G-Archiver Harvesting Google Mail Passwords

Posted by kdawson on Tuesday March 11, 2008 @05:47AM from the change-password-now dept.

Thwomp writes "It appears that a popular Gmail backup utility, G-Archiver, has been harvesting users' Gmail passwords. This was discovered when a developer named Dustin Brooks took a look at the code using a decompiler. He discovered a Gmail account name and password embedded in the source code. Brooks logged in and found over 1,700 emails all with user account information — with his own at the top. According to a story in Informationweek, he deleted the emails, changed the account password, and notified Google. The creator of G-Archiver has pulled the software, stating that it was debug code and was unintentionally left in the product."

1 of 462 comments (clear)

Min score:

Reason:

Sort:

Just wondering... by Doodhwala · 2008-03-11 05:59 · Score: 5, Interesting

So why did the binary program also have the password for the gmail account? One would assume that the email address would have been enough. After all, sending someone email doesn't require their password.