首页 > IT资讯, 技术相关, 评论 > Google Apps的账户漏洞?

Google Apps的账户漏洞?

2010年12月25日 发表评论 阅读评论

Google apps主要是面向企业的应用套件,可以减少企业,尤其是中小企业的运营成本,想要了解google apps的请移步http://www.google.com/apps/.

但我发现google apps丢失域名的话,有可能被别人获取管理员权限并且看到所有成员资料,包括所有Gmail,Doc,Calender,只要是属于google apps的服务,都能看到和更改。

发现过程是这样滴

  1. 前天,我在godaddy注册了新的域名sigma.me,为了让本博客绑到新域名上,我需要把域名加到我原来的google apps上,但是,加入的过程却碰到了如下的错误:This domain name has already been used as an alias or domain.看来,此域名已经被别人用过了。
  2. 于是,我想怎么才能证明我是这域名的新主人呢,于是搜了半天,搜到的结果大部分都是联系google客服,向他们出示域名属于你的证据,从而取回域名,但是这样据说周期会比较长,有可能需要半年。
  3. 我只好放弃了这条路,正在徘徊中,试着打开了对应的apps登陆页:https://www.google.com/a/sigma.me,在登陆下面发现了一个Can’t access your account?,于是尝试着点进去,发现有:If you are a domain administrator for sigma.me,Reset your administrator password
  4. 于是我尝试着点进去reset,但是发现要求提交原来的注册邮箱,这貌似没什么问题,但是惊喜在后面,填完验证码以后,有一段这样的话:

    We have sent instructions on how to reset your password to your domain’s secondary email address, which ends in: gmail.com.

    If you no longer have access to your domain’s secondary email address, there is a second option to reset your password. You can create an HTML file or CNAME record to verify that you own the domain name. Reset your administrator password by domain verification

  5. 原来,假如忘了原来的邮箱,还可以用域名验证来重置管理员密码,这正是我想要的!于是按流程走下去,会要求域名验证和填写一个接受重置密码的邮箱,一切完成后,会告诉你在两个工作日会把结果告诉你。我第二天就收到了重置邮件。

  6. 点进去,发现已经有个管理员登陆账号xxxx,并且Secondary email address已经是我的邮箱了。进入xxxx的inbox,进入发现还有之前的邮件(不过这人很幸运,只留下一封google官方2008年发的邮件),再看成员管理,能看到所有的成员。并且能看到管理员的一些资料,包括真实姓名,以及在GAE上的一些程序和所绑定的域名。其他什么doc也点了下,还好,这人什么也没留下。

我不知道这是否算一个漏洞,但是我总觉得他是非常可怕的。理由如下:

  1. 对于那些用免费域名申请的apps的用户,当你域名被收回后(比如臭名昭著的tk),你的google apps里面的数据不加以销毁的话,域名管理商可以获取你的管理员权限,新注册的用户也可以获取管理员权限并查看你的数据(其实不用收回,就可以通过域名验证来获取管理员权限)。
  2. 对于使用收费域名的用户,也存在同样的问题。这对一些中小企业后果会很严重。因为很多人中小企业选择google apps就是为了减少自己搭建内部邮件,ERP等服务器的成本。现在,你的内部邮件管理员权限将随时可能被域名注册商获取,你续费不及时的话,还会被新注册的用户获取。
  3. 在中国注册的域名,这就更可怕,由于xx监管,以及中国互联网的诚信状况。很可能,在一些势力的要求下,会要求域名注册商提供域名权限给政府,这样这些势力在需要的时候就获取目标用户或企业的管理员权限,并且查看内部邮件等资料。这也是很可怕的,这也许也是google要删除所有.cn注册apps的部分原因。

更深入的,这反映了云计算的一些问题,之前域名虽然是别人提供的,但数据在自己的服务器上,所以可以放心用,很安全。但现在,域名是别人的,数据也是在别人那的,并且要用别人的域名来验证你对数据的访问权,管理权,这就比较危险了(尤其是域名提供商不可靠的情况下)。

也许你会说google可以用其他方法来对权限认证,但貌似对于这类东西,也只能是域名作为最后的所属权的判断标准,毕竟有些人万一真的把自己的Secondary email address的把自己用户或密码忘了。

但愿google apps能够解决这个“漏洞”(假如google认为他是的话),也希望云计算能走的更远。因为我写这篇博客就正享受着google云计算(GAE)带给我的便利。



本文作者: Sigma    在新浪微博关注SigmaSigmaWeibo    RSS订阅本博客
本文链接: http://www.sigma.me/2010/12/25/google-apps-bug.html
本博客采用知识共享署名—非商业性-禁止演绎使用3.0协议进行许可,转载请保留作者和原文链接。

  1. 2011年1月18日06:49 | #1

    注销应该没问题的~

  2. 2011年1月18日06:42 | #2

    有点可怕!注销掉应该没有问题吧!我原来用tk注册过apps,后来域名被收回了。我就果断注销了apps。

  3. 2019年1月14日16:25 | #3

    I intended to write you a little remark just to say thanks a lot as before on the splendid tips you’ve documented on this site. It was simply incredibly open-handed of people like you to provide openly what a lot of folks could possibly have supplied as an e-book to earn some money on their own, specifically since you could possibly have done it in the event you wanted. The advice in addition acted as the fantastic way to fully grasp that the rest have a similar passion just as my very own to see significantly more in terms of this issue. I’m certain there are millions of more pleasant times in the future for individuals who look over your blog.

  4. 2019年1月15日03:11 | #4

    I just wanted to write down a quick comment to be able to say thanks to you for all of the stunning recommendations you are writing on this site. My long internet search has at the end of the day been rewarded with professional facts and strategies to go over with my family and friends. I would claim that many of us readers actually are extremely endowed to dwell in a decent place with so many outstanding individuals with valuable tips and hints. I feel somewhat happy to have come across the webpage and look forward to so many more thrilling moments reading here. Thanks a lot again for everything.

  5. 2019年1月15日08:33 | #5

    I simply wished to say thanks once more. I’m not certain the things that I would’ve created in the absence of the type of opinions contributed by you on such topic. It seemed to be a very traumatic case in my position, nevertheless seeing a expert tactic you treated the issue forced me to cry with fulfillment. Extremely grateful for this service and as well , have high hopes you realize what a powerful job that you are putting in instructing other individuals through the use of your website. I am certain you haven’t encountered any of us.

  6. 2019年1月15日10:48 | #6

    Thank you so much for providing individuals with remarkably remarkable opportunity to read critical reviews from this web site. It is always so useful and jam-packed with a lot of fun for me personally and my office acquaintances to visit your web site at a minimum three times per week to read through the newest secrets you will have. Of course, I’m certainly pleased with your superb secrets you give. Some 1 ideas in this article are clearly the most beneficial I have had.

  7. 2019年1月15日11:18 | #7

    I have to voice my appreciation for your generosity in support of women who actually need guidance on this important concept. Your very own commitment to passing the message all over had become amazingly helpful and have usually empowered people like me to reach their objectives. Your entire informative suggestions entails a whole lot to me and further more to my fellow workers. Many thanks; from everyone of us.

  8. 2019年1月15日20:04 | #8

    I wanted to write you a little observation to give many thanks as before on the breathtaking pointers you have contributed on this page. This has been simply strangely generous of you to make unreservedly all that a lot of folks would have distributed for an e book to help make some profit on their own, chiefly considering that you could have tried it if you considered necessary. The principles also acted as a great way to understand that most people have a similar passion really like my very own to understand significantly more when it comes to this problem. I am sure there are thousands of more enjoyable occasions in the future for people who scan through your website.

  9. 2019年1月16日05:01 | #9

    I’m just writing to make you know what a incredible discovery my wife’s princess obtained reading through your web site. She figured out plenty of pieces, including what it’s like to have a wonderful helping mindset to have men and women really easily gain knowledge of selected advanced matters. You really exceeded our own desires. I appreciate you for providing such practical, dependable, revealing and as well as fun thoughts on your topic to Tanya.

  10. 2019年1月16日12:42 | #10

    Thank you for all your valuable effort on this site. Ellie enjoys conducting investigations and it is obvious why. Most people notice all relating to the compelling form you produce sensible strategies through this blog and as well improve participation from other individuals on the situation so our own daughter is undoubtedly becoming educated a lot. Have fun with the remaining portion of the new year. You’re conducting a fabulous job.

  11. 2019年1月16日23:43 | #11

    I’m commenting to let you be aware of of the incredible encounter my cousin’s child obtained visiting your web site. She figured out a good number of details, which included what it’s like to possess a marvelous coaching mood to make other people with no trouble fully understand certain tortuous subject areas. You truly surpassed our own expectations. I appreciate you for churning out these warm and friendly, healthy, informative and also unique guidance on the topic to Kate.

  12. 2019年1月17日07:52 | #12

    I actually wanted to type a comment so as to thank you for those pleasant tips and tricks you are giving here. My considerable internet research has now been recognized with wonderful know-how to go over with my friends and family. I ‘d declare that most of us website visitors are rather endowed to dwell in a good network with many brilliant people with very helpful tips and hints. I feel rather grateful to have seen the web pages and look forward to so many more brilliant moments reading here. Thanks once again for everything.

  13. 2019年1月17日16:21 | #13

    My wife and i felt delighted Raymond managed to finish up his web research via the ideas he made in your weblog. It’s not at all simplistic to simply happen to be releasing solutions which often some other people might have been selling. And now we realize we need the writer to be grateful to for this. The explanations you made, the simple site menu, the relationships you assist to foster – it’s got all great, and it’s really making our son in addition to the family reason why the matter is fun, which is extraordinarily important. Many thanks for all the pieces!

  14. 2019年1月18日05:24 | #14

    I and my friends happened to be looking at the great thoughts on the blog and then suddenly got a horrible feeling I had not expressed respect to the site owner for them. My boys were consequently happy to read them and have now in truth been having fun with these things. We appreciate you truly being considerably helpful as well as for considering certain exceptional subjects millions of individuals are really needing to know about. My personal honest apologies for not expressing appreciation to earlier.

  15. 2019年1月18日09:40 | #15

    I am only commenting to let you understand of the brilliant discovery our princess encountered viewing your site. She learned such a lot of things, which included how it is like to have a wonderful giving style to get other people effortlessly know precisely specified grueling topics. You actually did more than her expectations. Thanks for offering these helpful, safe, explanatory not to mention cool thoughts on this topic to Julie.

  16. 2019年1月18日17:28 | #16

    A lot of thanks for all your effort on this web page. Gloria really likes working on investigation and it’s easy to see why. Almost all hear all of the compelling manner you offer informative guidance on this web blog and as well attract participation from some other people on that concern plus our favorite princess is without a doubt understanding a whole lot. Take pleasure in the rest of the new year. You are always conducting a wonderful job.

  17. 2019年1月19日03:03 | #17

    Thanks a lot for providing individuals with an extremely spectacular chance to read articles and blog posts from this web site. It can be very pleasant and also stuffed with a lot of fun for me and my office friends to visit the blog at least thrice in a week to study the new guidance you will have. And indeed, I am just always impressed for the perfect creative ideas you serve. Some 3 tips in this article are undeniably the most impressive I’ve ever had.

  18. 2019年1月20日03:46 | #18

    I not to mention my friends were found to be following the best points from your website then before long I got a terrible suspicion I had not expressed respect to the blog owner for them. All the young boys are already for this reason stimulated to see them and now have pretty much been taking advantage of these things. Appreciate your turning out to be considerably thoughtful and also for picking out variety of marvelous tips millions of individuals are really desirous to be aware of. My personal sincere apologies for not expressing appreciation to sooner.

  19. 2019年1月20日10:39 | #19

    Thank you for all of the work on this blog. My mum take interest in doing research and it is simple to grasp why. My spouse and i learn all about the compelling medium you convey very helpful solutions by means of the website and as well as encourage contribution from website visitors on this situation while our daughter is now being taught a lot. Have fun with the rest of the year. You have been carrying out a good job.

  20. 2019年1月20日19:58 | #20

    I precisely wanted to thank you so much again. I do not know the things I would’ve taken care of without the solutions discussed by you relating to this industry. Completely was a real frightening concern in my circumstances, nevertheless finding out the professional mode you processed it forced me to weep for delight. I am just happier for the guidance and in addition sincerely hope you comprehend what a powerful job you’re doing instructing other individuals through the use of a web site. I am certain you’ve never come across all of us.

  21. 2019年1月21日01:06 | #21

    My husband and i got very excited Michael managed to complete his researching with the ideas he came across using your blog. It’s not at all simplistic just to continually be giving out tricks which often most people have been selling. And now we remember we have got you to thank for that. Most of the illustrations you’ve made, the simple site navigation, the friendships you can make it easier to promote – it’s many fabulous, and it is helping our son and us understand this theme is excellent, which is certainly wonderfully essential. Many thanks for everything!

  22. 2019年1月21日04:37 | #22

    I simply wished to appreciate you again. I’m not certain what I could possibly have tried in the absence of those tips and hints shared by you relating to my field. It absolutely was a real hard circumstance in my opinion, nevertheless observing the well-written avenue you resolved the issue took me to jump with joy. I am just grateful for your advice and even hope you realize what an amazing job you are always undertaking educating some other people with the aid of your web blog. I am sure you haven’t come across all of us.

  23. 2019年1月21日11:15 | #23

    Thank you so much for giving everyone an extremely wonderful possiblity to read critical reviews from this site. It is always so sweet and also jam-packed with a lot of fun for me personally and my office fellow workers to search the blog at the very least thrice weekly to find out the new secrets you have. Not to mention, I am actually contented considering the excellent techniques served by you. Some 4 tips on this page are clearly the best we have all ever had.

  24. 2019年1月21日19:08 | #24

    I as well as my guys came looking through the excellent tactics on your web site then suddenly came up with an awful suspicion I had not thanked the website owner for them. All the young boys are already for this reason warmed to study them and have in effect definitely been loving these things. Appreciation for indeed being quite thoughtful and for opting for variety of important resources millions of individuals are really needing to be aware of. My personal honest regret for not expressing appreciation to earlier.

  25. 2019年1月22日05:10 | #25

    My spouse and i have been very delighted when Edward could carry out his web research by way of the ideas he had from your own web site. It is now and again perplexing to simply choose to be making a gift of hints which usually some people might have been making money from. And we also do know we have got you to appreciate for this. Those explanations you have made, the simple website menu, the relationships you can make it possible to foster – it is most extraordinary, and it is helping our son in addition to our family reason why the article is amusing, and that is very indispensable. Thank you for everything!

  26. 2019年1月22日13:18 | #26

    Thanks so much for giving everyone an exceptionally remarkable possiblity to read from this web site. It is often so nice plus full of a good time for me personally and my office colleagues to visit your blog at the very least 3 times in a week to find out the fresh guidance you have got. Of course, I am usually happy considering the outstanding principles you give. Selected two ideas on this page are without a doubt the best we have all had.

  27. 2019年1月22日22:50 | #27

    I simply wanted to thank you very much once more. I’m not certain the things I might have handled without those methods contributed by you relating to this subject. This has been the scary situation in my view, nevertheless witnessing a new specialized avenue you handled the issue took me to jump with joy. I’m just happy for this information and as well , have high hopes you recognize what an amazing job that you’re putting in instructing many others thru your webblog. I am sure you have never come across any of us.

  1. 本文目前尚无任何 trackbacks 和 pingbacks.

无觅相关文章插件,快速提升流量