Another Google Privacy Flaw: Calendar

[Turk]

23 Jan 2014
My wife likes to set reminders for herself in Google Calendar.

Recently, she added a note to her personal Google Calendar reading "Email [email protected] to discuss pay rise" and set the date for a few months from now. She'd had a discussion with her boss, Alice, and they'd agreed to talk about salary later in the year.

A few moments later, Alice sent her a "Meeting Accepted" email.

What... The...?

Although pretty embarrassing, it could have been a lot worse. It could have been "Email [email protected] with excuse why we can't see her" or perhaps "Email [email protected] with divorce details" or even "Email [email protected] to demand red stapler back" or... well, you get the picture.

Luckily, my wife doesn't have a Google+ profile, so there was no information leak other than her email address (which wasn't "huggle.wuggle.2012" or anything daft like that!)

We've tried several times to recreate this behaviour. Here's what we discovered:
If you use Google Calendar on the web and put a Gmail address in the subject line, that user will have the event added to the calendar.
They will not receive an email notification - although they will get a "meeting reminder" pop-up.
Creating an event on an Android phone does not trigger a meeting request.
Some non-Gmail addresses will also see the meeting in their calendar - but others will not.
When you delete a calendar item, the "Cancellation" notification is emailed regardless of whether the user received the original invite.

We were unable to determine which non-Gmail addresses would receive the item in their calendar. Some which were hosted with Google didn't receive the pseudo-invitation. Some accounts hosted on Microsoft Exchange got the invite while others on seemingly similar systems didn't.

Here's a video showing it in action.

http://shkspr.mobi/blog/2014/01/another-google-privacy-flaw

[212eta]

When it comes to Privacy, Google knows best how to... :duh:

[DLord]

Thank you for the share. Gotta be much more careful using Google Calendar with such flaws.