Slashdot Mirror
Google Antiphishing Site Exposed Private User Data
Juha-Matti Laurio writes "Google has removed a few user names and passwords posted inadvertently to a phishing blacklist it compiles and makes publicly available on the Web. This information was submitted to Google by Firefox users with the browser's internal antiphishing toolbar. This feature, developed in cooperation with Google, enables users to report potential phishing sites to Google's blacklist database. Google has reportedly implemented a new mechanism detecting login data in submitted URLs to prevent sensitive information from getting posted to the list." The article notes that news of this minor lapse may obscure the ongoing problem of sensitive data exposed on the Web and findable via Google and other search services.
It was discussed on the full-disclosure mailing list 2 weeks ago. If Google is continuing to do this, it's hard for me to see it as anything but irresponsible.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
Read the best of all of Slash: seenonslash.com
Sounds like we have some sites that are passing persistent username and password information in the URL (not just querystrings etc). That's pretty lame. I think Barracuda SPAM Firewall does this as well. Perhaps one of these days we'll just see applications with a higher level of security and won't have to worry about this so much.
Now please excuse me, g00gle.com tells me I need to enter my gmail login, password, and a valid credit card number to unlock my gmail account.
"Google also encourages users to use its search engine as a free credit card and Social Security number monitoring service for Web-based content. "We also suggest that individuals create Google Alerts for their credit card and Social Security numbers," the company recommends. "You can be notified once a day or once a week if a new result appears on Google for this query."
As if google doesn't know enough about us, whats next, check google to see if someone is eating the same meal as you for breakfast?
"This information was submitted to Google by Firefox users with the browser's internal antiphishing toolbar." So, the antiphishing toolbar is submitting full URL's without stripping them of uids/pwds/hashes. Sounds like both FF and Google are to blame for this one.
This kinda is a big deal. Imagine all the customers of Bank of America, Suntrust, Citibank, and Wachovia who are constantly reporting to google whenever they come across a phishing site. Dyslexic still continue in reporting fishing.com to google *sigh*.
Previewing comments are for sissies!
We only comment about the jerks who phish for one reason.
We didn't think of it first.
Free childcare classifieds: www.carebrite.com
You can get it here
this blog was posted to the full-disclosure list a couple days ago...has a lot more on the technical details of google's phishing protection and firefox:
a fe-browsing/
http://jon.oberheide.org/blog/2006/11/13/google-s
Why is this googles fault? Try blaming the retarts that use the URL parameters for username and password.... Come on that's web programming 101...
http://portal.spidynamics.com/blogs/spilabs/archiv e/2006/12/19/IE7-_2D00_-Phishing-vs.-Privacy.aspx
e /2006-12/msg00100.html
http://www.webappsec.org/lists/websecurity/archiv
Recetly, I've found out that I don't have a web browser that is not threatened by some nasty bugs or exploits. So after a long research I've found "Offbyone" browser, and it rulez. Website loading is -rapid- compared to anything outthere. No Web2.0 spyware.. no problems.
And did you notice how slow those Web2.0 sites are? The usability went from 4/5 to 2/5 with all those _web 2.0_ upgrades. There is nothing I was missing with old Slashdot, old Yahoo! messageboars or old Digg. All those sites were better under the old scheme and faster. Now you can play Doom in the browser right? Wrong, I play Doom on my XBox360 Live Arcade not in the _web 2.0_ bloated browser.
Let's get all of the Google nuthuggers out of the woodwork to defend their g00gl3!!!11 Now, if it was Microsoft on the other hand, they would be skewered to no end for a SNAFU such as this.
...I mean, if you publish the information nobody has to phish for it. Sooner or later, all those phishing "skills" will atrophy, and there'll be no more phishing!
This was a few years ago.
To, from, and subject only, but it was still pretty interesting because you could tell who had been distracted at work.
When reviewing stats of how many offences are committed using a straight IP address followed by a typical website secure address, I would say Point the finger the other direction at these DDNS services that do no verification of what content they are allowing these fly by night websites to host.
o gin/aseer223as/index.jsp or any other phishing scam? To be honest I haven't seen on in my inbox in 2-3 years.
2 23as/index.jsp which makes it a lot harder to notice over the earlier scams.
When is the last time you received an email stating to update your bank info at 255.255.255.255.securebanking.BankOfAmerica.com/L
On the other hand I almost weekly see phishing emails for sec.tw.seurebanking.BankOfAmerica.com/Login/aseer
Why hasn't the governments of this 21st century world recognized that we are a Computer born society and that if immoral acts of theft are occurring that we need to make the individuals responsible for allowing such a simple act of theft to be prosecuted. I say fry ddns.au, ddns.com.au, dyndns.com and all the like of them for failing to provide some sort of safe guard of abuse of their services. How difficult would it be to add webpage crawling to any DDNS service before allowing the registration of the hosts IP? Scan the hosts pages compare them to a listed of registered banking/brokerage/retail/government pages and if they have offending content immediately notify law enforcement and the ISP.
Internet is born of Free Speech and the like but Free never meant $Free$.
Switch to Internet Explorer 7!
The Great Google, with its thousands of very highly educated people accidentally releasing private information? Tell me that it just isn't so. What happened to "Do No Evil"? And are those highly educated people that can run and pass The Great Google Hiring Gauntlet no so smart after all?? Tell me that it just isn't so... :-p
Does anyone know what limits are placed on the urls that are sent to Google(and with IE7 Microsoft)? I figure that if these companies wanted to they could use all these urls to piece together what the most popular search results should be for any query. Even if these companies could not do this, a community-based, properly anonymizing service could almost replace any search engine on the planet by tracking what keywords lead to what websites people click on. Has anyone heard of this idea or has it been shot down for some other reason besides the privacy concerns?
"... few user names... minor lapse... "
/. story would say if, say, Microsoft or Sony had screwed up like this?
Can you imagine what the
Sorry!
Smokedot.org
Okay, so people are accidentally sending Google URLs with their usernames and passwords in them, and Google is then reporting this information to whoever cares.
But the URLs people are submitting are URLs of sites they think are phishing sites. People are effectively saying, "I think this site stole my password, which is 12345." Okay, so maybe Google shouldn't widely distribute this accidentally-disclosed information, but... how much do you care about whether the general public can see your password, when you've already provided it to somebody who was actually trying to collect it for presumably nefarious purposes? Surely these passwords have been changed, right? Right?
This is off-topic, and if you want to mod me as such then waste your points, but seriously, why can't these "first posts" that are basically piles of shit not just automatically removed? Not that it takes much time to skip over reading it, but the level of care associated with these comments by the administrators is so non-existent that they will just KEEP HAPPENING until something is done about it!
What is my assurance that a "trusted partner" doesn't gain access to "Aggregate search queries with no personally identifying information involved" five years down the line and run grep /[0-9]{3}\-[0-9]{2}\-[0-9]{4}/ against it? Anything that goes into the search hopper is retained, forever, so that Google can use it to tweak their algorithms. Google *has* my credit card number on file (AdWords) and can even access my bank account (Checkout) but these are risks that I can tolerate because presumably they have procedures in place to protect information they KNOW is sensitive and even if they don't my bank has ultimate liability for unauthorized charges. I'm not NEARLY so convinced that they have adequate procedures in place to protect search queries, which most people would assume are probably pretty harmless. (I know they bounced a Justice Department demand to turn over a million random queries once. Bully for their lawyers yesterday, what about their most clueless employee *tomorrow*? AOL posted their queries out of a desire to do good and genuine ignorance about the downside potential, too.)
Every time I accessed a credit card number on a customer account at an old place of employment there was an audit trail generated and what numbers I was accessing was periodically reviewed against what accounts I had legitimate business servicing. Does Google keep similarly in-depth records about internal/external use of their query data? I don't have confidence that this is the case.
Help poke pirates in the eyepatch, arr.
Well ... without AI it is just impossible to distinguish between troll and off-topic first posts and on-topic fp-s.\ ... let them do it. Democracy at it's best :).
Besides, if they want to spend their karma this way
Pardon the use of "automatically." I simply meant that, upon an editor seeing the crappy first post, how hard would it be to write a "delete permanently" button and use it?