ATTN: GMAIL USERS

[Ninja Chicken]

Just an FYI. If its OFN then an admin could kindly Lock/Del the htread.

There is a program called G-Archiver that is shareware and many people have been u
using to archive their gmail.

Apparently this program is malicious in nature and attempts to forward the username/password information of the installer.

Full Story here
[link=hyperlink url]http://www.codinghorror.com/blog/archives/001072.html[/link]

 

[Hidden_Question]

I don't think it was done with malicious entent:

The creator of G-Archiver has pulled the software, stating that it was debug code and was unintentionally left in the product."

 

[Ninja Chicken]

I don't know how he could have done it "unintentionally". In no part of what the product is designed to do, is the requirement to connect to a mail server.
And if there was a reason to connect to a mail server ( eg. submit a message saying that the operation has been completed), there would be absolutely no possible reason to send both the username and password as part of the message.

 

[Hidden_Question]

I think it's because the program needs to log in to gMail to export your mail. I have never used it, but this is my guess based on the program description.

G-Archiver is your one click Gmail backup solution.

Backup Gmail email messages to your computer using G-Archiver.

Never lose another message - backup Gmail messages and you'll have a stored copy on your computer in the event of Gmail data loss incidents.

the program wouldn't be able to download your mail if it didn't log in. Likely, the program debug mode stored the password for this reason. Why the program would "harvest" the username and passwords, is beyond me.

 

[RESPAWN]

[quote1205617551=Hidden_Question]
I think it's because the program needs to log in to gMail to export your mail. I have never used it, but this is my guess based on the program description.

G-Archiver is your one click Gmail backup solution.

Backup Gmail email messages to your computer using G-Archiver.

Never lose another message - backup Gmail messages and you'll have a stored copy on your computer in the event of Gmail data loss incidents.

the program wouldn't be able to download your mail if it didn't log in. Likely, the program debug mode stored the password for this reason. Why the program would "harvest" the username and passwords, is beyond me.
[/quote1205617551]


I'm guessing that it was a simple method that he was using for error checking during testing. Most likely, in the course of testing an non-operability condition he probably had the user IDs and passwords for his test accounts sent to him so that he could verify that G-Archiver did, in fact, have the correct credentials. I've used similar error checking methods before -- usually printing out the information to screen or dropping it in a log file somewhere. As much as people might like to try to sensationalize this problem, there is a legitimate reason for the developer to need to know that information during testing. I would hope that the fact that the code was left in there after release was merely an afterthought and not the result of malicious intent.