Put an email addresses in an event title? They’ll be automatically invited
A minor bug potentially embarrassing bug in Google Calendar could lead to private events being revealed to third parties. Researcher Terence Eden discovered discovered that placing a Gmail address in an event title leads to that person being automatically invited to the event, regardless of the context. It’s not hard to imagine how this might lead to a few red faces through supposedly private info being released to third parties. Eden uses his wife as an example —
“My wife likes to set reminders for herself in Google Calendar. Recently, she added a note to her personal Google Calendar reading “Email alice@example.com to discuss pay rise” and set the date for a few months from now. She’d had a discussion with her boss, Alice, and they’d agreed to talk about salary later in the year.
A few moments later, Alice sent her a “Meeting Accepted” email.”
We’ve confirmed the issue ourselves, and noted that it adds the event to the other person’s calendar even if you choose not to send invitations to guests. The glitch seems to be a result of Google’s event parsing features misfiring, assuming that each email address in the event title was an invited guest.
Eden’s initial disclosure of the issue to Google was met with a response saying the feature was working as intended, however The Verge is now reporting that the company is already at work on a fix, so hopefully this won’t be a problem for much longer.
In the meantime, you’ll want to think twice before adding email addresses to your Google Calendar events, if that’s something you were inclined to do in the first place.
Source: Terence Eden; via: The Verge