Gmail Information Disclosure

This isn’t a matter of Google snooping on your email. I fully understand that privacy and free web apps don’t really go hand in hand that well. This is a matter of core functionality. Is Google able to deliver? Like literally deliver? I don’t think so.

Here is the first problem I noticed:

Since this isn’t my email address, I’ve censored the name to protect the innocent. To make it easier to talk about, let’s call this email address HMK, as those are the letters I’ve left uncensored. I got this screen capture just a few minutes ago from an email I was sent, as you can see, a year ago. I’ve got more of this type, oh yes. I have an order confirmation for this very grill. But the problem is: I don’t own this email address.

I did not hack into HMK. I didn’t guess the password. In fact, this email is sitting in the inbox of the email address named thefreehunter, which is also running on Google. So how did I get it? Well, this email was sent to HMK. I happen to own the email address HMKF, which is all of the words of HMK with the addition of an F on the end. I guess it’s easy enough to mistype, but HMK (the person) didn’t mistype it. It was legitimately sent to them. Let’s take a look.

Here is the raw email as it was sent. You can see at the top that this was delivered to thefreehunter (me). It was forwarded to, oddly enough, another nameless email account I own. And you can see, it was forwarded from HMK. Again, I don’t own the email address HMK. I own HMKF, which is not shown here because the email never showed up in HMKF’s inbox.

Now to add more to the story, HMKF’s email is being forwarded to thefreehunter, so I only have a single pane of glass (email) to look at. There’s no reason for HMK to be forwarded to me though, as HMK has no reason to even know I exist. It can’t be a mistype, because HMK is not forwarded to HMKF, it’s forwarded to thefreehunter and another email account owned by me that has nothing to do with HMK or HMKF at all. Let me make this clear: the email from HMK is not in the inbox of HMKF. Only in thefreehunter’s inbox.

So we’ve established that HMK email is being forwarded to me for no reason at all. This is obviously a Google problem, I mean it has to be. But it doesn’t stop there. See I was in Mexico recently on vacation with Mrs Freehunter, and we were relaxing on the beach. I checked my email, and I see an order confirmation from Origin, EA’s gaming service. A few months back, I ordered The Sims 4 through Origin for Mrs Freehunter’s pleasure. And while I was in Mexico with my phone but no computer, someone made an order for FIFA 15. Please bear in mind that my EA account is (was) linked to the Google email address thefreehunter.

Here’s the aftermath of that long-distance phone call:

I also reset my password to a random string of characters and took the step of turning on login verification, EA’s fancy words for two-factor authentication:

And that was that. Except it… wasn’t. Sitting at a restaurant, I get an email:

Again, at a restaurant. No where near a computer. I reset the password to another random string of characters again and verified 2FA was still on. And that was that.

Except it fucking wasn’t.

This time, I reset the password, verified 2FA was turned on, and then changed my email address away from Gmail. So far, nothing further has happened from it.

Now here’s the crazy thing: no one stole my credit card number. Except for possibly the first time, no one guessed my Origin password. And for all everyone wants to bash EA, no one hacked Origin (although EA’s security isn’t all that great, when I reset my password the last time I was never prompted for 2FA. All I needed to do was click a link in my email). But no one else logged into my Gmail account. So what happened?

I don’t know. But combine this experience with what I mentioned about HMK’s email, and you can clearly see there is a major information leak going on at Gmail. It’s not impossible that my email is being forwarded in part or even wholesale to someone else, who decided they would help themselves to my accounts.

I would love to talk to someone at Google about this, I really would. Because what happens now is, I stop using Gmail. I stop recommending Gmail. I can’t count on my emails being private between me and Google, I know, but other users shouldn’t have access to my information either!

Don’t use Gmail!