Unauthenticated access to Google Docs and Calendar

Question

Today, I tried a demo of Openbravo (web-based ERP) and on its main workspace there were two widgets Google Docs and Google Calendar and they both displayed my Docs and Calendar data from my Google account without my permission.

I checked my settings again and I'm pretty sure that my docs and calender are not publicly shared. I am using Firefox 7.0 and was already signed in Gmail.

Is this the default behavior of Google Docs and Calendar or am I missing some privacy setting?

[EDIT:] I tried it in Google Chrome (version 14.0.835.187) with another Google Account and its the same, Openbravo widget displays my private Google Docs without any explicit permission.

Answer 1

Looks like they are using iframes to pull in content. You can browse directly to these sites:

• https://docs.google.com/API/IGoogle
• https://www.google.com/calendar/ig

I think Openbravo is taking advantage of the fact that you are more likely to have a Google account and be logged on than not. They attempted to do the same with Facebook just below the Calendar widget, but I don't have a Facebook account so it just says "Connect with Facebook".

Don't worry, no one at Openbravo has access to your Google account.