March 6th, 2008
Google gives developers access to your contacts
Developers now have an official Contacts API they can use to create, read, update and delete your contacts — but there is a catch. Thankfully, in order for a website to get this level of access to your list, you must sign into your Google Account and give the requesting website permission.
Unfortunately, it’s still dead easy for real desktop or mobile applications to read your contact list without asking your permission. Google would probably like developers to use their ClientLogin API for this, but with a simple web request, an application has full access to your contact list if you are currently signed into Google.
Click here to see your contacts.
If you are logged into Google (for example, you are using Gmail or have checked the “remember me” checkbox), the link above will show you a nice, easy to consume XML document of your whole contact list. Applications running on your computer can simply grab the contents of that URL and do what they want without using the new official Contacts API. Rest assured though, this information isn’t usable by other websites unless a malicious user finds an XSS vulnerability to exploit.
Garett Rogers is employed as a programmer for iQmetrix, which specializes in retail management software for the cellular and electronics industry. See his full profile and disclosure of his industry affiliations.
