Since we like reporting about search in forums, we generally wait for the discussion to begin there. As such, earlier this morning, Insomniac (aka Entriple) told Barry about a flaw in Google Video and Barry suggested that it be posted on DigitalPoint Forums (so in general, if you have a hat tip for us, please make sure there's associated discussion!). The discussion on DigitalPoint has since grown tremendously since it was created.
It appears from Insomniac's find that if you choose to share a video from Google Video to another social network (like MySpace, for example), your username and password get sent in plaintext on the http protocol (rather than the more secure https protocol).
Plaintext, you say? Yes, indeed. From the headers:
POST /blogpost HTTP/1.1 Host: video.google.co.uk User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Referer: http://video.google.co.uk/blogpost?d...22&siteindex=3 Content-Length: 42 Cookie: PREF=ID=26c938172fc51030:TM=1178041215:LM=1138046118:S=Bw_pBCzx-opEyR3s; sloc=en_GB Pragma: no-cache Cache-Control: no-cache req=login&name=myusername&pass=mypassword&site=MySpace
Want to see for yourself? First, install the Live HTTP Headers Firefox addon. Then, go to Google Video. (Step 1) When you click on Post to MySpace (Step 2), you get a link like this in a popup window. On this window where you input your username and password (Step 3), go to the Firefox Tools menu > Live HTTP Headers. What you see is your username and password in plain text (Step 4).
(Step 1: View a Google Video)
(Step 2: You can post the video to MySpace. Disclaimer: This video URL came to me via StumbleUpon.)
(Step 3: Enter your Username and Password)
(Step 4: Yeah, in fullsize, you can see the username and password that I typed in.)
This appears to be an oversight and I believe it should be patched immediately. After all, as Insomniac adds, "Who knows who else has noticed this and started logging data."
Forum discussion continues at DigitalPoint Forums.
