Yahoo Groups (Cache)-Spying

Printable View

December 3rd, 2003, 06:47 PM
Info Tech Geek

Yahoo Groups (Cache)-Spying

I have just experienced something by accident. I was looking for some information and came up with an e-mail from one individual to another on google. Clicked on it and it would not let me in, so I used the cached option and noticed it was e-mail. It had the header, to and from, the e-mail, and signature. So, I tried something else. I went back to google and typed groups.yahoo.com/group/USERNAME/ and was able to cache more e-mails from this user. Do you believe maybe this is just a glitch or is this a privacy volunerability?
December 3rd, 2003, 06:54 PM
Info Tech Geek

Example

I used the oldest one I could find, I also didn't want to post someones private e-mail, so I avoided that. I have viewed e-mails, private postings, and their profiles. This is all by being clever with the keywords and using google cache.
December 3rd, 2003, 07:14 PM
MrLinus

The problem is who is at fault: Google for having the cache or Yahoo for allowing it. I have seen some sites which won't allow cache options. I'd forward it to both Google and Yahoo and see who responds to it first. :D
December 3rd, 2003, 07:17 PM
Info Tech Geek

I originally sent the information to Yahoo Groups, but I have also forwarded the e-mail to Google after your suggestion. It seems there is more to this than I expected. I have been digging around and there is more stuff visable to the naked eye. I will be bringing this topic up at my 2600 meeting this Friday. I think if cache is going to stay and companies are aware at what is being cached we are going to have a lot of cache-spying going on.
December 3rd, 2003, 09:42 PM
moxnix

When I used your search criteria on a group I belong to, in Yahoo groups, it took me to the main page of the group....on yahoo. After actually going to the same group page, the normal way, I can say that the page is/was definately the current and up to date page. Plus it wasn't a cashed page.
I had to sign out of yahoo completely and then went back into this group from google, and it treated me just like a normal visitor to the site.
Except for the harvesting of email addies, which can be done much easier ways, I don't see any problem with google listing the site.
December 3rd, 2003, 09:57 PM
Info Tech Geek

I'm not posting the other information I gathered. I was able to gather full e-mail with header, plain text, and e-mail addy's. I was just using this as an example.
December 3rd, 2003, 10:34 PM
moxnix

Quote:

Originally posted here by Info Tech Geek
I'm not posting the other information I gathered. I was able to gather full e-mail with header, plain text, and e-mail addy's. I was just using this as an example.

And I agreen you shouldn't, but I was just pointing out that the group I checked it on was not a cashed copy, but the original.
Question? Are the 'e-mails' you are referring to the message board posts? They have full headers on them, and have the look and feel of a regular e-mail. Or are they e-mails of the person running the site? Just curious.
December 4th, 2003, 12:42 AM
Info Tech Geek

From garnadi@k... Mon Nov 06 20:17:35 2000
Return-Path: <garnadi@k...>
X-Sender: garnadi@k...
X-Apparently-To: [email protected]
Received: (EGP: mail-6_2_1); 7 Nov 2000 04:17:35 -0000
Received: (qmail 97864 invoked from network); 7 Nov 2000 04:16:43 -0000
Received: from unknown (10.1.10.26) by m8.onelist.org with QMQP; 7 Nov 2000 04:16:43 -0000
Received: from unknown (HELO kpeimain.kpei.co.id) (202.155.72.167) by mta1 with SMTP; 7 Nov 2000 04:16:43 -0000
Received: by KPEIMAIN with Internet Mail Service (5.5.2650.21) id <4PKLCFXJ>; Tue, 7 Nov 2000 11:19:26 +0700
Message-ID: <B3FC43761178D411968B00306E00F3230866F0@K...>
To: "'[email protected]'" <[email protected]>
Subject: RE: [gaul93]
Date: Tue, 7 Nov 2000 11:19:25 +0700
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2650.21)
Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C04871.E9DA6122"
From: Garnadi <garnadi@k...>

------_=_NextPart_001_01C04871.E9DA6122
Content-Type: text/plain;
charset="iso-8859-1"

Yu, gue coba call pake dialpad ya.
Malam yah di sana ?--garnadi

-----Original Message-----
From: Wahyu Hanito [mailto:hanitow@y...]
Subject: Re: [gaul93]

Loh...kan udah gue kasih tahu dulu.
Ok, ini lengkapnya :

(860) 568-5959
35 Ginger Lane
Apt-234
East Hartford, CT 06118

------_=_NextPart_001_01C04871.E9DA6122
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; charset=3Diso-8859-=
1">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version 5.5.2650.12"=
>
<TITLE>RE: [gaul93] </TITLE>
</HEAD>
<BODY>

Yu, gue coba call pake dialpad ya.
 Malam yah di sana ?--garnadi

<UL><UL>
<A NAME=3D"_MailData">-----Original Messag=
e-----</A>
 From: Wahyu Hanito [<A HRE=
F=3D"mailto:hanitow@y...">mailto:hanitow@y...</A>]
 Subject:=
 Re: [gaul93] 


Loh...kan udah gue kasih tahu dulu.
 Ok, ini lengkapnya :


(860) 568-5959
 35 Ginger Lane 
 Apt-234
 East Hartford, CT 06118
 

</UL></UL>
</BODY>
</HTML>
------_=_NextPart_001_01C04871.E9DA6122--
December 4th, 2003, 04:09 AM
Tim_axe

I can get that also. But it isn't their private e-mail. That is a public group posting. Like a post to the message board. The way Yahoo! Groups work is that with your Yahoo! profile and e-mail address you sign-in. The message board posting thing simply uses your Yahoo! e-mail account that goes with your profile and sends it to the e-mail address reserved for the group. So you are seeing the e-mail, but it is a public e-mail to the group's e-mail address (notice how the to: e-mail address is the same as the group name) and is supposed to be displayed like that.

So to sum it up this is the way it is supposed to work. It isn't something that is very obvious though; I don't know too many people who use Yahoo! groups very often except on some specialized topics.