Comment by mcflubbins

> They also classified the issue as a “Fraud and abuse” issue, rather than an Oauth/login issue.

I can _kinda_ see that, I agree they should mitigate it as best as possible too though, especially since they're Google after all.

> I thought this would be the end of the story, but 3 months later, they re-opened my ticket (after my Shmoocon talk was accepted), paid a $1337 bounty, and said they were working on a fix.

Sad how the only way to get Google's attention to make enough noise about something...