it to them?

[BlackKnight]

That is correct. So if I had given out my BlackKnight address to people, was using Gmail, and was silly enough to enter my real name and expect it to be safe, someone could prove me wrong.