bugtraq - Re: Anonymous Surfing Via Gmail Login Window

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 26 Aug 2004 19:32:12 +0200
From: Markus Ackermann <maol@...link.ch>
To: bugtraq@...urityfocus.com
Cc: Punabi MC <punj4b1_mc@...oo.com>
Subject: Re: Anonymous Surfing Via Gmail Login Window - Poor Sanitization


Am Mittwoch, 25. August 2004 15.14 schrieb Punabi MC:
> Anonymous Surfing Via Gmail Login Window - Poor
> Sanitization
>
> User can do anonymous surfing (apart form other cool
> tricks) from Gmail login window. The window is small,
> still checking your mails via google is phun. :)

No way this is anonymous. The webserver still logs your IP, Referrer, Browser, 
etc... just see the two following lines from my access_log:
80.218.86.137 - - [26/Aug/2004:17:24:43 +0000] "GET / HTTP/1.1" 200 5221 
"http://www.google.ch/search?hl=de&ie=UTF-8&q=maol.ch&btnG=Google-Suche&m
eta=" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.6) Gecko/20040114"                                                                          
80.218.86.137 - - [26/Aug/2004:17:24:43 +0000] "GET /onebox.css HTTP/1.1" 200 
2303 "http://www.maol.ch/" "Mozilla/5.0 (X11; U; Linux x86_64; en-US
; rv:1.6) Gecko/20040114"

Markus Ackermann.

PS: the trick requires a GMail authorized browser: 
https://gmail.google.com/gmail/browser_requirements.html
-- 
Symlink - News für die Welt http://symlink.ch/
maol symbolisch http://maol.ch/