Correct.
It’s clearly a not great bug, but historically (by design) you could get more information via CSS. The only increase is trackability is extracting the google id because I guess google includes that in the db name??
It’s clearly a not great bug, but historically (by design) you could get more information via CSS. The only increase is trackability is extracting the google id because I guess google includes that in the db name??
As I understand it:
According to the source, Google inserts unique user ID is into database name. An attacker can make a request to Google, pass in this unique user ID into their API and get profile details, for example a photo back.
The attacker does not need access to the database data, only the database name, since the user ID is embedded in the _name_.
You are right it's a leak of a database name, but Google store sensitive data in the database name.
* Finding your browsing history: historically this was just as trivial as the DB name leak
* Finding the google ID: this is the bigger issue and provides a very concrete way of tracking a specific user.
I was trying (admittedly terribly) to say the browsing history is not the worst bug in the grand history of the web, although it is very clearly bad.
The bigger issue is the google tracking ID being leaked to third parties.
[edit: I incorrectly claimed there was a google id when you weren't using a google account, forgetting of course that YouTube is part of google. herp derp. I work in tech and use to work on a browser engine]