4 ms·
Hey all, I work at Facebook, but this is not an official media statement. This doesn't appear to be a Facebook bug that leaks anyone's private email address.
by blakeross 16y ago
Hey all,
I work at Facebook, but this is not an official media statement.
This doesn't appear to be a Facebook bug that leaks anyone's private email address. It appears that all the examples indexed in Google exist in Google because they were already published publicly on other Internet sites. We're committing a fix right now to stop indexing this page in Google, but even that wouldn't prevent email addresses from being published because it appears that users are already republishing their addresses in other non-Facebook venues.
For example, if you see http://www.facebook.com/o.php?k=afc4a7&u=1018862530&mid=21f667bG3cba9bc2G0G8 http://www.facebook.com/o.php?k=afc4a7&u=1018862530&... in isolation, it appears to be divulging private information.
However, the original Facebook email that links to that page and contains the user's email address was republished publicly on a mailing list archive by the owner of the email address: http://games.dir.groups.yahoo.com/group/Living_Greyhawk/message/98175 http://games.dir.groups.yahoo.com/group/Living_Greyhawk/mess...
Does anyone see an example where this is not the case that constitutes a privacy leak?
Blake Ross
- corywatilo 16y agoBlake, Thanks for following up. My personal email address is indexed, but is nowhere else on the internet. Shoot me an email at hi@corywatilo.com and I'll give you the address.
- blakeross 16y agoHi Cory - Can you see my response below regarding Posterous? Also, it does appear that your email address is available on the Internet, e.g. http://groups.google.com/groups/profile?enc_user=nBw3lBQAAAAWUyfsmoyCnSqrJSDQVYLLOPANdqfI6prRsqjc7uCt1A http://groups.google.com/groups/profile?enc_user=nBw3lBQAAAA... Thanks, Blake
- corywatilo 16y agoWow, I didn't even know that was out there. But, it doesn't look like Google indexes those.
- blakeross 16y agoFurthermore, the author of the blog post in question republished his own Facebook email on http://corywatilo.com/reminder-cory-invited-you-to-join-facebook http://corywatilo.com/reminder-cory-invited-you-to-join-face... Although his email opt-out link has been edited out of that email (see "please clic to unsubscribe." at the bottom), it appears that the email was originally published to Posterous in its entirety via his iPhone and then edited later, after it was picked up by Google. (Update: The author of the original blog post acknowledges this below.)
- sounddust 16y agoGood point. That blog post has a link "to sign up for facebook", and when you click on it, it reveals the gmail address of the user (which is something @gmail.com). At least that answers the question of how Google found it.
- corywatilo 16y agoThis is possible. +1 Blake Would be nice for FB to exclude that page from getting indexed though.
- blakeross 16y agoThanks for the acknowledgment Cory. FYI, we collaborated with Google and these pages are no longer indexed as an extra precaution: http://www.google.com/search?q=site%3Afacebook.com%2Fo.php http://www.google.com/search?q=site%3Afacebook.com%2Fo.php
- deleted 16y ago[deleted]
- jpeterson 16y agoSorry, but it is a Facebook bug. Facebook could've easily instructed google not to index these pages.
- blakeross 16y agoIt wouldn't have mattered. The user republished a Facebook email on a non-Facebook venue (such as a public mailing list archive), thus exposing their email address. See, for instance, http://groups.yahoo.com/group/salemwhitemagic/message/89 http://groups.yahoo.com/group/salemwhitemagic/message/89
- what 16y agoThat's a lame excuse and as corywatilo has pointed out is untrue (at least for his email... and probably others).
- natrius 16y agoThere is no way for Google to find those pages unless those pages are linked from somewhere else or Google is getting URLs from users' browsing activity. The first scenario makes this relatively harmless. The second makes it a privacy issue on Google's end.
- luckyland 16y agoListen, this isn't the point. The point is that Facebook should be responsible for protecting their own indexing vectors. Plain and simple.