If I have a profile photo associated with a Google account, then when I enter my email address into GMail, but before I enter my password, the photo is shown.

Is there a possible security breach there? For instance, if someone guesses at an email address, perhaps after obtaining part of it, the photo appearing confirms ownership, without that someone needing to know my password.

I know not to associate a picture with my account, others may not; but let's discuss Google's side of things, not the account holder's.

  • I cannot replicate this behavior. I also have an profile picture associated, but it isn't shown when providing my email address. Tested with a fresh Firefox installation. Doesn't even work after I logged in and out again of gmail (known browser to user association). Can you give some more details on how to replicate this?
    – Demento
    Mar 15 '20 at 8:50
  • I've not tried, but these instructions say it's a user option.
    – paj28
    Mar 15 '20 at 9:11

In the past I have noticed that the full name of the account holder was sometimes displayed too, before entering the password. But not systematically, it seemed to be account-dependent. Perhaps the OP can confirm this.

There is a potential breach of privacy here, even if you put a picture of your cat. Because many people reuse the same image for their profiles on other sites such as forums or social network sites. A simple reverse image search can often match a picture with other profiles and ultimately a real identity. This is one of the most basic doxxing techniques.

If your real name is already embedded in your Gmail address, you probably don't care. If you have some made-up address, that you use to register, post (and sometimes troll) on forums, maybe that should concern you because you are not as anonymous as you think you are.

Think of it, at one point, we have all upset someone with something that we wrote, for good or bad reasons. As a result, we may have had to deal with stalkers at least on one occasion.

Everything you post can and will be used against you. A picture is very often uniquely identifiable data and the metadata sometimes tells a lot: for instance a raw picture from a tablet, camera or smartphone will often have GPS coordinates embedded in the EXIF data. Plus the name and model of your device. Normally the thumbnails will drop all EXIT data but you still have to think twice before posting or uploading anything.

The EXIF can even get you in trouble with the tax authorities. A famous example is late french singer Johnny Hallyday betrayed by pictures posted on his Instagram and Twitter accounts. The geolocation metadata revealed that he spent little time in Switzerland, where he claimed to have fiscal domicile.

Therefore, I recommend using exiftool to systematically strip all EXIF data from your pictures before uploading them to a site. As easy as:

exiftool -all= picture.jpg

The tool has plenty of other options, including bulk options. You could also fake some of the data if you want to have fun with adversaries.

  • I have not yet seen my name (thankfully) and, yes, I am more concerned with social impact than security as such, although there are aspects of both at play here. Mar 16 '20 at 6:15

the photo appearing confirms ownership

You are assuming user must use only his own photo to set it on his account, but Google doesn't requires this, user can put his cat's photo if he wants.

That being said, we can't confirm the ownership of an email address by a the appearing photo.

Is there a possible security breach there?

Showing account photo before authentication, deals more with privacy concerns than user security.

As far as I can tell, there is no known risk of breach that is related to shared user photo, since the purpose is simple as showing it beside your email id, and it is not involved in any identification/authentication process.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.