Google Video Flaw Raises Privacy Concerns by Exposing Usernames and Passwords

Jun 12, 2007 • 12:23 pm | comments (3) by twitter | Filed Under Other Google Topics
 

Since we like reporting about search in forums, we generally wait for the discussion to begin there. As such, earlier this morning, Insomniac (aka Entriple) told Barry about a flaw in Google Video and Barry suggested that it be posted on DigitalPoint Forums (so in general, if you have a hat tip for us, please make sure there's associated discussion!). The discussion on DigitalPoint has since grown tremendously since it was created.

It appears from Insomniac's find that if you choose to share a video from Google Video to another social network (like MySpace, for example), your username and password get sent in plaintext on the http protocol (rather than the more secure https protocol).

Plaintext, you say? Yes, indeed. From the headers:

POST /blogpost HTTP/1.1 Host: video.google.co.uk User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Referer: http://video.google.co.uk/blogpost?d...22&siteindex=3 Content-Length: 42 Cookie: PREF=ID=26c938172fc51030:TM=1178041215:LM=1138046118:S=Bw_pBCzx-opEyR3s; sloc=en_GB Pragma: no-cache Cache-Control: no-cache req=login&name=myusername&pass=mypassword&site=MySpace

Want to see for yourself? First, install the Live HTTP Headers Firefox addon. Then, go to Google Video. (Step 1) When you click on Post to MySpace (Step 2), you get a link like this in a popup window. On this window where you input your username and password (Step 3), go to the Firefox Tools menu > Live HTTP Headers. What you see is your username and password in plain text (Step 4).

First, Share your Video (Step 1: View a Google Video)

You'll be Taken to a Link to Post to MySpace (Step 2: You can post the video to MySpace. Disclaimer: This video URL came to me via StumbleUpon.)

This is when the headers get sent. (Step 3: Enter your Username and Password)

Live Headers in Action (Step 4: Yeah, in fullsize, you can see the username and password that I typed in.)

This appears to be an oversight and I believe it should be patched immediately. After all, as Insomniac adds, "Who knows who else has noticed this and started logging data."

Forum discussion continues at DigitalPoint Forums.

Previous story: Yahoo Tries Out New Look: Shiny Blue Bar
 

Comments:

Andy

06/12/2007 11:34 pm

You may be right but this doesn't prove it -- LiveHttpHeaders always shows the plaintext. You could scroll up and check the protocol, though.

s

06/13/2007 01:25 am

MySpace doesn't use https on their login page, so everytime you login via their own site you have exactly the same situation.

Josh

06/13/2007 06:01 pm

To be clear, it is your MySpace password that is transmitted in plain text, not your Google password. And like the above commenter says, this happens every time you login to MySpace. There is likely nothing Google can do to make this better, except encourage MySpace to use https for authenticating users.

blog comments powered by Disqus