Repeatedly refers to "Gaia ID" but never says what that is.
Leaking the email of any YouTube user for $10k
481–487 of 487 posts
Re: Leaking the email of any YouTube user for $10k
#482I found this title confusing. For those who didn't make it toward the end of the article: the leaked emails didn't cost them anything (except their time and ingenuity), and they received 10k as the bug bounty.
Me too. I thought it meant they were offering this as a service for $10k.
Me too.
I thought it meant they were offering this as a service for $10k.
Re: Leaking the email of any YouTube user for $10k
#483Re: Leaking the email of any YouTube user for $10k
#484What can one do with a Gaia ID? I don't think the article went into the impact of having it.
Long time ago I discovered a similar google error, accessing youtube got me in other people accounts. I mean just going to a youtube will show me signed in into another user's account. It turned out there was a caching/database issue, and the isp/googlr mingled accounts. Here is the old report:"The issue has been replicated by the editorial teams of both itp.net and Windows Arabic magazine. In testing, the user profiles that were visible were for users that had logged into YouTube only a few hours previously, suggesting that the pages have been cached by either Google or Etisalat’s own servers, and were somehow being accessed in error through the cache.
Neither Google nor Etisalat have responded to request for comment at the time of writing.
The issue appears to be very similar to a problem which was reported by users of Kuwaiti ISP FASTtelco , who said that they were able to see other users Gmail accounts and other personal details, although this was later denied by the ISP'
Re: Leaking the email of any YouTube user for $10k
#485> Here's a POC of the exploit in action: This video has been removed for violating YouTube's Terms of Service That's hilarious.
OP actually shared an actual existing user’s email address to prove the concept. In the reuploaded video, the email address is blurred.
Re: Leaking the email of any YouTube user for $10k
#486Earlier quoted context omitted.
The USofA is the bizarre exception here: The United States has a rather unique way of writing the date that is imitated in very few other countries (although Canada and Belize do also use the form). In America, the date is formally written in month/day/year form. They don't use metric, still use First Past the Post voting, elect a mini monarch with effectively unchecked powers, ... it's an odd place.
We write the date that way because that's how we say the dates and conversation: today is February 13th, 2025. 02/13/2025. I personally use ISO dates because i like getting sorting for free.
Ah yes, the famous American holiday of July 4th ;)
Re: Leaking the email of any YouTube user for $10k
#487Misleading title - the $10k is the bug bounty reward.
Still, impressive writeup. Shows how chaining a few reverse engineered endpoints can generate created a significant exploit.