HN Explorer

Tell HN: Warning, Google ignores opt-out for Buzz if you set an away message

32 points by yalurker ↗ HN
Well, my opinion of Buzz just did a 180. When it first asked me to join I opted out and moved on. I didn't see the big deal for privacy concerns, since I could easily opt out and never use it.

Today, I set a status message for google chat as an away message, and suddenly I was auto-enrolled into buzz. My away message was published as a status update, I had followers auto configured, the whole deal. I think I've successfully killed it now, but already my privacy has been lost (just the auto-follow behavior exposes who I chat/email with through gmail).

So a warning to other HN readers: be wary in using google chat status updates, or you may find yourself enabling buzz even after explicitly opting out.

And if anyone from google is reading this: No means no. If you enable buzz after I explicitly say no, then you just buzz-raped your user.

30 comments

[ 2.6 ms ] story [ 68.7 ms ] thread
CoryMathews
This whole buzz thing has send me looking for a new email provider. If they so eagerly give out all my contacts what else are they doing or whats next? The last couple months have been enough for me to start my move away from google.
scott_s
My understanding is that you did not opt out of Buzz. What you said "no" to was taking the tour of Buzz - but you were still auto-enrolled. Hence the fuss.
wgj
That's just as bad or worse, if a tech savvy user can come to this kind of erroneous conclusion.
ekiru
That's odd. I even opted in for Buzz but never created a public profile due to privacy concerns, and my chat status updates aren't be posted on Buzz(although when I looked in the linked sites dialog to see if it should be, I noticed that while Google Chat status updates were not linked, Picasa and Reader were(conveniently, I don't use Picasa and I use Reader exclusively for reading), although it said that they would not be actually linked until some further step was taken).
jameskilton
So I've yet to create a Google public profile but I just saw a very disturbing "feature" related to Buzz. To make sure that I was safe from Buzz, I enabled it and unfollowed everyone it automatically made me follow, then turned it off again.

But then I went to my Google Reader page, and my "People you follow" list was now completely empty. Google has hooked up sharing between everything with Buzz, and that's not cool.

Wow. I'm starting to wonder if I should also start looking for alternatives.

natrius
Are you sure it automatically followed people you weren't already following on Reader? If they were, the behavior makes sense.
aw3c2
I am so glad people finally start seeing Google for what it is. A huge evil (at least explicetely not "do no evil") corporation with a dangerous market majority on many things on the internet. Embrace alternatives!
buster
While the launch of buzz really is a big disaster, i still think most of the errors that were made, were not because of a manager saying "hey, great, lets publish all privacy information of our users to the internet, thats a great business model!" (think of it, the users data is probably the most valuable data an internet company has today). It looks to me, as if a team had a good idea (yes, i think buzz as an idea is a good idea, the launch was not) but it was not properly tested and thought of such cases. All in all it was released far too early for far too many people. I still wonder why they didn't roll out buzz on an invite only base like they did with gmail. All this negative press could've been avoided and most people would be like "yay, thats cool!" without the "oh shit"-effect.

But that attitude that google fucked up your privacy on intent is just stupid. I agree, Googles power is scary: Think of it, google may control a lot of users internet experience from end-to-end in the future (ISP->Search->Mail->Mobile->Android->Netbooks+advertising = omg, scary!). They will eventually end up being split into many companies if the trend continues. But to say they fucked up your privacy on intent is just wrong, imo.

Thanks for the upcoming downvotes in advance, because i don't just repeat what every little blog is already writing over and over again.

danudey 

  > It looks to me, as if a team had a good idea (yes, i think buzz as an idea is a good idea,
  > the launch was not) but it was not properly tested and thought of such cases.
I agree wholeheartedly, which is why I feel they're evil. They believed that their idea was a good one, and so forced it on everyone without bothered to test it. Even if you don't attribute their mistakes to malice, the other option is to concede that they were 'merely' careless and reckless with our personal, private data.

My issue with Google isn't all the privacy issues around Buzz, it's that all the privacy issues around Buzz came after no outside testing, and with no choice on the end-user's part. They made a string of assumptions that turned out to be false in a not-insignificant number of cases, because no one thought 'hey, maybe we should ask people before we give other people information about them.'

buster
Yes, i agree. As i said, it would probably have been a good idea to start with an invite-only beta stage. Still wondering why they didn't and why they didn't think the use cases through, that's a shame. To me it feels, like some manager wanted to push that software out before its time where i hoped google projects wouldn't be as budget-driven and as marketing-driven as the whole rest of the industry. Atleast not so much to produce such a disaster.

Although Google did some steps to open up in terms of what data they have on a user, i hope this incident pushes them to be as open as possible with what data of me they have and giving me more control over it.

earl
No, Google clearly demonstrated that they are evil.

For whatever reason -- it doesn't matter in the slightest -- they decided not to very carefully think through what type of formerly private embedded information they had garnered through gmail, picasa, and reader. They then went and shared this information in an, at best, very difficult to understand and disable manner with a group of people that I didn't choose nor desire to share with. All in an effort to bootstrap their fb/twitter competitor.

To recap: in order to make money, they shared my private information to benefit no one but themselves.

Dear YC folks: now is a perfect time to write a self-hostable gmail clone.

fnid2
wow. i am so glad I haven't logged into any google products since they launched this. I may create brand new accounts. I don't use gmail, thank goodness!

I knew my reluctance to use Google products would pay dividends.

JeremyBanks
You seem very relived. Would this have actually directly negatively affected you?
fnid2
Who knows? It has negatively affected others already.
JeremyBanks
Sure, but those were uncommon circumstances. I'm not denying that Google deserves a ton of shit for this, but I don't think it's the kind of thing that had much of a chance of negatively affecting the average user.
[deleted]
(comment deleted)
carbon8
Out of curiosity, I just tried it on an account with an existing Google Profile that doesn't have buzz set up and it did not add followers/followings to the existing Google Profile. It added the status message to the buzz feed, which isn't a privacy problem since contacts can see it anyway, but it did not fully set up a buzz profile. Clicking on the Buzz status textarea brings up the normal "How do you want to appear to others?" form and still won't let me use Buzz without setting it up.

Also, I can't see the following/follower lists from another account; it just shows the name, a link to the google profile and the fact that the two accounts are following each other, but nothing about any other contacts. It does, however, appear that the profile is fully set up from within the account, showing the follower/following lists, but outside accounts can't see this info.

I also follow someone who hasn't created a Google profile or started using Buzz. She changed her status message and it showed up in the Buzz feed, but when I click on her name it goes to an empty Buzz profile view that says "This person does not have a public profile." where the name usually is.

TL/DR: I looked at accounts both with and without an existing Google Profile and although a status message change is posted to the Buzz feed, in neither case did it fully sign the account up for Buzz nor did it expose contacts, despite the fact that it looks like it does. YMMV, but probably not.

yalurker
Very good information. I didn't do any verification from outside accounts, I just started immediately trying to stop/undo.
carbon8
Yeah, it's tremendously confusing. As far as I can tell, looking at it from another account is the only way to know that the profile doesn't actually show the following/follower information publicly. It really shouldn't require an in-depth, multi-person investigation to figure out what's public and what isn't.
[dead] blueag
I've disabled both Chat and Buzz as now. Chat used to be there as a benign thing since I don't use it. Since the Buzz forced activation, I've gone through to disable all Google apps that I don't care.
robotron
Doesn't this really belong in a bug report somewhere?
s3graham
I feel like the only person not pissed off about Buzz.

Email contacts might seed your connections, but I have followers and followees that I've never spoken a private word to in person or via email.

Honest question: what information is it that people feel is leaking, other than "I clicked 'Follow' on this person's profile"?

lftl
I think the biggest failure of Buzz is how confusing it is. I think this is one of the most misunderstood products that has ever been launched. I honestly believe about 90% of the complaints we've seen are misunderstandings of how Buzz works, and how the information that it sets up looks to other people.

For example, in my experience the autofollow doesn't reveal nearly as much information as some people expect:

1) It doesn't reveal anything if the person you autofollowed doesn't have a public google profile.

2) It never reveals the email address to anyone who already didn't know it

3) It doesn't really reveal on what level you have any contact with the person, because an outside observer has no idea whether you autofollowed this person or chose to follow them. For example, about 50% of the people I'm following I've never emailed before (and I still don't know their email address even though I've communicated with them through Buzz now).

There are some privacy issues with Buzz, but more than anything its biggest failure is being confusing.

torial
I'd say the biggest failure is autoenrolling you, and then setting certain things public. Sure they could see my gtalk status, but I never set anything up to let my Reader be public, but it was by default. If I want people to know what I'm reading, I'll tell them!
lftl
This is one of the other points I think is confusing. What exactly is being shared out of reader? I use reader, I've got it linked to my profile, but when I view my profile as an anonymous user it just says no shared items. I never used the sharing feature of Reader before, so I really have no clue what it did previously. Is that was was shared automatically on enroll? I definitely don't see any way for anyone to see what feeds are in my reader.
csomar
Strange, Google asked me what feeds I want to include in Buzz and one of the feeds was Gtalk Status, so are you sure you didn't select this one (for me, it was unselected by default). If you didn't, then it become really serious.
torial
I ran into this -- thought I had opted out (turns out only of the tour), then because of this post, I check the Buzz settings. Reader and Gtalk statuses were shared by default. And I was already following others (presumably they were unaware their info was being shared).