Finjan Inc., declared that it backs up recent reports that Google have accidentally exposed private user names and passwords on the Google anti-phishing blacklist, without using any access protection. Such sensitive data could potentially have been used to compromise user privacy, and could even have been used for identity theft or financial profit .

On January 3, 2007, Finjan’s Malicious Code Research Center (MCRC) researchers exposed that a list of URLs was available and not encrypted on Google’s servers and straight away informed Google, which acknowledged receipt of Finjan’s alert about the vulnerability.

Finjan considers the information on the servers had been gathered using Google’s anti-phishing browser extension. Google has long fixed the problem, and it is assumed that Google has notified all affected users. Recent tests conducted by Finjan confirm that there is no data leakage on the current Google anti-phishing blacklist.

For a snapshot of the data leakage page follow this link: Google JPG