Major Google Web Accelerator Security Issue

[TimRogers]

That is seriously bad, though the post should be deleted to we dont get people deliberately using it to get into accounts!

[Vice]

That is seriously bad, though the post should be deleted to we dont get people deliberately using it to get into accounts!

585880190[/snapback]

err why? we need people to be made aware of the problem!

Remove the google accelerator and change all login passwords for accounts you where logged into when using the google accelerator, this should in theory stop anyone using the old cookie to gain access to any of your accounts.

[ChopSuey]

Another thread is already open on this topic:

https://www.neowin.net/forum/index.php?act=ST&f=8&t=317129

[ZiGGA]

Thanks for the warning. I've just changed my passwords and deleted the accelerator.

Google can lick my hairy ass on this one. That's a major flaw and to not notice it, well I have to question their developers.

[y0sh]

I guess google's plan of world dominance is leaking out..

[Laptop]

Google Web Accelerator BETA

[mAcOdIn Veteran]

Beta doesn't matter, because this is the intended result.

There's not a bug in the software there's a bug in the concept.

[Laptop]

i've turned mine off now, I see it as a bug :/

[G4M3R]

I was going to try it tonight, glad I came here first.

Edited May 6, 2005 by G4M3R

[Matt]

wtf you must be special.

585880028[/snapback]

he is the "one". :p

thats a pretty big security issue.

[Chode]

I'm glad I never used Neowin or any other forum during the 15 minutes I used it for.

[Larney]

Somebody was smoking abit to much of the wrong thing when making this :/

Edited May 6, 2005 by Larney

[DannyGlass]

Its just a beta so its still in testing wait for the final.

-DannyGlass

[zhangm Supervisor]

Perhaps the admins should temporarily disable cookies on the board, to prevent people's identities from being stolen? I'm sure many users would understand if the reason were posted on the front page.

[Larney]

Perhaps the admins should temporarily disable cookies on the board, to prevent people's identities from being stolen?  I'm sure many users would understand if the reason were posted on the front page.

585880327[/snapback]

It's not Neowin's issue. It's Google's. If anything encourage people to NOT use the Google Web Accelerator but don't disable cookies :/

DON'T DISABLE COOKIES!!!11!!1KKEEJEJEONENENOE

[mAcOdIn Veteran]

IMO the harshest yet most reasonable option open to Neowin would be to disable cookies only from the IP ranges of google, but I don't know if they have that much control over the board. But at least that way it would only affect users of Google Web Accelerator and not affect the rest of the members.

However one has to ask, is it Neowin's responsibility to protect the user from itself?

[Malisk]

Wow, now that's a beta issue if I've ever heard of one! :blink:

maybe the 'google conspiracy' is real? Or do they just have poor programers and QA?

Well, this is definitely a slip in their QA procedures.

Their programmers are generally good though. Look at google.com, Gmail, Google Maps, and so on. :)

I'm not sure of what "conspiracy" you're talking about, when it has to do with users logging into forums with another guy's account?

[Nelsinho]

:huh: sorry dude but if true then is one big problem :whistle:

[cork1958]

temporary cookie cacheing.... that does not sound good at all. :no:

maybe the 'google conspiracy' is real? Or do they just have poor programers and QA?

585880088[/snapback]

Both are true. The Google conspiracy and poor programmers. Any toolbar though is a joke. Useless crap!! Seen this coming!!

[hotwire]

Wow, who needs spyware when you can just have Google's Web Accelerator?

585880083[/snapback]

maybe google is tryin to spread out it's own version of spyware?

yes!!!!! spyware for free from google!!!! :cool: :cool:

[NienorGT]

What??? :omg:

Anybody can enter in a random user???

STUPID GOOGLE :angry:

Are we in Danger??? :cry: :cry:

[Malisk]

Are we in Danger??? :cry: :cry:

585880561[/snapback]

As I understand it, people using the accelerator can sometimes get logged in as other users using the accelerator.

[DannyGlass]

Yes that is correct! Jug!

-DannyGlass

[Rix]

Dammm :|, I'm glad i don't use it :/

Hope google fix this ASAP (Y)

[SkyyPunk Veteran]

wheres the proof? show me the proof :p someone screenshot a name other than their own :)