Your Google Calendar Is Probably Public. Here's Why That's Terrifying.
来源: bobdahacker blog ·
Google Calendar has a setting that makes your entire calendar visible to anyone with your email address. Not just your availability. Full event details: titles, descriptions, attendees, Zoom links with passwords, and any documents linked in the description. All anyone needs is your email and a URL like calendar.google.com/calendar/u/0/embed?src=you@company.com. No authentication. No notification to the owner. This whole rabbit hole started by accident. I was doing security research on MSCHF, the viral product company behind Big Red Boots and Blur, and ran an employee's email through GHunt, an
常见问题
什么是 Your Google Calendar Is Probably Public. Here's Why That's Terrifying.？
Your Google Calendar Is Probably Public. Here's Why That's Terrifying. is a 文章 discovery curated from bobdahacker blog. Google Calendar has a setting that makes your entire calendar visible to anyone with your email address. Not just your availability. Full event details: titles, descriptions…
如何访问或体验此内容？
You can experience this content directly on its original host (bobdahacker blog) by clicking the "Open Original" button.
此内容来源于哪里？
Curated from bobdahacker blog by the OnSuggest team to surface the most interesting and serendipitous content on the web.
相关发现
所有 文章 发现 →From hakyll to comrak based generator
Tl;DR: I decided to gradually switch from hakyll- based framework for this blog to comrak -based custom generator. I’ll migrate both HTML render of posts and RSS feeds in the following few days. You should not see any changes: all the URLs and UUIDs are the same before and after. Until I missed something crucial. I hope I did not. The one exception will be the style of syntax highlighting in the HTML render of posts (and it will probably keep changing for a while more when I experiment with various backends). Background I used hakyll for about 13 years at least since first commit from 25 Novem
You Paid $50K for a Pentest. You Didn't Get One.
I'm going to tell you something big cybersecurity doesn't want you to hear: the pentest you paid for probably wasn't a pentest. I've lost count of how many times I've disclosed critical vulnerabilities to a company, only to hear: "That's weird, we just had a pentest done and they said we were clean." At this point, hearing that a company recently passed a security assessment is almost a leading indicator that I'm about to find something bad.
The Fix That Wasn't: Why Outsourced Dev Teams Are Your Biggest Security Risk
There's a conversation I have over and over again. A company hires an agency to build their app. The app ships. It works. Everyone is happy. Then someone like me takes a look, and the whole thing falls apart. And you better hope it's someone like me, not someone who wants to exploit it. This isn't about where developers are located. Talented engineers exist everywhere. This is about a business model where agencies are incentivized to ship features fast, security isn't in the contract, and nobody checks the work.
Your Lowest-Paid Employee Can Probably See Everything
Companies spend millions on firewalls, endpoint detection, and perimeter security. Then they give a part-time employee the keys to the kingdom. This is one of the most common patterns I find in my security research, and one of the least talked about. It's not about hackers breaking in from the outside. It's about what's already accessible from the inside, to people who were never supposed to see it.
Your Boarding Pass Is a Skeleton Key. Frontier Airlines Doesn't Care.
How I found that anyone with a boarding pass photo can pull full passport numbers, home addresses, children's dates of birth, credit card details, and Known Traveler Numbers for every passenger on a Frontier Airlines booking. Reported March 3rd. Still live 105 days later.
I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.
How I found that anyone could register on FIFA's public Agent Platform, gain access to the Football Data Platform's Streaming Management panel, and get RTMP ingest URLs and stream keys for every live FIFA World Cup 2026 camera feed. I then spent hours calling FIFA, MediaKind, HBS, CISA, and the FBI trying to get someone to pick up the phone.