Google Fail

So I live in College Park, Maryland; which is directly on the North Western side of the infamous Beltway…and let me tell you: traffic is a bitch right outside of DC.

For those of you unfamiliar with the DC area, there is a single, unifying highway that loops completely around the metropolitan area of Washington and it is absolutely plagued (daily) with traffic.  It is, with out a doubt, one of the most traffic-prone highways in the country, and it can take up to an hour and a half just to travel 15 miles to my hometown of Rockville, Maryland.

Anyways, if duty, family or friends call and I need to head back west towards Rockville, I have taken it upon myself to check Google Maps for the traffic.  Google recently started collecting location data from people who use smartphones and have Google Maps installed.  When this geo-location data is cross referenced with location change over time gives Google the unique opportunity to display live traffic on their maps…or so they say.

Whats that you say? That sounds awesome! Well it would be, if the damn data was correct.

Tonight I took a short trip back to the Rockville area for a meeting that was scheduled to begin at around 7:30pm.  I figured, given no traffic, I would be able to venture home in about 30min MAX.  So I open up my browser and head over to maps.google.com, only to discover at about 7:00pm (optimal time for departure from College Park under ideal circumstances) that the entire route back is shaded in red.  Red = slow (or sometimes danger or stop…but this is irrelevant to this discussion).

Since according to Google Maps the traffic was bad and I had no time to waste, I decided to head out west anyway. And guess what? NO TRAFFIC.

I was in a green situation, not a red catastrophe like I was expecting.  After about 5 minutes on the highway, traversing many more miles than Google Maps predicted, I checked Google Maps on my Palm Pre.  Still red! Even in the area I was currently in.

So no, Google Maps can’t possibly have “live” traffic reporting.  I even restarted my phone just to see if it was a caching problem…but no, Google was just flat out wrong.

Google, take off the “live traffic” label on your maps.  I really rely on that to planning my schedule in a hectic traffic are of the country. Could you (Google) or anyone else provide a legitimate excuse for a misrepresentation like this? I can’t see one…and I am part of the Google Generation.  My contemporaries, at the very least, need to feel like they can rely on Google…and usually they deliver.  But no on this one.

I’d really like more in depth idea of how Google’s Live Traffic feature truly works, or the “Live” aspect of the system needs to be revised or removed. Gracias.

</end rant>

So I believe I have found a security hole in Google’s login systems, and why they need to unlink usernames with YouTube accounts, or they need to at least address this issue.  I’ll be brief.

Say you have a Google Account.  Say your other friend has a Google Account.  These two accounts are independent of each other, as in they have different User Names and Passwords.  Now, say that one of you, lets say here that its you, who creates a YouTube account to share with me.

This is a very common circumstance.  I have about 3 different accounts in YouTube that I share with other people, it makes it convenient to maintain the account, especially if its a busy one.

So here is the security hole: if I log into this ‘Shared” YouTube account, all I need to do is head on over to Gmail and waalaa! I’m now in your Gmail.  I have full access, and I can poke around all you want, without you knowing except for that little IP log at the bottom of the Gmail window.  I could do some real damage  and snooping.

This is a serious issue, please unlink the accounts.  Email is rarely shared, YouTube accounts are.

UPDATE: This is the response from Google about this issue.  Apparently these accounts were linked, and this is just the nature of the Google Accounts system.  I agree with the security team, there is no large risk, but this is still a problem in my opinion.

From Google:

Thank you for the clarification, and for helping me figure out the
nature of the problem.

As you noted, the user in fact disclosed his Google account password
to you, along with an “alias” on YouTube. This alias serves simply as
a nickname for his canonical account with Google, and the password
could be readily used to access services such as Google Mail or Google
Docs without the need to rely on YouTube at all.

Although the fact you gained access to all Google services by logging
in via YouTube with this alias may sound somewhat counterituitive to
people less accustomed to a variety of Google services, I believe
there is no security risk. As noted, you could have used the same
password, and his canonical account name, to simply log in at:

https://www.google.com/accounts/Login

…to gain access to the same services. Canonical account names are
not a secret, and could be easily discovered, e.g. through the YouTube
UI itself.

Now, it goes without saying that sharing your password with other
parties is usually not a good idea, for a number of reasons; if this
can’t be avoided, we would recommend creating a separate Google
account for this purpose.

My Short Rebuttal:

Absolutely Sir, I will add to my blog post now.  I have to say though, that it would not be a bad idea to give Google Account’s access permissions.  This would also prevent something confusing like this from happening.  The basic fact is, while your correct there is no large security risk, this user (my friend) had no intention, nor any indication (according to him) that he was allowing me to access his Gmail without his explicit consent.  Just something to consider…

I would like to praise Google right now, for their quick response time, and detail centered approach.  This encounter with them was exciting in its short life span.  Onward…

Hey All!

Welcome to my new blog.  It hasn’t changed that much but at least I’m finally heading in some direction with it.  I thought for my first new post I would write about the plugins I’m using this time around.

• Contact Form 7 – This plugin is amazing.  Really simple to use AJAX form, that even has a form generator in the admin section for a truly customizable experience.  It even has a built in option for a CAPCHA area, to prevent spam. (However you have to download this as a seperate plugin to use the functionality.)
• Flickr Gallery – Really simple to use Flickr implementation plugin that allows you to important your Flickr photostream in a variety of customizable ways.  Currently I have mine set to display the most recent uploads.
• Twitter Updater – Automatically sends a tweet to my twitter profile to let my followers know I just posted a new blog post.
• All in one SEO Pack- Everyone should know about this one already.
• Google SiteMaps XML – Again, a great SEO tool which everyone already knows about.
• Ozh’ Admin Drop Down Menu – Now this plugin is incredibly helpful.  It makes all admin section navigation in drop down menu format with CSS.  I couldn’t stand having to click through the various higher-level nav to get to the lower-level admin pages.  This saved me about 15 minutes of clicking time.
• Sociable – Easy integration of social networking and bookmark services. (Which is below this post…tweet me please!)

I’m also using various other plugins, but they are technical and/or aren’t important enough to talk about here.  Anyways, enjoy the new blog look and feel.  Hopefully now that I have a more presentable blog, I will write more.

Evan

With the release of the new Palm Pre, Apple, Andriod supported phones, and no name brands are still in awe of just how Palm released this thing with not only no leaks, but also wow’ed us all with some “new-ness” as they Palm calls it.

While the keynote for the introduction of this phone was quite impressive, it left a lot of open ended questions.  Here is what I, and you all, are wondering.

How well does Javascript apps hold up?

In comparison to the iPhone, the palm pre will have all of its apps built with HTML, CSS, and Javascript.  But how can javascript be so powerful?  If we look at the iPhone, it is built with Objective-C programming.  Not an easy language to develop for, but still very powerful and reliable since it is all compiled code.  Scripting languages are notorious for being slow with Object Oriented programming, but looking at the Palm keynote, it seemed that all their apps ran smoothly, and in some cases, smoother than the iPhone.

As it has been said, the Pre does not support gaming.  Maybe in the future, but JS just doesn’t  hold up well for intensive games like the iPhone.  So that poses the question what about apps that are as intensive as games?

Is there a screening process for apps?

While it is definitely harder to develop apps for the iPhone than what it looks like for the Pre, the Pre’s app development with HTML CSS and JS should cause an explosion of apps to be developed for the phone.  But that is actually a BAD thing.  Apple’s process of screening apps, while it is usually something of annoyance, is good for quality control.  This explosion of apps that comes from large amounts of developer’s, we need to have some kind of system in place to monitor the apps.  Palm has not announced anything about this yet.

Flash?

Ok, this one I am really really waiting to hear about.  Will there be Flash support in the webkit browser?  If Palm incorporates Flash they will have a significant lead over the other smart phones.  Given that Palm said there is a processor in that little thing that can power a laptop, I would assume that Flash Lite is a possibility.

Price Point, Sub-$200?

While the Palm Pre looks like a must have for most enthusiasts, the question must be asked what is the price point of the phone?  It needs to be under $200 in order for the average consumer to even think about it.  So far, I have read prices in the 300 and 400 dollar range, and that is just no-good.  Palm, in order to win, you must take a hit on the price.

Missing Partnerships with Google and Yahoo?

The one thing about the iPhone that I loved, was that it included very nice apps from both google and yahoo.  Palm has not shared any information with us about having Google or Yahoo apps pre-built in.  Now I understand what your thinking, who care as long as they have OEM apps that work.  Well, its about marketing my friend.  If Google or Yahoo advertise that they have their apps built FOR and ON the Pre, it will be instant press and credibility on the integrity of the phone.