Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Calendar Unexpectedly Leaks Private Information

shkspr.mobi

Post reply on HN
Print view View original

21–30 of 138 posts

Re: Google Calendar Unexpectedly Leaks Private Information

#21

Post by NoahTheDuke »

ritikk4 wrote: post #15
nmc wrote: post #12

Earlier quoted context omitted.

Out of curiosity (and regardless of the meaning of your comment), are you completely unrelated to the author of the comment you are linking to? Except the "3" at the end, their pseudonym is identical to yours. Here on HN people do not like fake accounts.

It's mine, I just signed up to join the discussion, but evidently new users get rate-limited to only a few comments, so I've incremented the username by 1 to indicate it's still me.

This probably means you should stop contributing.

Re: Google Calendar Unexpectedly Leaks Private Information

#22

Post by edent »

aviraldg wrote: post #16

This is not a "private information leak." It's expected behaviour. Entering information in that field to create a new event results in Google Calendar parsing your information as best as it can, to automatically set things like the date, time, event description and of course, the participants (the apparent privacy leak here.)

Why then, does a notification dialogue box pop up when you enter the information on the calendar overview page?

Evidently, someone thought it was a good idea to warn there that an invite was going to be sent. So why does no warning pop up when you're in the "Edit Event" view?

There's a discrepancy here.

See my video in the blog https://www.youtube.com/watch?v=ZqjYb6eiMWE

Re: Google Calendar Unexpectedly Leaks Private Information

#23

Post by aviraldg »

Elessar wrote: post #20
aviraldg wrote: post #16

This is not a "private information leak." It's expected behaviour. Entering information in that field to create a new event results in Google Calendar parsing your information as best as it can, to automatically set things like the date, time, event description and of course, the participants (the apparent privacy leak here.)

If you're aware of the feature, it's not a privacy leak. If you aren't, it could be very damaging. It would have been nice if the first time the Calendar parsed and sent emails on behalf of a user, it would ask if this is what they wanted. It doesn't have to bug them ever again, but that's a single instance of training that would minimize confusion.

https://support.google.com/calendar/answer/36604

Re: Google Calendar Unexpectedly Leaks Private Information

#24

Post by carsonreinke »

est wrote: post #5
SunboX wrote: post #2

Btw. ownCloud 6.0.1 was released yesterday: http://owncloud.org/releases/Changelog

God I love the idea of ownCloud so much but secretly hope it's not written in PHP. I run a wordpress site for 3 years, and one day a hacker took my site over with a bug from a plugin.

What are you talking about? You have written off PHP because of a WordPress plugin issue.

Re: Google Calendar Unexpectedly Leaks Private Information

#26

Post by blueskin_ »

ritikk3 wrote: post #4

A couple of things: That is expected behaviour, email address in reminders applies coordination. It's basically parsing your command correctly 'email this address'. Second, the zdnet post you link to towards the end is full of inaccuracies: https://news.ycombinator.com/item?id=7107554

Read this guy's history (and the same usernames with lower numbers on the end (edit: ...and now he's onto 4)) for some comedy.

Google employee, or rabid google fan? I can't decide.

Re: Google Calendar Unexpectedly Leaks Private Information

#27

Post by est »

camus2 wrote: post #11
est wrote: post #5

Earlier quoted context omitted.

God I love the idea of ownCloud so much but secretly hope it's not written in PHP. I run a wordpress site for 3 years, and one day a hacker took my site over with a bug from a plugin.

well, you had a problem with a badly written wordpress plugin ,not PHP. or are you saying PHP is insecure and no insecure code can be written in other plateforms ? for a project to be popular amongs developers and hobbyists , it has to be written in PHP, because PHP is easy to deploy even if you dont know PHP. By the way, most CMSes on other plateforms assume you know the language , PHP CMSes dont, so maybe there is…

> you had a problem with a badly written wordpress plugin

The plugin is top 10 popular one

> because PHP is easy to deploy even if you dont know PHP.

Wordpress has clean URL, but under the hood many .php files are directly accessible via URL, so hacker found a exploit, crafted a parameter aginst one particular .php, and got in.

The solution? Limit URL entry to only one .php file (like index.php), more rewrite configs and mod_security. So you lost the benefit of copy-to-update, it becomes just as hard like other language/frameworks.

As ownCloud community grows, I think this problem will surf again and it will end up like many PHP forum/CMS today. You can put up a usable site very quickly, but once or few months you have to patch the system, and many plugins you need most are abandon-ware.

Re: Google Calendar Unexpectedly Leaks Private Information

#28

Post by username223 »

edent wrote: post #8
slazaro wrote: post #3

The worst thing about things like this happening is the feeling of helplessness when you can't reach anyone in the company or when they just say "it's not a problem".

To be fair - they were very quick at responding and asked questions about my disclosure. The security team is very responsive but for normal users there is no way to communicate with Google.

This seems like a business opportunity -- come up with a steady stream of "security issues," then use the resulting access to provide paid customer service for GOOG.

Re: Google Calendar Unexpectedly Leaks Private Information

#29

Post by leephillips »

This article has pretty much the same content as my article from March, 2010: http://lee-phillips.org/gcaldisaster/

Even the titles are similar: this one's called "Another Google Privacy Flaw"; mine was called "Another Google Privacy Disaster Brewing". So people have been complaining about this since at least 2010, and Google by now has pretty firmly established that they don't care.

Post reply on HN