Software

Latest GSpace doesn’t really require GMail.. (GMail as an anonymous File Relay)

This is probably very obvious but I was installing the latest version of Gmail Space today - 0.5.1 - ( a FireFox extension for accessing GMail as a filestore in the browser, get it here: http://www.rjonna.com/ext/gspace.php ) and came across some interesting and most likely unintended functionality.

You can use your own arbitrary email address as GSpace storage. This latest release (and possibly others, have not tested) seems to communicate with GMail in a way that relays the data via the GMail SMTP servers and back and forth to your personal server. It appears actually to proxy the login over to the specified server, without any valid gmail credentials..

Pretty simple stuff actually, when you configure it, instead of giving it your gmail address simply give it your personal email address and password. GSpace communicates with GMail which then relays the mail to your personal account. When retrieving it does the same and somehow pulls the content back over. Note that the connection to the 3rd party server comes from GMail, not the connecting client.

My GMail account stays empty (since I never gave it my account id) but my personal email account gets the files as per the screencaps. The connection to the 3rd part mailserver comes from GOOGLE and not from my desktop PC.

Last oddity, if I delete the file from GSpace it does NOT remove it from my server but it is unavailable in GSpace (it must be keeping an internal counter?). If I delete from my email it STILL shows in GSpace(It seems to be caching the files locally).

Some security implications of this would be things like large scale piracy. Someone sets up an SMTP server, distributes the file drop information (login info for an email account on the mail server) and that data is transferred anonymously via GMail with no audit trail. Google can’t look for it since the data is NOT ON THEIR SERVER but thousands of people around the world can easily access the pirated data and be anonymized at the Google GMail SMTP gateway.

Anyone know why Google would be relaying data like this? Seems ripe for abuse… I may be missing something obvious but it feels wrong to me.

Some photos and logfiles

This is the contents of my PERSONAL email account (webmail interface)

GSpace files in Thunderbird via IMAP

Capture of the config screen for GSpace, note that its my PERSONAL account login information.

Screen capture of the contents of GSpace.

Here is my mailserver log. Note that the connection is coming FROM Gmail, not from my office ISP. My personal identity is not compromised in this workflow from a Gmail/GSpace perspective, I am totally anonymous to the 3rd party mailserver(my own in this case).