That link, “Stats for nerds” is also a great little tool for seeing what tabs and extensions have been using as far as memory is concerned.  A great development tool for those wishing to create extensions for chrome and writing optimized javascript and HTML5.  I also love the nerdy Bug message at the top, and issue 25454.

Google Fail

So I live in College Park, Maryland; which is directly on the North Western side of the infamous Beltway…and let me tell you: traffic is a bitch right outside of DC.

For those of you unfamiliar with the DC area, there is a single, unifying highway that loops completely around the metropolitan area of Washington and it is absolutely plagued (daily) with traffic.  It is, with out a doubt, one of the most traffic-prone highways in the country, and it can take up to an hour and a half just to travel 15 miles to my hometown of Rockville, Maryland.

Anyways, if duty, family or friends call and I need to head back west towards Rockville, I have taken it upon myself to check Google Maps for the traffic.  Google recently started collecting location data from people who use smartphones and have Google Maps installed.  When this geo-location data is cross referenced with location change over time gives Google the unique opportunity to display live traffic on their maps…or so they say.

Whats that you say? That sounds awesome! Well it would be, if the damn data was correct.

Tonight I took a short trip back to the Rockville area for a meeting that was scheduled to begin at around 7:30pm.  I figured, given no traffic, I would be able to venture home in about 30min MAX.  So I open up my browser and head over to maps.google.com, only to discover at about 7:00pm (optimal time for departure from College Park under ideal circumstances) that the entire route back is shaded in red.  Red = slow (or sometimes danger or stop…but this is irrelevant to this discussion).

Since according to Google Maps the traffic was bad and I had no time to waste, I decided to head out west anyway. And guess what? NO TRAFFIC.

I was in a green situation, not a red catastrophe like I was expecting.  After about 5 minutes on the highway, traversing many more miles than Google Maps predicted, I checked Google Maps on my Palm Pre.  Still red! Even in the area I was currently in.

So no, Google Maps can’t possibly have “live” traffic reporting.  I even restarted my phone just to see if it was a caching problem…but no, Google was just flat out wrong.

Google, take off the “live traffic” label on your maps.  I really rely on that to planning my schedule in a hectic traffic are of the country. Could you (Google) or anyone else provide a legitimate excuse for a misrepresentation like this? I can’t see one…and I am part of the Google Generation.  My contemporaries, at the very least, need to feel like they can rely on Google…and usually they deliver.  But no on this one.

I’d really like more in depth idea of how Google’s Live Traffic feature truly works, or the “Live” aspect of the system needs to be revised or removed. Gracias.

</end rant>

So I believe I have found a security hole in Google’s login systems, and why they need to unlink usernames with YouTube accounts, or they need to at least address this issue.  I’ll be brief.

Say you have a Google Account.  Say your other friend has a Google Account.  These two accounts are independent of each other, as in they have different User Names and Passwords.  Now, say that one of you, lets say here that its you, who creates a YouTube account to share with me.

This is a very common circumstance.  I have about 3 different accounts in YouTube that I share with other people, it makes it convenient to maintain the account, especially if its a busy one.

So here is the security hole: if I log into this ‘Shared” YouTube account, all I need to do is head on over to Gmail and waalaa! I’m now in your Gmail.  I have full access, and I can poke around all you want, without you knowing except for that little IP log at the bottom of the Gmail window.  I could do some real damage  and snooping.

This is a serious issue, please unlink the accounts.  Email is rarely shared, YouTube accounts are.

UPDATE: This is the response from Google about this issue.  Apparently these accounts were linked, and this is just the nature of the Google Accounts system.  I agree with the security team, there is no large risk, but this is still a problem in my opinion.

From Google:

Thank you for the clarification, and for helping me figure out the
nature of the problem.

As you noted, the user in fact disclosed his Google account password
to you, along with an “alias” on YouTube. This alias serves simply as
a nickname for his canonical account with Google, and the password
could be readily used to access services such as Google Mail or Google
Docs without the need to rely on YouTube at all.

Although the fact you gained access to all Google services by logging
in via YouTube with this alias may sound somewhat counterituitive to
people less accustomed to a variety of Google services, I believe
there is no security risk. As noted, you could have used the same
password, and his canonical account name, to simply log in at:

https://www.google.com/accounts/Login

…to gain access to the same services. Canonical account names are
not a secret, and could be easily discovered, e.g. through the YouTube
UI itself.

Now, it goes without saying that sharing your password with other
parties is usually not a good idea, for a number of reasons; if this
can’t be avoided, we would recommend creating a separate Google
account for this purpose.

My Short Rebuttal:

Absolutely Sir, I will add to my blog post now.  I have to say though, that it would not be a bad idea to give Google Account’s access permissions.  This would also prevent something confusing like this from happening.  The basic fact is, while your correct there is no large security risk, this user (my friend) had no intention, nor any indication (according to him) that he was allowing me to access his Gmail without his explicit consent.  Just something to consider…

I would like to praise Google right now, for their quick response time, and detail centered approach.  This encounter with them was exciting in its short life span.  Onward…