Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Calendar Unexpectedly Leaks Private Information

shkspr.mobi

Post reply on HN
Print view View original

51–60 of 138 posts

Re: Google Calendar Unexpectedly Leaks Private Information

#51

Post by Shooti »

ritikk4 wrote: post #18
amirmc wrote: post #10

Earlier quoted context omitted.

It's evidently not 'expected' behaviour from the point of view of the user. Just because you happen to put an email address in the title of a calendar event doesn't imply that I expect the software to go and send messages on my behalf.

Then we disagree. Especially if it's in the title it indicates you want to coordinate with the email you just entered. A proper way to do it is, Title: "Email Alice", Description: "alice@example.com".

A good UI would make it explicitly clear by highlighting the email address and/or by auto adding an explicit entry to the guest list.

At present there's no way to predict the behavior until after the fact. Something with that much consequence (sending an email to an unintended recipient) should never be done silently. By all means take the initiative with autofill etc, but the user should have the final say.

If the supposed design revolution within Google (http://www.fastcodesign.com/3016268/google-the-redesign) isn't just for show, the Calendar team (assuming there even is an ongoing team) clearly hasn't been touched by it and that ought to be corrected.

Re: Google Calendar Unexpectedly Leaks Private Information

#53

Post by prof_hobart »

ritikk3 wrote: post #4

A couple of things: That is expected behaviour, email address in reminders applies coordination. It's basically parsing your command correctly 'email this address'. Second, the zdnet post you link to towards the end is full of inaccuracies: https://news.ycombinator.com/item?id=7107554

Apart from the fact that you're typing in a title, not a command.

Re: Google Calendar Unexpectedly Leaks Private Information

#54

Post by thomasahle »

username223 wrote: post #28
edent wrote: post #8

Earlier quoted context omitted.

To be fair - they were very quick at responding and asked questions about my disclosure. The security team is very responsive but for normal users there is no way to communicate with Google.

This seems like a business opportunity -- come up with a steady stream of "security issues," then use the resulting access to provide paid customer service for GOOG.

You can get great paid GOOGLE customer service if you just sign up for Google Apps.

Re: Google Calendar Unexpectedly Leaks Private Information

#55

Post by [deleted] »

ritikk3 wrote: post #4

A couple of things: That is expected behaviour, email address in reminders applies coordination. It's basically parsing your command correctly 'email this address'. Second, the zdnet post you link to towards the end is full of inaccuracies: https://news.ycombinator.com/item?id=7107554

[deleted]

Re: Google Calendar Unexpectedly Leaks Private Information

#56

Post by DanBC »

ritikk4 wrote: post #15
nmc wrote: post #12

Earlier quoted context omitted.

Out of curiosity (and regardless of the meaning of your comment), are you completely unrelated to the author of the comment you are linking to? Except the "3" at the end, their pseudonym is identical to yours. Here on HN people do not like fake accounts.

It's mine, I just signed up to join the discussion, but evidently new users get rate-limited to only a few comments, so I've incremented the username by 1 to indicate it's still me.

The rate limiting exists for a reason. It is a bit arrogant of you to assume that your comments are worty of evadin site controls.

And is it actual rate limiting? Try clicking the [link] url, whic should give you a reply text box.

Disclosing company affiliations is polite.

Not making comments in public fora, but letting company spokespeople do it, is a practice I dislike but which I understand having seen the mess you've made with your comments.

The violet blue article is lousy. If there are errors it should be easy enough to find corrections. Take the time to do it properly - find the sources, pull out relevant quotes, build the post. Put that as a blog post and get hits, or put it as an answer in the thread and get upvotes.

Re: Google Calendar Unexpectedly Leaks Private Information

#57

Post by brudgers »

ritikk4 wrote: post #44
brudgers wrote: post #38

Privacy, where it exists, creates impedance in Google's cash flow because it requires designing for some n sigma tail where n does not entail statistical significance and the case analysis must be very fine grained. Google doesn't have a category labeled "private" information". It never has and creating one is not planned. Privacy is not amenable to computer science. It is a social concept not a technical one. The cl…

Generally speaking you might be right, but I fail to see the profit motive behind this specific case. It's just a UX disagreement it seems.

This is simply one expression of the corporate protocols in which privacy does not exist. It's not a bug. It's not an honest mistake. It is an implementation detail of a higher level abstraction.

Re: Google Calendar Unexpectedly Leaks Private Information

#58

Post by chrisBob »

aviraldg wrote: post #16

This is not a "private information leak." It's expected behaviour. Entering information in that field to create a new event results in Google Calendar parsing your information as best as it can, to automatically set things like the date, time, event description and of course, the participants (the apparent privacy leak here.)

This is why I always enter email address into my calendar events as chris@example NOT chris@example.com

Re: Google Calendar Unexpectedly Leaks Private Information

#59

Post by buro9 »

dredmorbius wrote: post #40
slazaro wrote: post #3

The worst thing about things like this happening is the feeling of helplessness when you can't reach anyone in the company or when they just say "it's not a problem".

Or the company shill shows up and burns through four HN accounts trying to spread FUD. https://news.ycombinator.com/threads?id=ritikk https://news.ycombinator.com/threads?id=ritikk2 https://news.ycombinator.com/threads?id=ritikk3 https://news.ycombinator.com/threads?id=ritikk4 (Should I add the 5th link or wait for him to create that ID as well?)

Maybe create it instead of him, it might stop him in his tracks.

Re: Google Calendar Unexpectedly Leaks Private Information

#60

Post by fluidcruft »

ritikk4 wrote: post #18
amirmc wrote: post #10

Earlier quoted context omitted.

It's evidently not 'expected' behaviour from the point of view of the user. Just because you happen to put an email address in the title of a calendar event doesn't imply that I expect the software to go and send messages on my behalf.

Then we disagree. Especially if it's in the title it indicates you want to coordinate with the email you just entered. A proper way to do it is, Title: "Email Alice", Description: "alice@example.com".

You know what, reading all your desperate posts is very disturbing. Even Google Now knows to ask before auto-doing shit, but you sit here with some stupid surgeon-like "I can do no wrong" attitude.

Generally, I thought Google hired smarter people than you seem to be, so possibly you're some sort of false-flag bullshit.

Post reply on HN