Hide Complete Orkut Profile! [New Orkut Bug]

Important Update: This is fixed NOW. So I am closing comments for this post


Long time back I wrote about hiding your profile name on orkut. Yes it was something to write about as by default you can not left your orkut profiles’ first and last name field empty.

Now comes a simple bug which hides complete orkut profile as shown below…

invisible orkut profile

# Steps To Hide:

  1. Go to Orkuts manage stuff page or click here.
  2. You will see a URL field on that page. Enter http://oa.addons.googlepages.com/hideme.xml in that field.
  3. Press Add button. That it!

Here comes screenshot…

Hide Orkut Profile

# Steps To UnHide: (works in firefox 2.x only)

  1. Go to Orkuts manage stuff page or click here.
  2. You will see a My Feeds section at the bottom of that page.
  3. Click the remove button next to feed we have added above!

Here comes screenshot…

UnHide Orkut Profile

# Technical Details

If you look at source of hideme.xml you can see title field have a script tag!

<title><script>prompt(‘Hi’,’Hello’)</script></title>

Next all contents are there if you look at source code of hidden profile pages, then…

>> Here is what exactly went wrong:

  • First thing feeds have no restriction on their title length.
  • On profile pages orkut shows feeds added to that account in left sidebar.
  • Now left sidebar is of fixed width so orkut has to truncate long feed titles. So if feed title is longer than 13 character, then only first 13 character is displayed from feed title followed by ellipsis […]
  • So in hideme.xml case first 13 characters are – <script>promp
  • Now while parsing browser encounters a <script> tag but no matching </script> tag and thus HTML source rendering stops in left sidebar only. Thus main portion of profile is not parsed at all!

>> Solution:

  • A very simple but highly costly solution is too validate feeds when user adds them! This I guess will not be acceptable by user as well due to delay caused by validations. Also while working at orkutfeeds I see today’s valid feed may become invalid tomorrow and so vice-versa!
  • So next solution is to do HTML entity escape on selected feed title portion as there is nothing wrong is truncating long feed title.
  • In PHP this can be easily achieved using a function htmlspecialchars. I hope there must be an equivalent in ASP also.

>> Implications

  • As you can manage your stuff only this is not serious as of now!
  • But use of script tag in title field suggest somebody discovered this bug while trying to find a XSS hole.
  • Now I guess orkut is lucky this time as truncation saved them. Otherwise this could have been ground for a perfect XSS attack! May be it is… πŸ˜‰

Credits: Orkut Addons blog by Bean!

24 Replies to “Hide Complete Orkut Profile! [New Orkut Bug]”

  1. Tried …….but not working.
    …………………………..
    Rest in your profile & tell me what happen with you. Bro, please do something for me. [:(]

  2. Hi All,

    I tried the steps for hidding the profile in orkut but could not able to recover it.

    I can able to hide my orkut profile but could not able to recover that.

    I struggled a lot, then finally got solution from Rahul.

    Please try this only with Firefox and not in IE.

    Enjoy this !!!!!!!

    Thanks Rahul.

  3. If you have any problem in recover your profile to its previous stage, then here is the solution. Thanks to Rahul πŸ™‚
    ===========================
    Firstly login in to your Orkut account in firefox and click
    to the manage stuff link in your right hand side in your profile.

    If you see the blank screen like your profile’s
    page….that means there is a problem in your browser or
    your addons that not match with script.
    If you are using the latest version of firefox i.e. firefox 3 beta 3 & new firefox 3 beta 4 I think its not compatible with this trick.

    So, disable all the addons/plugins of firefox and run procedure again.
    > If still not work, then uninstall your beta firefox with all the cookies & data and install old fresh version of firefox again.

    This trick works with me. And I am sure could works with you.
    ===========================?|?
    πŸ˜‰

  4. Hiiiii……
    I m trying 2 hide my orkut account using the above steps….Bt its not working….Whenever i enter dat URL,its saying “PLEASE ENTER A VALID FEED URL”………Plz help me out….i want 2 hide it as soon as possible…plz repl…….

  5. Hi I want to hide my orkut account for 6months so that no one can see my profile as well as my friend and community list. I don’t want to do orkuting for next 6 months but don’t want to lose my friends and communities. Please help me.

    1. @bimal

      Well there is no such official feature like hide your profile or take it offline. What you read in this post was a bug, rectified long time back.

      Still I will tell you how what you may do…

      • First change your status to going offline for 6 months (read more about this new feature)
      • Change last name in your profile to "offline for 6 months"
      • Write a scrap in your scrapbook saying you are going offline for 6 months
      • Also do not forget to put write lock on scrapbook and make your album private. (Read More)

      In meantime, if you just want to receive scarps via RSS or email or SMS try our service orkutfeeds. (Read More)

Comments are closed.