Google Video Flaw Raises Privacy Concerns by Exposing Usernames and Passwords

Jun 12, 2007 - 12:23 pm 3 by
Filed Under Misc Google

Since we like reporting about search in forums, we generally wait for the discussion to begin there. As such, earlier this morning, Insomniac (aka Entriple) told Barry about a flaw in Google Video and Barry suggested that it be posted on DigitalPoint Forums (so in general, if you have a hat tip for us, please make sure there's associated discussion!). The discussion on DigitalPoint has since grown tremendously since it was created.

It appears from Insomniac's find that if you choose to share a video from Google Video to another social network (like MySpace, for example), your username and password get sent in plaintext on the http protocol (rather than the more secure https protocol).

Plaintext, you say? Yes, indeed. From the headers:

POST /blogpost HTTP/1.1 Host: video.google.co.uk User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Referer: http://video.google.co.uk/blogpost?d...22&siteindex=3 Content-Length: 42 Cookie: PREF=ID=26c938172fc51030:TM=1178041215:LM=1138046118:S=Bw_pBCzx-opEyR3s; sloc=en_GB Pragma: no-cache Cache-Control: no-cache req=login&name=myusername&pass=mypassword&site=MySpace

Want to see for yourself? First, install the Live HTTP Headers Firefox addon. Then, go to Google Video. (Step 1) When you click on Post to MySpace (Step 2), you get a link like this in a popup window. On this window where you input your username and password (Step 3), go to the Firefox Tools menu > Live HTTP Headers. What you see is your username and password in plain text (Step 4).

First, Share your Video (Step 1: View a Google Video)

You'll be Taken to a Link to Post to MySpace (Step 2: You can post the video to MySpace. Disclaimer: This video URL came to me via StumbleUpon.)

This is when the headers get sent. (Step 3: Enter your Username and Password)

Live Headers in Action (Step 4: Yeah, in fullsize, you can see the username and password that I typed in.)

This appears to be an oversight and I believe it should be patched immediately. After all, as Insomniac adds, "Who knows who else has noticed this and started logging data."

Forum discussion continues at DigitalPoint Forums.

 

Popular Categories

The Pulse of the search community

Follow

Search Video Recaps

 
Google Core Update Rumbling, Manual Actions FAQs, Core Web Vitals Updates, AI, Bing, Ads & More - YouTube
Video Details More Videos Subscribe to Videos

Most Recent Articles

Search Forum Recap

Daily Search Forum Recap: March 18, 2024

Mar 18, 2024 - 4:00 pm
Google Updates

Google Urges Patience As The March 2024 Core Update Continues To Rollout

Mar 18, 2024 - 7:51 am
Google

Official: Google Replaces Perspective Filter With Forums Filter

Mar 18, 2024 - 7:41 am
Google Maps

Google Business Profiles Now Offers Additional Review After Appeal Is Denied

Mar 18, 2024 - 7:31 am
Google Maps

EU Searchers Complaining About Google Maps Features Changes Related To DMA

Mar 18, 2024 - 7:21 am
Google

Google Showing Fewer Sitelinks Within Search

Mar 18, 2024 - 7:11 am
Previous Story: Yahoo Tries Out New Look: Shiny Blue Bar