Comments on: Gmail Flaw can Give Anyone your Contact List

By: //M-Tech Development Blog » Gmail Hackable?

//M-Tech Development Blog » Gmail Hackable? — Wed, 03 Jan 2007 02:18:02 +0000

[...] More bad news for Google: Gmail is vulnerable to a hack which enables malicious websites to hijack your contacts list, including the name, email address and avatar of all your contacts. Google claims to have fixed the flaw, but apparently it still exists on the Google Notebook and Google Groups server. What do you think? Post your comments! [...]

By: natmaster

natmaster — Tue, 02 Jan 2007 02:27:12 +0000

Not ironic…more like insult to injury.

By: Ryan

Ryan — Mon, 01 Jan 2007 21:31:54 +0000

ClausValca wrote:

In fact, I do that anyway for just about all the “medium security” sites when I browse except for just a handful of “low-security” forum sites that I just generally stay logged into at all times. “High-security” sites (related to on-line banking activities) always get a new browser window…login…perform the activity…logout…delete cache/forms…close browser..then reopen a fresh browser session for regular web surfing again. Do others to that as well?

I haven’t gone to those extremes but I have to admit that it’s a good idea. I may have to start doing things like that as well.

By: ClausValca

ClausValca — Mon, 01 Jan 2007 21:13:19 +0000

I must agree with OldManDeath’s suggestion.

Since I have come to depend a great deal on the Google resources…and have been a bit paranoid about an exploit like that occurring…I have always been in the habit of fully logging out of any Google/Blogger/Gmail/etc. resource when I am done.

In fact, I do that anyway for just about all the “medium security” sites when I browse except for just a handful of “low-security” forum sites that I just generally stay logged into at all times. “High-security” sites (related to on-line banking activities) always get a new browser window…login…perform the activity…logout…delete cache/forms…close browser..then reopen a fresh browser session for regular web surfing again. Do others to that as well?

It’s not quite as convenient, but (I hope) more secure.

Then again, now that tabbed browsing is pretty common in FF and IE7, I guess I have to be that much more careful that opening any additional site-pages while I am signed in to my Google accounts.

By: Lewis

Lewis — Mon, 01 Jan 2007 21:09:42 +0000

You just have to be logged in to a Gmail service on your browser.

I didn’t worry about clicking that link, as it’s my contacts that would have been spammed

By: Ryan

Ryan — Mon, 01 Jan 2007 19:51:50 +0000

It works fine for me without having any of the things open…except I have Google Talk but I wouldn’t think that an application could affect it.

By: OldManDeath

OldManDeath — Mon, 01 Jan 2007 19:35:33 +0000

This shows everything associated with a contact, phone numbers, addresses, etc.

I have heard that for this to be exploited, you have to have one of your Google resources (Gmail, Calendar, etc.) running while you are browsing the web. If you hit a website that is exploiting this with one of those other resources open, then the exploit will work and your contact information will be taken.

I guess I need to get into the habit of closing Gmail when I am browsing the web as I normally leave it open.