« Previous post
Next post »

January 1, 2007

Another Gmail Problem

Michael Arrington

42 comments »

The last thing I want to do right now is post on another problem over at Google, but this was a big one. Basically, a website could download your entire Gmail contact list by adding a bit of code to their server and exploiting Google’s JSON API. The problem has apparently been fixed, very soon after the vulnerability was found.

I’m not going to go on and on (again) about how much trouble Google is getting into with these problems. In this case, days did not go by before Google responded to the problem. They addressed it immediately.

This is good fodder for the ongoing JSON debate, though.

  • Sphere It

This entry was posted on Monday, January 1st, 2007 at 2:32 pm and is filed under Company & Product Profiles. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.

Trackbacks/Pings (Trackback URL)

  1. Techcrunch » Blog Archive » 2007: Web 2.0 Companies I Couldn’t Live Without

    January 2nd, 2007 at 12:44 am

  2. Le blog du Guigo » Blog Archive » Backup your Google accounts

    January 2nd, 2007 at 4:09 am

  3. Spamroll

    January 2nd, 2007 at 7:27 am

  4. web live :: 2007: Web 2.0 Companies I Couldn’t Live Without :: January :: 2007

    January 2nd, 2007 at 6:01 pm

  5. Smoking Politics and Free Poetry in the (for now?) Google Age » alog

    January 6th, 2007 at 4:58 pm

  6. gmail, the stupid part of google » WinTweaks

    April 17th, 2007 at 10:59 pm

  7. techcrunch中文网 » Another Gmail Problem:谷歌邮箱的另一个问题

    April 25th, 2007 at 12:02 pm

  8.   07: Web 2.0 Companies I Couldn’t Live Without:2007年我不能离开的Web2.0网站 by I TechCrunch:麦斯贝日志

    May 18th, 2007 at 12:48 am

  9. Gmail handing out contact lists | Michael Gracie

    May 29th, 2007 at 11:39 pm

  10. 2007 - Top Services

    September 9th, 2007 at 9:14 pm

Comments

RSS feed for comments on this post.

  1. jj

    January 1st, 2007 at 2:38 pm

    RIGHT - Michael the hacker… lol

    When you bash a company like Google you kinda need… uhm… proof?

  2. jj

    January 1st, 2007 at 2:39 pm

    LOL I did not see the ZDnet link. Hehe that was dumb of me to post that first comment. Anyway, I’m sure you ego is bloated enough to not take any offense :)

  3. Dare Obasanjo

    January 1st, 2007 at 2:51 pm

    According to the linked post, the vulnerability hasn’t been fixed. Instead it was hastily covered up in one specific situation but the core vulnerability still exists.

  4. WEST_COAST_HUSTLA

    January 1st, 2007 at 3:10 pm

    Oh no, a “free” service has a flaw. Cry me a river made of the tears of unprofitable Web 2.0 bloggers.

  5. hyperbolic_mike

    January 1st, 2007 at 3:20 pm

    But Mr. Arrington, I thought gmail was perfect…

  6. Peter Cooper

    January 1st, 2007 at 3:24 pm

    Google’s problems are certainly not ending. All of a sudden their calculator, currency conversion, and unit conversion features don’t work either. Hope they get them working again, they were very useful!

    There are about a thousand threads complaining about one broken thing after another over at WMW this last week. I feel sorry for the Googlers heading back into work this week..

  7. Jamie Thingbox

    January 1st, 2007 at 3:27 pm

    Huh? Based on my reading of the issue, the problem has got absolutely nothing with the format that they deliver the results of the API call (ie, JSON), but the API security sanity checking. That is, if the results were being returned in XML, you’d still have the same problem.

    But maybe I misunderstand the problem. I’m happy to be corrected.

  8. Carson

    January 1st, 2007 at 3:30 pm

    Do you think Gmail will work on the new italk from apple?

    check it out: http://youtube.com/watch?v=Nf4iS6-73g8

    looks to good to be fake…?

  9. matthew

    January 1st, 2007 at 3:38 pm

    not a big deal

  10. Mike S

    January 1st, 2007 at 3:48 pm

    Slow news day? Why not start the new year out right with some positive news?

  11. Michael Arrington

    January 1st, 2007 at 3:54 pm

    Mike - more of a hangover day. Trying to find some.

  12. Mike S

    January 1st, 2007 at 4:10 pm

    Gotcha. Now we’re talking with Eroshare… :)

  13. Bob

    January 1st, 2007 at 4:19 pm

    The real problem with all of these new Ajax sites is that no one took the time to look into the security issues. Why not first evaulate the technology you are about to use, implement strategies to work around any security issues, and design the site correctly.

    Note: No matter what the resource or how seemingly useless that resource is to people, someone will exploit it.

  14. Ron Diggity

    January 1st, 2007 at 5:53 pm

    at least they are quick to fix faster than Microsoft, but this shows Googles slippery slope coming into play. They are going to have major privacy issues as thy get bigger and their don’t be evil motto doesn’t help them at all anymore, maybe in the beginning it did.

  15. Joe Walker

    January 1st, 2007 at 5:54 pm

    Some analysis: http://getahead.ltd.uk/blog/jo.....#responses

  16. David Mackey

    January 1st, 2007 at 7:54 pm

    I imagine Google may have to enter a slower development pace to avoid these pr nightmares.

  17. mrshl

    January 1st, 2007 at 7:57 pm

    Seems like a good time to remind people they shouldn’t be letting just any old web site run script on their browsers.

    http://www.noscript.net/whats

  18. Guigo

    January 2nd, 2007 at 4:00 am

    Folks, that means BACKUP all your Google stuff time by time, or you’re under the risk to open your Google Notebook one day and find it empty..

  19. Sami K

    January 2nd, 2007 at 4:19 am

    The JSON url won’t work now (it has been fixed), BUT the XML Url still returns your contact list … not yet fixed apparently

    The XML Url : http://docs.google.com/data/co.....max=999999

  20. Carlos Granier-Phelps

    January 2nd, 2007 at 8:23 am

    Michael, I reported a somewhat similar exploit almost a year ago:

    http://red66.com/blog/2006/03/.....-contacts/

    It’s different in that you don’t need the API to exploit it, but you do need physical access to the target computer. I reported it to Google at the time, and I believe it was eventually fixed.

  21. Sascha

    January 2nd, 2007 at 8:59 am

    I think for things like API security holes it comes in handy that they are still waiving the Beta flag under their logo (after how many years? 3? 4?), so they can still claim that you agreed to the Beta terms, which for sure don’t take any responsibility if anything like this happens. That being said, I agree that Google has become enough of a household name that people tend to trust it, no matter if it says Beta or not, and if something bad happens, the pillar of trust begins to crack. And lately, it’s been cracking in several places.. hopefully they can fix it before it crashes!

  22. Kingsley Joseph

    January 2nd, 2007 at 10:10 am

    What most people here are missing out is the fact that you have to be extra careful when creating JSON APIs. Unlike services which return XML, JSON calls can be easily made across domains. If you tried to make an AJAX call, it would fail, but an AJAJ (JSON instead of XML) call would work.

  23. Daniel

    January 2nd, 2007 at 3:43 pm

    Did you ever notice:
    Within the sponsored links box on the top of a Google paid search results listing clicking anywhere takes you to an advertisers URL?

    Also, if you click on the text “Sponsored Link” it takes you to an advertisers URL vs say a description of what a Sponsored Link actually is.

    Lame.

  24. Jimmy K

    January 2nd, 2007 at 4:14 pm

    What the hell is up with Gmail and the inability to buy more storage space or easily delete attachments or at least easily search for the largest attachments!? I am out of space and it’s a nightmare. What are these people thinking? This can only be a growing problem.

  25. Dan

    February 7th, 2007 at 2:53 am

    Invite yourself, create another account and forward all mail from your existing account to the new one.

    Easy.

  26. Saul

    February 13th, 2007 at 1:45 pm

    Jimmy and Dan,

    Well, even though Dan’s quick fix suggestion would certainly work, this is what in my country we call a chapuz; a kludge, a McGyverism if you will.

    The thing is, Google is not in the business of selling email space, Jimmy. They would end up spending more sustaining the infrastructure needed to collect cash from a few individuals, than what they would actually gain from providing such a service. Sadly, their standard answer at the moment is “We keep adding free space, please bear with us”… but this is hardly good enough for the growing number of folks who are running out of Gmail space.

    What Gmail sorely, sorely needs is the ability to sort messages by something other than date. All over the Web you read requests, cries even of folks who want to sort by read/unread messages, sort by size, sort by answered/unanswered. I’m guessing that, given the way Gmail works (based on searches), implementing sorting has proven so difficult that they haven’t rolled it out just yet. I don’t even want to imagine the possibility that they haven’t even begun work on this… although that’s certainly possible.

    And Jimmy, one final word: you can click on the little “Show search options” link next to the search buttons in Gmail, which shows an option to search for emails with attachments. Maybe not a complete solution, but it’s a start.

  27. Saul

    February 13th, 2007 at 1:51 pm

    I forgot to include this in my last message:
    http://labnol.blogspot.com/200.....under.html

    There are some useful tips in there for keeping your inbox size under control. The one I found particularly useful is this one:
    “» The query string “has:attachment” will list all messages that have an attachment. If you further refine the string to “has:attachment from:me label:sent” - it will show all messages with attachment in the Sent Mail folder that were sent by you. Deleting them can retrieve lot of important space.”

    There are more good tips in there. Give it a look.

  28. moh

    February 20th, 2007 at 6:10 am

    please help every time i try to log to my account even try to log to gmail site or any site start with google i have a massage your page can’t be displayed
    any body help
    i have also fire fox & it did not help
    moh

  29. moh

    February 20th, 2007 at 6:17 am

    please help every time i try to log to my account even try to log to gmail site or any site start with google i have a massage your page can’t be displayed
    any body help
    i have also fire fox & it did not help
    moh
    any body answer me

  30. Gwagg

    February 23rd, 2007 at 5:26 am

    Gmail has been down for 12 hours! Argh

    moh,
    you must be behind a proxy or router that has been setup to block google.

  31. kayenne

    March 5th, 2007 at 2:14 am

    I can load up google page to receive mail, the inbox appears but no mail is showing, either there or in any of the boxes (sent mail, archives. etc) Google will not allow me to scroll down the page or access any other instructions. I can compose and send mail. I have two accounts and the same thing happens on both of them.

    My husband has a google account and uses the same computer and has no problems.

    Has anyone any ideas please.

  32. donna

    March 7th, 2007 at 8:46 am

    i can’t even log in the gmail account. it’s giving me the proxy server page… same thing for yahoo’s email…. what’s going on???

« Previous post
Next post »