11–20 of 47 posts
How does it work?
Looks like Google is aware of it as the reference to gaia_id has been removed from Youtube pages source (Aug 2020), locked down public accessibility of photo albums (Sep 2020), and prevented connected email address leaks from Webmaster tools (Sep 2020).
It also lists Youtube channels with similar names, which is generally wrong.
Would love to see a Svelte SSG (Sapper’s nice but no movement there either).
I’ve had the chance to use Gatsby, Next, Nuxt and Hugo out of all the above my preference is Nuxt but it lacks graphQL. I’ve also used Gridsome which I love problem is I can’t really recommend it because I’m pretty sure the project is becoming abandoned... their official twitter account hasn’t posted anything since Sept. 2019 and there’s very few pushes to the repository which is a shame because it would have been my…
This seems to be interesting, but I couldn't actually fetch android device information from the targets I have tried; THAT seemed to be private information that nobody should access, along installed apps. Everything else seems just crawling/pinging for publicly available information. Maybe the "Probable Location" is something a bit private if somebody didn't publish it in google maps explicitly... but then, it's not…
I agree with this. I'm worried about the probable location though, because I've realized that people tend to post reviews (even if it's a one-off) in a location where they live. All the probably locations it was able to guess, it was right.
But, actually the city where I live is a public information... it's on my linkedin profile, etc. I don't actually care.
This tool doesn't seem to be leaking private information of any kind. It's just a way to consolidate existing public information. I think pipl (pipl.com) used to do something like this across accounts, some 10+ years ago.
How does it work?
Then it just opens https://www.google.com/maps/contrib/+person id and there are your reviews on google map with locations obviously.
Then it tries to fetch your public albums from google photos using same technique, but that does not work anymore. When it did work, it extracted meta info from public albums. That's pretty much it.
Earlier quoted context omitted.
I agree with this. I'm worried about the probable location though, because I've realized that people tend to post reviews (even if it's a one-off) in a location where they live. All the probably locations it was able to guess, it was right.
Don't post reviews all around where you live, then. But, actually the city where I live is a public information... it's on my linkedin profile, etc. I don't actually care. This tool doesn't seem to be leaking private information of any kind. It's just a way to consolidate existing public information. I think pipl (pipl.com) used to do something like this across accounts, some 10+ years ago.
That's what's on the tin: "an OSINT tool"
If you check your own account, it finds albums and can even download some shared photos.
If you check the same account but using another account's cookies… surprise surprise, "No album" appears.
# Own account
Name: ---public name----
Last profile edit : 2019/12/01
Email : ----------@gmail.com
Google ID : ------id------
Hangouts Bot : No
Activated Google services :
- Photos
- Maps
Google Photos : https://get.google.com/albumarchive/------id------
=> 4 albums, 50 photos
Searching metadata...
[+] 1 device found !
- Apple iPhone 7 (40 pics) [2017/01/1]
-> 1 Firmware found !
--> 10.3.0 [2017/01/1]
Google Maps : https://www.google.com/maps/contrib/------id------/reviews
=> 167 reviews found !
Probable location (confidence => Okay) :
- --------, ----------
Name: ---public name----
Last profile edit : 2019/12/01
Email : ----------@gmail.com
Google ID : ------id------
Hangouts Bot : No
Activated Google services :
- Photos
- Maps
Google Photos : https://get.google.com/albumarchive/------id------
=> No album
Google Maps : https://www.google.com/maps/contrib/------id------/reviews
=> No reviewsUnless something changed lately, this is a little deceiving. If you check your own account, it finds albums and can even download some shared photos. If you check the same account but using another account's cookies… surprise surprise, "No album" appears. # Own account Name: ---public name---- Last profile edit : 2019/12/01 Email : ----------@gmail.com Google ID : ------id------ Hangouts Bot : No Activated Google ser…
> 02/10/2020 : Since few days ago, Google return a 404 when we try to access someone's Google Photos public albums, we can only access it if we have a link of one of his albums. Either this is a bug and this will be fixed, either it's a protection that we need to find how to bypass. So, currently, the photos & metadata module will always return "No albums" even if there is one.