Re: [Full-Disclosure] Gmail Information Disclosure Vulnerability

From: Remko Lodder (remko_at_elvandar.org)
Date: 07/05/04

  • Next message: Thierry Carrez: "[Full-Disclosure] [ GLSA 200407-05 ] XFree86, X.org: XDM ignores requestPort setting" 
    To: Maarten <fulldisc@ultratux.org>
Date: Mon, 05 Jul 2004 22:53:54 +0200

    Hi maarten, and the rest,
    Maarten wrote:

    > On Monday 05 July 2004 19:42, Eric LeBlanc wrote:
    >
    >>On Mon, 5 Jul 2004, System Outage wrote:
    >
    >
    >>I agree with "System Outage". Gmail clearly told us that their website is
    >>in BETA stage.
    >
    >
    > Beta, alpha, released, yada yada. Gmail is OPEN for the public, albeit you
    > need "an invitation". Thus, enough reason to disclose security holes.

    It's being used by others then gmail personel, so privacy and
    information that could be YOURS is at stake here. You just opened up a
    e-creditcard and got the numbers and information stolen, woeps, sorry,
    since it was vulnerable, now i have the codes as well. I need a car, i
    will use your creditcard. Thank you very much mister X, saved me a lot
    of money (ofcourse there can be other things in your mailbox as well...)

    >
    >
    >>For me, when a software is in 'BETA' (or 'ALPHA'), we SHOULD expect that
    >>this software MAY HAVE security holes. That's why they want us to test
    >>this site before going to the public release, and it's our job to notify
    >>to the gmail team all bugs AND security holes we may find. As long as
    >>this website is in beta stage, all advisory that someone may send in this
    >>list or elsewhere are NOT considered 'Security Advisory' for me.

    I do consider them as Security-Advisory. It's being used in the wild,
    more and more people are using it, and more and more information is at
    risk. Disclosing a bug first to gmail and then to FD is a normal way of
    responding to bugs. That way we ALL profit from it.

    >>The original author may not receive answers from the Gmail Team, but this
    >>site is NOT IN PRODUCTION. When gmail site will be official and when this
    >>bug is still there, NOW you can publish your security advisory.

    What exactly do you want to tell us? Wait until hunderd(s) people more
    are vulnerable for privacy disclosure? Some how i get the feeling you
    came from mars with happy campers that don't care about privacy and
    disclosing information that could risk your privacy.

    >>Futhermore, the best people for testing the software (bugs and security
    >>holes) is the public. They can do many things which we will never
    >>thought or imagined.

    Indeed, that is why gmail is letting people in , and the group is
    getting bigger, finding bugs, reporting them to gmail and then disclose
    them is a normal way to follow.

    >>BTW, I'm sure that the Gmail developers expect that the public will find
    >>some security holes...
    >>
    >>If we must publish all security advisorys about beta software, this list
    >>will be flooded...

    Beta software is not always used by thousands of people which get larger
    every day...Still i like the disclosure so i know that there are bugs
    taken out of the system before production. I would get an itch if i
    never heared of bugs of the application before. That means that with
    current state of coding and defense mechanism's there are a LOTS of bugs
    still present in the system. Now i would not use that ever in my life..

    >
    >
    > The very reason to HAVE a beta test phase is to find and flush out bugs early.
    > Doing that, the released program can be as flawless as can be. So when would
    > you suggest disclosing bugs is a good time ? Release date being too late...

    Exactly, disclose to gmail now, and then inform the public. Again and i
    repeat that again, it's a normal way of handling.

    >
    > Maarten
    >

    Cheers 

    -- 
Kind regards,
Remko Lodder                   |remko@elvandar.org
Reporter DSINet                |remko@dsinet.org
Projectleader Mostly-Harmless  |remko@mostly-harmless.nl
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
  • Next message: Thierry Carrez: "[Full-Disclosure] [ GLSA 200407-05 ] XFree86, X.org: XDM ignores requestPort setting"

    Relevant Pages