Slashdot Mirror
Gmail Reveals the Names of All Users
ihatespam writes "Have you ever wanted to know the name of admin@gmail.com? Now you can. Through a bug in Google calendars the names of all registered Gmail accounts are now readily available. All you need to find out the names of any gmail address is a Google calendar account yourself. Depending on your view this ranges from a harmless "feature" to a rather serious privacy violation. According to some reports, spammers are already exploiting this "feature"/bug to send personalized spam messages."
If I was worried about privacy with my gmail account, google wouldn't have my actual name to have the ability to give it out.
This bug really doesn't affect me as my email address is my real name.
How we know is more important than what we know.
oh noes! they can figure out my real name just by using google calendar and my email address (first.last@gmail.com)!?
Didn't your mother teach you not to do things you would be ashamed to see on the evening news?
In short, yes. Ever since GMail was launched and people discovered that its way more convenient that Outlook/Yahoo/etc., there's been a steady conversion of addresses in my contact list to "@gmail.com". People are moving to GMail as their primary mail accounts -- I don't know if you've been listening since 1998, but "free web-based email" is now often much, much better than whatever your university/company offers.
So yeah, this is a pretty big deal -- not so much for spammers, but as a privacy violation. You can't do a name lookup for an arbitrary e-mail address, and you shouldn't be able to do it for a GMail address. Someone should get an ass-kicking for this.
An old-timer with old-timey ideas.
chunkylover53 is going to be most displeased.
IBM doesn't play chess with the Universe.
ahah! But now the spammers KNOW FOR SURE that there isn't an underscore/dash/whatever between your first and last name! You're so screwed!
Really, now everyone will know my name is John Smith? I am outraged and will see my lawyer immediately!
-- john.smith@gmail.com
But, does this constitute evil? So far so good. My gmail account is my real name anyway. I'll be looking out for the evil...
Everything I've ever learned the hard way was based on a statistically invalid sample.
Someone should get an ass-kicking for this.
Agreed. I'll certainly be asking for my money back...
This is exactly why I remain leery of applications in the cloud. I've got a google account for work, and that's the only use it ever sees. And it's under real.name.company anyway, and has no other useful information associated with it.
I try really, really hard not to leave to broad a trail online. Those databases just never die (except when they do, of course - but the timing is subject to Murphy's Law, so it's never in my favor).
I'm gonna go hide in my cave now.
cogito ergo dubito
Gmail strips out punctuation. So email to First.Last@gmail.com goes to the same inbox as FirstLast@gmail.com
I know individuals with a hell of a lot of sense who would give their real names in such a situation.
So? Part of the reason for that is that full names in and of themselves are not really a security risk. I walk around all day in public with an ID badge that gives my first and last name. Big deal. Our names are our public identifiers.
If a job's not worth doing, it's not worth doing right.
Does this mean they're only sending spam to people who really need Cialis?
...after which exercise balls (in lieu of the usual chair) will be thrown in a fit of unbridled anger (several tech websites will report a mysterious colorful stream of balls spilling out the Google offices).
You can hold down the "B" button for continuous firing.
Why would they have such an unnecessary expense?
I have no problem giving people my gmail account address for business-type-transactions because it is a hell of a lot easier to keep track of my conversations and actually get business done using gmail. When I do need a "professional" email address I usually just have it forwarded to my gmail account, again, because it is easier to keep my life organized that way.
Not to mention how great gmail and Google Calendar Sync work on my BlackBerry.
It has really become a first-rate application suite for just about every use.
-nick
Then they'll know what part is your first and last name regardless of capitalization! THIS IS HUGE!
for a small business owner, why not. I manage a few websites. Very, very small. Less than 20 people have write access. They wanted email. some users would use outlook or outlook express, others wanted a web mail front end. The email client the hosting service had was horrible so I hooked them up with a gmail hosted services. It works very, very nicely for them.
there are some cases where Google is a good alternative to other options.
This is horrible. This is an outrage! I'm writing Google a letter telling them how awful this is an how they need to work on the Q/A. I mean my GMail address *IS* my full name, but I'm not going to let that fact stop me from acting like an emotionally charged idiot!
No sig for you!!
Ditto.
Since all names are really all about pretense, I set up mine on Gmail as "firstnamelastname@gmail.com" (Where 'firstname' and 'lastname' are my actual names.
I think there are only eight or ten other people in the US with my same spelled the same anyway. Regardless, I think Gmail's spam filters have only let a couple of false negatives into my Inbox.
*THIS* is why I use very different passwords for web mail as say, my banking or credit report service passwords, etc... If the password file were to be breached, I would only have one to change.
I suggest a good password management app such as this one: http://passwordsafe.sourceforge.net/
What, your parents named you Quantum G?
It's a good thing they caught this in beta, before it affects a large number of people!
http://www.theonion.com/content/node/44460
http://notanumber.net/
So yeah, this is a pretty big deal -- not so much for spammers, but as a privacy violation. You can't do a name lookup for an arbitrary e-mail address, and you shouldn't be able to do it for a GMail address. Someone should get an ass-kicking for this.
You know what else... Someone left a thick softcover book on my doorstep the other day that listed the names, addresses, and phone numbers of everyone in my region. Hundreds of thousands of people, maybe millions. I called the police about this, but they seemed unconcerned.
...is that this will allow Phishing scams aimed at GMail users to *seem* so much more plausible.
What? You expected humour?
The Families Educational Rights and Privacy Act of 1974 allows a student at a university to require the university to not release their name to anyone. For example, if you check for my name at my school's phonebook, you'll find I'm not listed. If you call my registrar's office and ask for information on me, they'll tell you that they don't have a student by my name. You see, it's against the law for them to even confirm that I'm a student.
Since many schools have outsourced their email systems to Gmail, anyone can generate a full roster of student names through this trick. This could obviously result in many violations of FERPA.
Ok...so I only see this as an issue for people trying to hide their identity for something nefarious. I mean christ, I give out my full name a dozen times a day to people I don't know. "Hello, we have a circuit down and need to open a ticket." "Hello, I have a few questions about your product." and damned near every other statement you might make when calling another company is almost IMMEDIATELY followed by "Can I have your name please?" Of course this is after they answer the phone "Hello, my name is..."? Now granted they don't always use their last name if they are just phone jockeys, but almost anyone worth anything in terms of sales/technical/etc reps will give you their full name, email address, phone number, etc.
In other news, purchasing cigarettes and alcohol require you to disclose your first and last name when you show your ID! Even worse, there are rumors that every time you make a purchase using anything other than cash you have to disclose your first and last name. This isn't a privacy issue, maybe a privacy irritation, but certainly not anything to get in a ruffle about. It isn't like names are even really unique identifiers. Now if it revealed birthdays or SSNs or credit card numbers or something then I would understand.
Course, maybe there is something here I am ignoring. Do the people getting in a ruffle about this freak out when someone of the opposite sex asks their name? "Oh my god they are trying to invade my privacy!" Generally it is considered "normal" to give them your name so they have something to call you other than "freak" or "uberhax4234".
The only change I can believe in is what I find in my couch cushions.
Honestly - your name isn't a secret...
and if you're trying to hide your identity and you put your real first / last name into a free service, you're a moron.
You mean Bob Marley, Elvis Presley, Jimi Hendrix, and Al Gore HAVEN'T come back from the dead and signed up for emails with Gmail thousands of times from thousands of different locations? -Registered Spammer
I am the richest astronaut ever to win the superbowl.
citation needed. seriously, what you describe would be a huge security/privacy hole, and I don't believe you.
This goes well beyond the scope of SPAM. Once they match your real name with your e-mail, they can start finding out what you do online, what sites/forums you visit, etc (Google knows everything).
I'm much more worried about ID thieves finding out about my life than about getting personalized spam.
Posting to clear moderation because I was brainless and didn't get the joke.
The role of the writer is not to say what we can all say, but what we are unable to say. -Anais Nin
False. For GMail, dots are invisible in regards to who receives the email. Emails sent to foobar@gmail.com and foo.bar@gmail.com and f.o.o.b.a.r@gmail.com all go to the same address. Messages sent to foo.bar@gmail.com don't go to bar@gmail.com.
Really, I wonder how many times people have used bugs like this to steal an identity, only to find that it's all fake info anyhow.
Personally, every few years, I Re-invent someone... Use a fake(completely fake, not false) identity for everything from Cellphones to gmail.
I google my real name, nothing, google my 'fake' like 20 pages. My 'fake' identity is WAY more famous than I am... I'm kinda jealous.
THE WORLD IS GOING TO END!!!! eventually.
you are incorrect. john.richards@gmail.com send mail to johnrichards@gmail.com not to richards@gmail.com. Stripping the punctuation means gmail ignores it, not kills off the first part.
what you are talking about is using + in your email address: see here Google Blog
-- All this knowledge is giving me a raging brainer.
No, her parents named her Moon Unit. What kind of fucking name would "Quantum G" be?!?!
Wait, the Rolexes are fake?!?!
eBay sent this message to FULL NAME (account)
Your registered name is included to show this message originated from eBay. Learn more.
The "Learn more" link takes you to http://pages.ebay.com/help/confidence/name-userid-emails.html which explains
Since people who send out spoof emails often don't have your first and last name as well as eBay User ID, receiving an email that contains this information should increase your confidence that the email was sent by eBay.
Whooosh.
I am aware of the period-ignoring feature, by which gmail treats Bob.Smith@ and Bo.bS.mith@ and BobSmith@ as the same person. That is not at issue. The parent claims that email sent to Bob.Smith@ is also delivered to [just] Smith@, which I believe to be false.
There are two X's in Rolexx.
Where 'firstname' and 'lastname' are my actual names.
Damn! Some nasty name you got there! Perhaps I'll name my son 'firstname' too!
Oh man! So email can be sent to me at the.rapist@gmail.com or therapist@gmail.com?
I was like, really concerned for a minute. I thought spammers had managed to access something *important* or something.
So, this is about someone that already knows my email address accessing the "name" that I show on every email I send out?
To quote "The Whole Nine Yards" -
*Oh* *My* *Gawd*!
Pug
An Invisible Entity of Vast Power whose existence must be taken on faith alone: Liberal Media
is just my Social Security number.
Yes, and using the exploit referred to in the article, your real names will be revealed as Jekyll and Hyde, respectively.
A World in a Grain of Sand / Heaven in a Wild Flower,
Infinity in the Palm of your Hand / And Eternity in an Hour.
A World in a Grain of Sand / Heaven in a Wild Flower,
Infinity in the Palm of your Hand / And Eternity in an Hour.
I've used about every service that they have had, and this is pretty much how everything they do works. You don't opt in for anything, you have to figure out how to eventually opt out.
You fumble through the options screen and finally find the right combination of checkboxes that doesn't throw your name out there, and let everyone see everything by default.
"Hey guess what users, we added this nice option that lets everyone see your real name, address, and link to a picture of your house on google maps. Don't worry, it's been already enabled for your convenience!"
They also ignore anything after a + sign, so I use username+site@gmail.com to sign up for legit stuff where I think there's a chance of getting spammed in the future, if I do get spammed on that alias I write a rule to drop it to the floor and contact the company letting them know they now have zero chance of getting future business with me. The only problem is when a stupid validation script writer doesn't know how to read an RFC and claims the address is invalid. In that case they get my old excite address which is nothing but a spamhole. I guess I could use my google apps address, but it's too much of a pain to create a new user just for one site and I never read the catchall mailbox unless I know I'm missing an important email.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
And two O's in Roloxx. You know it's the real thing because the dial on the watch face goes up to eleven.
mine goes to thirteen...
MP3 Search Engine
just create any calender entry (single click on an empty field) with just the gmail address in the main 'What:' field, select 'don't send' and open it up (double click)... there you see the full user name of the gmail account.
;)
Not sure why the article makes it so complicated...
So the admin@gmail.com guy is named 'smart ass'... poor fellow
You may have been given a book that does name->phone-number lookups for those who have not chosen to opt out but I believe that it is very much harder to get access to the inverse function that does phone-number->name lookups. I suspect that it varies by jurisdiction but I believe that in some places at least, people can be in serious trouble for giving access to the database that performs that function to those who do not have the proper authorization.
Those who are familiar with security will know the concept of work-factor. You can reverse lookup with a phone book but if all you have is a printed copy it is a lot of work. The cost of doing that work is the deterrent. Modern technology has made it easier, but it is still costly. The idea is to adjust the cost/benefit ratio so that an attack is not worthwhile.
The concern for the revealing of names from addresses is that it makes it cheaper for confidence tricksters to deliver some plausible message that will trick people into giving them some of their money. If the average cost of creating the plausible message becomes less than the expected return then the level of scamming will increase. Those of us not taken in by the tricksters will still suffer from increased level of junk so it is in all our interests to take this kind of thing seriously.
Check the message headers. Probably, the envelope recipient (SMTP RCPT To) was your account and the header "To:" was the address you don't own.
There are no karma whores, only moderation johns
Actually there is another feature of Gmail that was advertised through their blog. And it states that me+nospam@gmail.com is directed to me@gmail.com
So basically all the characters after the + sign (including it) in the email address is stripped to determine to receiver. You will see that the email has been sent to me+nospam@gmail.com and then can filter on it. If used intelligently, it can tell you which site is selling your email address to other 3rd party companies.
I'm going to name my kid 'lastname' instead.
I wondered why all the spam was suddenly titled, "Hey Satanic!" and "Dear Mr. Puppy"
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.