Hacker News Reader

Comment by hedora | Hacker News Reader

> Additionally, Google’s account recovery tools indicate many different developer email addresses tied to extensions reviewed here share the same recovery email

What?!? This work was done by an independent researcher. Why is google providing account recovery emails to the general public (and therefore attackers)?!?

Edit: fixed typo; replaced “recovery passwords” with “recovery emails”

View on HN

Often, account recovery reveals something about where the email will be sent but with some characters in the email redacted. Maybe that’s what’s happening here?

You are correct. Using the "forgot your password" function on Gmail often reveals snippets of the email account used for recovery and authentication of that account.

> Why is google providing account recovery passwords to the general public

It doesn't refer to passwords but email addresses.

And Google doesn't have to provide them even the actual address for them to determine that they are identical, they just need to provide something that maps 1:1 with the email, without the mapping.

The actual email addresses are in screenshots in the article.

It looks like spreadsheet has the developer’s public email, not their recovery email.

Those are the developer emails, not the account recovery emails that it says are shared between different developer emails.

Developer emails for extensions are public normally, so those being revealed aren't an issue.

Reply on news.ycombinator.com