Its too bad (in a way...) they couldn't get private video IDs to leak. It would have made an impressive combination with their bug posted earlier this month (Stealing Your Private Youtube Videos, One Frame at a Time https://news.ycombinator.com/item?id=25728175)
Speaking of... do security researchers sometimes just sit on their discoveries in hopes that they will eventually lead to a bigger payout? I would be kicking myself if I had reported a bug for a relatively small reward that I could have leveraged in combination with another discovery
Yet another example of why the whole concept of third-party cookies does much more evil than good. Yet all major browsers keep them enabled by default.
This was an extremely serious privacy issue, and it's shocking that they'd only award $1,337 for a bug of this scope.
I honestly feel like Google's award in this case is pathetic. This is an exploit which would be worth 100s of thousands, if not millions to the wrong people.
That’s why I don’t browse the web while logged in google/fb/twitter. As I keep them in separated firefox containers
doesn't google employ the elite of world programming? how can such stuff even happen? honest question.
Companies should stop exploiting developers. Instead of erecting another sky scraper they should start paying the fair share.
My understanding is that the javascript in a web page executes in the client. How can the page owner obtain the video lists?
I can see why Google might want to downplay this. Partner websites could obtain the history info directly from users and Google would not need to disclose the data sharing. I'm sure the watchlists/history would be valuable tools for profiling and advertising purposes.
This is a bad link, not sure how it got upvoted when following it fails (there’s a trailing . after the domain). That’s kinda fishy...
Correct link should be https://bugs.xdavidhu.me/google/2021/01/18/the-embedded-yout...
He lost me at - Forgot to eat Pizza.
EDIT: never mind
Should probably be (2019), as the bug has been fixed since (as noted at the bottom of TFA).
$1,337 for watch history + liked videos + watch later disclosure? Requires user to visit a malicious site, yes, but still feels a bit skimpy.