Google Fixes Flaw That Could Unmask YouTube Users' Email Addresses

An anonymous reader shares a report: Google has fixed two vulnerabilities that, when chained together, could expose the email addresses of YouTube accounts, causing a massive privacy breach for those using the site anonymously.

The flaws were discovered by security researchers Brutecat (brutecat.com) and Nathan (schizo.org), who found that YouTube and Pixel Recorder APIs could be used to obtain user's Google Gaia IDs and convert them into their email addresses. The ability to convert a YouTube channel into an owner's email address is a significant privacy risk to content creators, whistleblowers, and activists relying on being anonymous online.

Flaw?

[aglider]

Or feature for surveillance agencies?

Re:

[Rinnon]

Or feature for surveillance agencies?

If a government can do it, it's a feature, not a flaw. If a criminal can do it, it's a flaw, not a feature. What paradoxical times we live in.

Re:Flaw?

[Errol backfiring]

And by definition, if a government can do it, so can a criminal.

"Privacy risk"

[Anonymous Coward]

The ability to convert a YouTube channel into an owner's email address is a significant privacy risk to content creators, whistleblowers, and activists relying on being anonymous online.

If you're trying to be anonymous, giving your actual email address to a megacorp like google is a terrible idea.