What could've been the largest data breach in the world - an attack chain on Google services to leak the email address of any YouTube channel
  • givesomefucks@lemmy.worldEnglish
    1532·
    11 days ago

    To clarify this is about someone identifying a vulnerability and getting $10k from Google for it

  • qaz@lemmy.worldEnglish
    28·
    10 days ago

    Here’s a POC of the exploit in action:

    This video has been removed for violating the YouTube TOS

    • pHr34kY@lemmy.worldEnglish
      13·
      10 days ago

      Sharing a video about a Google security vulnerability on Google’s own platform. What would you expect?

      • qaz@lemmy.worldEnglish
        11·
        10 days ago

        They did disclose it to Google before, and got a bounty but it seems the moderators from YouTube didn’t get the memo

  • flames5123@lemmy.worldEnglish
    281·
    10 days ago

    When FFXIV implemented better blocking tools this past summer, there was an option when blocking a single character to block the entire service account. This would be fine, but the implementation they went with is client side, and when you select that option, you get the service account ID. Which means that if you’re blocked by someone, you can’t made an alt character to stalk/harass them. But with third party tools, we can see this account ID. The stalker could just use a new account and find the person’s account ID that they were harassing and find any alt character they have in the game. They’re changing this soon as a third party tool popped up and is now able to do this, full source code leaked so there’s no shutting it down until the game devs change how it’s done.

    This sounds super similar, but the implementation that you had to do for google is crazy.

    • Redeven@lemmy.worldEnglish
      4·
      9 days ago

      Saying full source code leaked is a little wrong.

      Plugin was always open source, and all plugins for that framework are required to be open source by the framework’s licensing.

      Doesn’t change the fact that once one person did it, the code was available for anyone, though, you’re right.

  • TJA!@sh.itjust.worksEnglish
    211·
    10 days ago

    So… Google Mail will not show me emails if their title is 2.5 million letters long? Pathetic