Security Flaw in Google Reader Added Subscribers Without Intent

Jul 19, 2007 - 9:27 am 0 by
Filed Under Misc Google

A DigitalPoint Forums member points to a vulnerability within Google Reader that enables blog owners to add code to their blog that will allow any visitor to automatically subscribe to the RSS feed. Patrick Altoft wrote about this discovery and says that if you copy certain code to your site and a user has logged into his/her account, they will automatically be subscribed to your blog:

The problem is that unscrupulous websites can copy the links to Add to Google homepage or Add to Google Reader and open them up in an IFRAME for every visitor, meaning that anybody who visits their website while signed in to a Google account will suddenly have subscribed to the RSS feed on both Google Reader and the Google homepage automatically.

I tried Patrick's demo and it seems to have been fixed. In fact, Matt Cutts responded as well and it appears that the hole has been patched.

In any event, if you want to subscribe to our feeds (and we know you do), we have two RSS feeds (a normal feed and a full feed) and one email feed. You're welcome to Subscribe to any of our feeds.

Forum discussion at DigitalPoint Forums.

 

Popular Categories

The Pulse of the search community

Search Video Recaps

 
- YouTube
Video Details More Videos Subscribe to Videos

Most Recent Articles

Search Forum Recap

Daily Search Forum Recap: July 18, 2025

Jul 18, 2025 - 10:00 am
Search Video Recaps

Search News Buzz Video Recap: Google June Core Update Done, Local Ranking Update, AI Mode Updates & AI Calling Businesses

Jul 18, 2025 - 8:01 am
Google Maps

New Google Business Profile Check Edit Status

Jul 18, 2025 - 7:51 am
Google Search Engine Optimization

Google: Login Service Pages Are Hard To Rank In Search

Jul 18, 2025 - 7:41 am
Google

Google AI Overviews For Movie Queries

Jul 18, 2025 - 7:31 am
Google Ads

Google Ads Rolling Out Smart Bidding Exploration To Some Advertisers

Jul 18, 2025 - 7:21 am
Previous Story: Yahoo! Acquires Stake in Tyroo, an Indian Online Advertising Agency