Gmail just logged me in as someone else | Hacker News Reader

Gmail just logged me in as someone else

joshualyman.com

77 pointsljoshua39 comments

I wasn't exactly sure who would look into this, but I started the ball rolling internally and asked if someone could investigate.

The post has been updated: "UPDATE: After doing extensive checking with extended family, this has proven to be legitimate (though very unexpected). Please ignore the post and move along, Gmail is still secure for now! My sincere apologies for raising an alarm."

So, back to your regular Christmas Eve activities.

Fantastic, Matt, really appreciate it! Hopefully we can fix it.

We occasionally get something like this reported to us against Chrome (people assume the browser is doing something fishy). So far it's always turned out that someone else simply logged in to check their email without the primary computer owner's knowledge. So, the first thing I'd suggest checking is if anyone else may have used the computer, or perhaps let a visiting friend use it. It's the holidays after all, and most people have a lot more traffic around the house than usual.

This isn't to say there couldn't be a bug in the session handling, just that my repeated experience has shown the human element to be far more likely.

I actually think that it is more fantastic for them that you have brought this to their attention then it is for you. Hard to believe that this is so random that it has only happened to you.

I saw it happen once in the early days of gmail. I assumed it was an early bug that got weeded out quickly

Hey it's Matt Cutts - I didn't realize you were on HN. Keep up the great work on your SEO Videos :)

You may want to cancel that ball...

Since my comment is awaiting moderation there, and there are no other comments so I suspect he's withholding all of them, I'll also post my comment here.

This seems to me as a session collision. You looked at the cookie, so you know something about how these things work, but just to be sure I'm going to explain it in basic terms. Keep in mind that this is just my theory, I'm not not affiliated with Google and have never experienced this myself.

When you log in, on pretty much any website, it generates a session. This session must be unpredictable so that others can't guess what your session is, so there is some random generator involved. An example session could be 7583 (in practice it will be a much larger number, usually with letters or even special characters involved).

When someone else logs in, they will also have a session generated for them. If the random generator happens to pick the same number, it might overwrite your session. If you then open the tab (and your browser remembers the session to keep you logged in), you will appear to be logged in as someone else.

This should never happen. The server should check whether the generated number is already in use. However, the odds of this are incredibly low. With 64-bit sessions, the odds of having two people have the same session is 1 in approximately 18446744073709551616. Even with a billion users logging in, substract 9 decimal positions from that and it's still one in eighteen billion. But it might just happen.

With the millions of users that Gmail has, it might take a lot of resources to check if the session exists somewhere in the world. Or perhaps your session had expired and has been removed, and then someone else logged in and got the session that you were previously assigned. Your browser, not knowing that its session cookie had expired, simply used it.

The odds of this are just so incredibly low, it's very surprising that it happened - if this is what happened. It would perfectly fit your explanation though. Looking at Gmail's cookie, I can't really figure out how many bits of randomness they use. The length is 194 bytes when base64-decoding it, so that would be 1.58*(10^467) possibilities. But I think they simply store some more data there, not just your session.

Hmm, writing this down and looking at the numbers, it's actually more likely that something else messed up, especially considering the complexity of Google's network. Anyhow, a very interesting bug.

"With 64-bit sessions, the odds of having two people have the same session is 1 in approximately 18446744073709551616."

Please read about the Birthday Paradox: http://en.wikipedia.org/wiki/Birthday_Paradox . The probably of a random collision in 64 bits is 1 in 2^32, not 1 in 264.

Right, my bad!

"The odds of this are just so incredibly low... It would perfectly fit your explanation though."

Sounds like someone used Maximum Likelihood instead of Maximum A Posteriori.

On the other hand, you have Bayesian probability: even if it looks 99% like Aliens have landed in front yard, you would still be validly assuming it's your neighbors with flashlights.

http://en.wikipedia.org/wiki/Bayesian_probability

Put simply, you multiply the "a posteriori probability" (i.e. how much it "looks" like it happened) by the original probability (how likely it is to happen).

Could you dumb it down? :) What means "maximum a posteriori" and how does it differ from maximum likelihood?

It means you tried to find the cause that makes the effect most likely, rather than the most likely cause given the effect.

The two are only equivalent if what you know a priori is that all causes are equally likely. In this case they aren't, so a MAP estimate would still give a very low probability to an actual collision, whereas ML doesn't care about the probability of a collision itself -- merely the probability of what it causes. :)

Sites normally employ various mechanisms to prevent session fixation attacks[1] and similar malice. These mechanisms prevent session collisions as a side-effect, thus your scenario seems rather unlikely.

[1] http://en.wikipedia.org/wiki/Session_fixation

There are lots of possible causes for this. Collision/leak in Chrome Sync, for example. Nobody knows yet.

The cookie probably contains routing info so your request goes to the data center where that session exists.

For the uninformed, if something like this happened, what information should we save? You mentioned saving:

* a screenshot

* "network information" (what does that include?)

* cookie information - I assume you just saved the cookie, itself, but which did you save? Everything in your cookies directory at the time?

* ...?

I opened up the Chrome Web Inspector, switched to the Network tab and verified that a couple of requests had indeed gone through, right clicked, and chose "Save all as HAR." That's how I saved the data specifics like cookies.

UPDATE: After doing extensive checking with extended family, this has proven to be legitimate (though very unexpected). Please ignore the post and move along, Gmail is still secure for now! My sincere apologies for raising an alarm.

(Emailed PG to ask the post be removed, no need for it to stay up.)

Well, that is good to know! Hopefully you are updating the site.

Can you provide any more detail on how it happened? Did a cousin's friend come over or something? Perhaps there are lessons for others to learn from this regarding securing your computer for guest use (ie I wonder if Sarah had access to your mail temporarily).

Scary. It is quite honorable for you not to violate that person's privacy. As a physician, this is of the utmost importance for our patients and it is nice to see honest people out there.

I agree. It is a quick reminder that if another person would have had access to it, that it could have been quite different. Potentially malicious.

Maybe your roommate/friend had a girl over last night who used your computer to check her email?

Nope, just my wife and I, and she doesn't know the individual.

this is the most likely explanation. That, of course, doesn't make it the explanation, because unlikely things happen all the time (just ask the White Queen)

I wonder if your ISP has a very broken proxy?

(should be irrelevant due to HTTPS, but still)

What about the SSL certificate? Did you save a copy?

Darn, didn't think to do that, I should have.

> a networking-based error that occurred somewhere along the way, where traffic destined for me/her was switched somewhere along the lines

SSL prevents this from happening, right? If you mean that a system responsible for returning a gmail session cookie got your traffic mixed up, seems like that would have to happen at the application-layer rather than networking.

SSL simply encrypts the connection between your browser and the server. There is no telling what happens inside Google's datacenters.

For example, if you try to reach any Google IP, it will route to the nearest datacenter regardless of where you are in the world. If the datacenter doesn't have the data that it needs to respond to your request, it internally requests the data. It might have messed up there. We can't tell.

Something very similar happened to me four or five years ago. I had just sat down at my laptop and opened the browser. Imagine my surprise when it correctly navigated to iGoogle, but under someone else's account. I looked around just enough to verify that I was locked into a session and then took some screenshots, wrote a detailed explanation of the past five minutes, and sent them along to Google. Never heard back.

The zip code in the iGoogle page weather widget suggested it was someone that lived in my general area, but I didn't recognize the name. This wasn't a shared laptop. I believe this also predated SSL-on-by-default so I guess it is possible traffic got mixed up somewhere.

Something very similar happened to me as well.

That Sarah has only about 1 email per day in her inbox. That's ~100x less than I have.

lol, I just was informed that someone in Corpus Christi US tried to access my account.

This is why I always use two-factor authentication with my google account

If you have an open session i don't think that would make a difference.

I would really love to know the reason how this could have happened

mailto:security@google.com

Reply on news.ycombinator.com