Home Too Easy: How a Simple Hack Can Turn Your Numeric Google Profile URL Back into a Gmail Address

Too Easy: How a Simple Hack Can Turn Your Numeric Google Profile URL Back into a Gmail Address

Over the last few days, there has been a lot of buzz about how much private information your public Google profile contains if you don’t choose the right settings. The URL of your profile alone can already give away your Gmail address. To hide this address from public view, you can switch your profile URL away from showing your name to using an address that features a 21-digit number instead of your username. However, as it turns out, this isn’t a foolproof method either. By using a very simple trick, anybody can quickly figure out your Gmail address from these numbers.

Update: Google has now closed this loophole. Here is a statement we just got from a Google spokesperson:

Blogger harmonyguy helped us discover a bug that made it possible to discover a user’s email address based on their numeric profile ID. Our engineers worked hard to address this issue and it is now fixed.

Security blogger The Harmony Guy just told us about how this hack works. While the way to reveal these addresses isn’t obvious, you can easily follow along and try this method out yourself.

How does it work?

First, you simply copy the numbers from a user’s Google profile and then append these numbers to http://picasaweb.google.com/[numbers].

For some users who haven’t customized their Picasa page, the username (which is also their Gmail address) will come right up. If the user has customized the account and added a nickname, you simply have to replace the URL in the address bar with javascript:alert(_user.name); and a small pop-up window will show you the username.

Caveats

It’s important to note that this only works for Google users who also use the Picasa web service. This, however, is likely a large percentage of Gmail users.

How to Protect Yourself

In Picasa Web Albums, go to the settings page and add a new username. Then, select the new username for your gallery URL. As The Harmony Guy points out, you may also want to edit your nickname.

Is this a major issue for Google? Probably not. But given the ruckus around privacy, Buzz and Google Profiles these days, it is disheartening to see that it is this easy to circumvent the only way to hide your Gmail address from public view. After all, if you want to use Google Buzz, Google forces you to have a public profile.

About ReadWrite’s Editorial Process

The ReadWrite Editorial policy involves closely monitoring the tech industry for major developments, new product launches, AI breakthroughs, video game releases and other newsworthy events. Editors assign relevant stories to staff writers or freelance contributors with expertise in each particular topic area. Before publication, articles go through a rigorous round of editing for accuracy, clarity, and to ensure adherence to ReadWrite's style guidelines.

Get the biggest tech headlines of the day delivered to your inbox

    By signing up, you agree to our Terms and Privacy Policy. Unsubscribe anytime.

    Tech News

    Explore the latest in tech with our Tech News. We cut through the noise for concise, relevant updates, keeping you informed about the rapidly evolving tech landscape with curated content that separates signal from noise.

    In-Depth Tech Stories

    Explore tech impact in In-Depth Stories. Narrative data journalism offers comprehensive analyses, revealing stories behind data. Understand industry trends for a deeper perspective on tech's intricate relationships with society.

    Expert Reviews

    Empower decisions with Expert Reviews, merging industry expertise and insightful analysis. Delve into tech intricacies, get the best deals, and stay ahead with our trustworthy guide to navigating the ever-changing tech market.