Leaking the email of any YouTube user for $10,000

Re:Leaking the email of any YouTube user for $10,000 by brookst on Wednesday February 12, 2025 @08:56AM (#43025442)

But then what? Given the number of accounts Google has, odds are that nearly every alphanumeric combo less than 8 or 10 characters plus “@gmail.com” is a google account. This vulnerability gets you other domains, but still not seeing it. Massive databases of email addresses are a dime a dozen.

The only angle I can imagine is phishing for high profile creators, and at most this is a “makes it easier” and not a “creates the problem” bug.

[ Parent | on HN ]

Re:Leaking the email of any YouTube user for $10,000 by ineedasername on Wednesday February 12, 2025 @10:17AM (#43026194)

You could target accounts of users likely to be younger & more susceptible to phishing for passwords-- kids subscribed to channels with younger content. Or other interest-based targeting. It's not quite spear phishing, but still more targeted.

[ Parent | on HN ]

Re:Leaking the email of any YouTube user for $10,000 by refulgentis on Wednesday February 12, 2025 @09:06AM (#43025535)

The back of an envelope can get you making silly claims quickly (ex. 26 ^ 8 is 208 billion)

[ Parent | on HN ]

Re:Leaking the email of any YouTube user for $10,000 by cirego on Wednesday February 12, 2025 @09:11AM (#43025588)

I think you might be off by a factor of 10. Alphanumeric would be at least 36 characters, which would imply 2.8 trillion combininations (36 ^ 8).

[ Parent | on HN ]

Re:Leaking the email of any YouTube user for $10,000 by refulgentis on Wednesday February 12, 2025 @10:08AM (#43026116)

yeah, I was doing the charitable as possible version

[ Parent | on HN ]

Re:Leaking the email of any YouTube user for $10,000 by brookst on Thursday February 13, 2025 @09:00AM (#43035888)

Not seeing the problem. Are you assuming that somehow there is at most one Gmail account per person on earth?

I have… I’m not sure. Ten maybe? And those are actual conveniences for different purposes. I’m sure plenty of people have hundreds, if not thousands. So what?

[ Parent | on HN ]

Re:Leaking the email of any YouTube user for $10,000 by refulgentis on Thursday February 13, 2025 @08:05PM (#43043475)

I'm a bit confused:

- I charitably went with 208 billion, 25 for every single individual on this planet.

- As the other replies note, I chose a misleading number that is too generous by 3 orders of magnitude.

- You can't see the problem

Something seems off.

[ Parent | on HN ]