Google fixes flaw that could unmask YouTube users' email addresses

Google has fixed two vulnerabilities that, when chained together, could expose the email addresses of YouTube accounts, causing a massive privacy breach for those using the site anonymously. The flaws were discovered by security researchers Brutecat (brutecat.com) and Nathan (schizo.org), who found that YouTube and Pixel Recorder APIs could be used to obtain user's Google Gaia IDs and convert them into their email addresses. The ability to convert a YouTube channel into an owner's email address is a significant privacy risk to content creators, whistleblowers, and activists relying on being anonymous online. The first part of the attack chain, which was exploitable for months, was discovered after BruteCat looked through Google's Internal People API and found that Google's network-wide "blocking" feature required an obfuscated Gaia ID and a display name. A Gaia ID is a unique internal identifier Google uses to manage accounts across its network of sites. As users register for a single "Google Account" that is used across all of Google's sites, this ID is the same throughout Gmail, YouTube, Google Drive, and other Google services. However, this ID is not meant to be public and is for internal use to share data between Google's systems. Playing around with the blocking feature on YouTube, BruteCat discovered that when attempting to block someone in a live chat, YouTube exposes the targeted person's obfuscated Gaia ID in a response from the /youtube/v1/live_chat/get_item_contex...