full-disclosure - Google Desktop Search

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <416FE39E.9050409@deaddrop.org>
From: shrdlu at deaddrop.org (Etaoin Shrdlu)
Subject: Google Desktop Search

Dogo wrote:

>Hi everybody!
>
>I decided to test Google Desktop Search 
>

Hope that this was just a test machine. I would have been a bit nervous 
to try this on anything I needed, myself.

>...In the beginning I put my nick to play with, Dogo. The
>research came with a bit more than I expected 'cause the engine  went to some webmail based accounts: Yahoo and MSN. I could click in the results and opened my Yahoo Mail inbox page without a password.
>

Perhaps you have something that says funnel all email to a specific 
account; perhaps you *do* have a "remember my password" set somewhere. 
Lots of perhaps here; you might want to ghost the drive, and do a little 
forensics off line, to see if there are presents left behind.

>Well, I just used for maybe 20 minutes until the index was being prepared. I uninstalled the tool.
>  
>

You *hope* you uninstalled it. Checked the registry? Sounds a bit to me 
like Google is working to be the next Big Blue/Microsoft. Excellent. 
Survival of the fittest.

>Did someone try it? Any opinion? 
>  
>

I'd recommend that someone try a couple of installs on a private 
network, and watch what goes in or out. Sounds interesting, for certain 
values of interesting.

-- 
You've confused equality of opportunity for equality of outcomes,
and have seriously confused justice with equality.
                                -- Woodchuck