Automatically followed by abusive ex-husband (and his friends) on Google Buzz

Huh. Sorry, I can't access it now either.

I did some of my own experiments with a couple of throwaway accounts, before the privacy improvements on Thursday.

I set up a profile on one account ahead of time. This was very easy to do; Google Reader encourages it at various places.

When I logged into GMail and got the "Buzz" welcome screen, it offered "Try Buzz" and "No thanks." I clicked "No thanks" and it took me to GMail, but the Buzz UI was enabled anyways. When I logged into second account that was a contact of the first, it received a notification that the first account was following the second, with a link to the first account's profile and list of followees/followers.

Now, this part is a bit foreign to many people, but imagine that the fact you email someone is a secret and potentially damaging to you. Maybe you are a whistleblower talking to a government regulator. Someone I know had a stalker added to their Buzz followers along with people she didn't want the stalker to learn about (because stalkers will try to get at their victims through their friends and family). Maybe you don't want certain people aware of your sexual orientation, or your religious or political activities.

At this point, the damage is already done. Before Thursday night, there was no clear notification or way to opt-out of the public followers list until after it had been created and then broadcast to a list of people. By the time you got around to checking out Buzz, realizing that your information had been disclosed, and figuring out how to remove it, it could easily be too late. Note that Google did not "suggest" people to follow and then let users "accept" these defaults. They were added without the user's knowledge or consent.

Worse, if you found the "Turn off Buzz" link in the GMail footer and clicked it before blocking your followers, changing your profile settings, etc., then all your information is still public but hidden from your GMail pages! It's then much harder either to discover the problem or to fix it.

And Google has admitted to some outright bugs that made the situation worse for the "Fuck you Google" blogger. For example, people still appeared in the "Following you" list on Google Reader even after they were blocked and you set your Reader shared items to private; they couldn't actually see your shared items then but it appeared to the user that they could. Also, before Thursday there was no way to block a user who did not have a public profile.

My friends who work at Google are convinced these are real problems[1]. I think you are dismissing them way too quickly.

[1]: http://www.google.com/buzz/mbrubeck/HEN2DyJooNZ/This-looks-l...

This is kind of beating a dead horse here, but Despammed.com was my baby (still is, in an embalmed and pathetic sense) for six years. And we had Web-based anonymous email for real, written into our policy. We tossed the logs every day - the only way anybody could get fresh logs, before tossing, was to subpoena us for them. One - exactly one - law enforcement agency did that, for a user who was using us as a dropbox for credit card fraud. The Italians never managed to get us a subpoena for the freedom-of-speech abrogation they attempted. And nobody else ever tried. They'd bluster a bit, but when it came to getting us paperwork, they went away.

I should probably reinvigorate that someday.

Clearly this is an edge case though; you cant protect against every eventuality!

Couple things here.

First, I stand by what I said: People need to be aware, and made aware, of these things. Privacy is your business, and putting my privacy in the hands of someone else (and I'm not even referring to Google here) means I'm essentially giving up my privacy. Whistleblowers and other people who wished to remain secret should have taken more steps to ensure their privacy (accounts that can't be traced back to themselves).

Secondly, you don't make it clear whether either account said it auto-followed things before you logged in or not. Did it? Did Account 1 follow Account 2 without actually logging in with Buzz enabled, or was it only after logging in it auto-followed? Note: I realize the implications of either way; however, I'm just curious to know which it is for my own knowledge. Again, I'd rather not assume. You also make it seem as if you accepted the default privacy settngs Google set for you.

Next, I realize their were bugs in Reader that "Fuck you Google" made them aware of. Bugs happen. In this case, the bug was just a display bug and from my understanding, didn't actually share anything. In this case, the big problem was merely a display problem. Sure, this is a bug, and a serious one, but not the extent that anyone was suggesting.

Finally, everything I've seen from Google, including the link you sent, suggests that they had these settings in before hand, and that the privacy concerns were more from people that didn't look into the privacy settings before hand and accepted the defaults. The link you posted even described all the issues you described by fixing them merely through making them more visible.

So again, we come to it: The settings were made available. That they weren't flashing and in front of the users with big bold text with sound announcing themselves is a problem, but not to the same extent that "Google was display user's contact lists on their profile page."

However, that all being said, I still think we can learn a lot by this. But looking at it through the eyes of the mob-think that occurred these past few days won't teach us anything, and if anything, only promotes continued ignorance of privacy concerns on the internet.