Issue 33 in latitude-api: mysterious "[person] has accepted your location sharing request" notification without having sent any request

[latitu...@googlecode.com]

Status: New
Owner: ----
Labels: Type-Defect

New issue 33 by yya...@gmail.com: mysterious "[person] has accepted your
location sharing request" notification without having sent any request
http://code.google.com/p/latitude-api/issues/detail?id=33

I received an email stating that someone has accepted my location sharing
request but I have no idea why.

headers shown below (identities hidden)

from: per...@somewhere.host via friendfinder.bounces.google.com
to: me <this is my add...@gmail.com>
date: 31 December 2011 17:47
subject: person has accepted your location sharing request
mailed-by: friendfinder.bounces.google.com

From the header I conclude that it is legitimate and therefore there was a
location sharing request wrongly sent and then responded to.

I have been friends in latutide with this person for probably a couple of
years and the request came from this person in the first place. ie. I have
never added anyone in latitude. Therefore why am I sending location
requests and why am I sending them to the person who made the initial
request?

Confusingly, I haven't logged into latitude in months - ie. I can't
remember the last time I did log in. Therefore I am certain that there is
nothing that I did that could possibly have initiated this request.

no idea how to reproduce this issue. no idea what caused it. I am however
concerned that google may be sending things like this out on my behalf
without my knowing and wonder what else is being sent out as if it were me.

I'd be grateful for an explanation of the reasons and a statement as to
whether any other requests have been sent without any action on my part. I
would also like to know whether this is likely to affect any other google
products.

[latitu...@googlecode.com]

Comment #1 on issue 33 by nicolasb...@gmail.com: mysterious "[person] has

accepted your location sharing request" notification without having sent
any request
http://code.google.com/p/latitude-api/issues/detail?id=33

I have just had an almost identical issue, I received a confirmation that
someone accepted my request, and she is in fact upset with me that I
unfriended her at all... I did no such thing. My e-mail looks identical
with the header.

I use google latitude somewhat frequently on multiple devices, and I
considered that perhaps one of them I had toggled something somewhere, but
further consideration has left me confused. Any more information would be
appreciated.

[latitu...@googlecode.com]

Comment #2 on issue 33 by steel.travis: mysterious "[person] has accepted

your location sharing request" notification without having sent any request
http://code.google.com/p/latitude-api/issues/detail?id=33

I just received a similar message.
When I went to check my friends on latitude, sure enough, that person was
able to see my fine-grain location! I never sent the request, I don't even
know the person, and I'm using 2-step verification with my Google account
so I'm 99% sure they didn't gain access to my account. I'm disabling
Latitude until this is fixed! This is a major security issue - when
somebody can know exactly where I am at any time without me knowing it!

I've attached an image of the email along with the original message text.



Attachments:
latitude.png 76.6 KB
original.txt 10.5 KB

--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings

[latitu...@googlecode.com]

Comment #3 on issue 33 by martinkr...@gmail.com: mysterious "[person] has

accepted your location sharing request" notification without having sent
any request
http://code.google.com/p/latitude-api/issues/detail?id=33

I'm getting these non-stop.

[latitu...@googlecode.com]

Comment #4 on issue 33 by jpgree...@gmail.com: mysterious "[person] has

accepted your location sharing request" notification without having sent
any request
http://code.google.com/p/latitude-api/issues/detail?id=33

My father is also having these invitations sent on his behalf. He doesn't
even know that Latitude exists.

WTF Google? What is friendfinder.bounces.google.com?