Collected research

Leaking the email of any YouTube user for $10,000

Arvin Shivram & Nathan (schizo.org) · Brutecat · 12 February 2025

Chains YouTube's blocked-user identifier with a Google account-recovery flow to reveal the email address behind a channel. The write-up explains the identifier conversion, rate and cost constraints, and a practical deanonymization workflow.

Record

Researcher

Arvin Shivram & Nathan (schizo.org)

Published by

Brutecat

Date

12 February 2025

In the archive

• Collected in the 2025 research round

Tags

• info-leak
• user-enumeration
• deanonymization
• privacy
• case-study
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Arvin Shivram & Nathan (schizo.org), first published at the original source. Preserved copies are kept so the citation survives its host.