Google Buzz: Privacy nightmare

[Cees Binkhorst]

REPLY TO: D66 at nic.surfnet.nl

I do /not/, however, like a product that bursts through my door like a
tornado and opts me in to wanton in-box clutter and spam (or, more
precisely, bacn <http://en.wikipedia.org/wiki/Bacn_%28electronic%29>)
publicly reveals my personal contact list without asking me, threatens
to broadcast my e-mail address anytime someone wants to @ me in a Buzz,
and even appears to grab photos off my Android phone that I've /never
uploaded/.

Vooral dat laatste is angstwekkend. Dat zou betekenen dat de gegevens op
je Android mobiel niet veilig zijn. En als Google het er af kan halen,
wie kan het dan nog meer?

Groet /Cees

http://news.cnet.com/8301-31322_3-10451428-256.html
February 10, 2010 5:48 PM PST
by Molly Wood <http://www.cnet.com/profile/mollywood/>

I know some of the technorati
<http://calacanis.com/2010/02/10/breaking-google-buzz-is-brilliant-facebook-just-lost-half-its-value/>

are losing their minds over the awesomeness that is Google Buzz
<http://news.cnet.com/8301-30684_3-10449662-265.html>, but I think that
Google's making a lot of Facebook's privacy and opt-in mistakes right
out of the gate, and it's going to bite it big-time, if it doesn't fix
it pronto.

I, for one, have already opted out of the entire endeavor.

Those seven people are really important to me. That's why I turned this
thing off.

See, I love the idea of neat new tech innovations that lead to
streamlined communication, real-time updating, in-line video and photo
posting, and supersimple friend and contact integration. I do /not/,
however, like a product that bursts through my door like a tornado and
opts me in to wanton in-box clutter and spam (or, more precisely, bacn
<http://en.wikipedia.org/wiki/Bacn_%28electronic%29>) publicly reveals
my personal contact list without asking me, threatens to broadcast my
e-mail address anytime someone wants to @ me in a Buzz, and even appears
to grab photos off my Android phone that I've /never uploaded/.

That, right there, is bad behavior, and given all the hue and cry about
Facebook's inexorable attempts to expose everything
<http://www.pcworld.com/article/185033/facebook_privacy_complaint_ignites_war_of_words.html>

about its users to the entire world, Google ought to know better.

Seriously, Google. Would it have killed you to add a "configure" step to
this process?

When you visit Google Buzz <http://www.google.com/buzz>, you're invited
to "Try Buzz in Gmail," with "no setup needed." But the no-setup thing
isn't the bonus you might be led to believe.

First, you automatically follow everyone in your Gmail contact list, and
that information is publicly available in your profile, by default, to
everyone who visits your profile. It's available with helpful "follow"
links too--wow, you can expand your Buzz network /so fast/ by harvesting
the personal contact lists of other people!

To hide the list of followers/followees from your profile page, you have
to click Edit Profile
<http://www.google.com/profiles/me/editprofile?edit=t#about> and uncheck
the box next to Display the list of people I'm following and people
following me. Why that option isn't obvious on the Buzz page
itself--well, decide for yourself.

On top of that, let's say you've customized your Google profile page
with the vanity URL Google helpfully offers at the bottom of the page.
Well, that'd be your e-mail handle. Anytime anyone does an @ reply to
you, they've broadcast your e-mail address to the world.

Now, I know Gmail is in fairly wide use in business environments, but
it's also most commonly used for personal e-mail. We've gotten
comfortable with handing out usernames of all stripes across social
networks, but the personal e-mail address used to be somewhat
sacred--until Google Buzz came along.

Plus, and maybe this is specious, but it really bugged me: when I
enabled Google Buzz, it was using a photo on my personal Buzz page (not
my profile or anything) that I'd taken on my Droid but hadn't ever
uploaded. Why? And why that photo? And--what? That's just creepy as hell.

But it's less creepy than the mobile privacy
<http://blogs.computerworld.com/15559/google_buzz_and_you_thought_firefox_had_privacy_issues>.

I will say, thank goodness, at least Google Buzz doesn't opt you in to
this creepiest feature of all: revealing your location by exact address.
When you first visit the mobile app on your Android phone and attempt to
post something, you'll be asked whether you want to Share Location or
Decline. The "Remember this Preference" box is prechecked too, so be
sure you're ready to have everyone know right where you are, whenever
you post to Buzz. At minimum, uncheck the Remember button so you can
decide whether to reveal your location post by post.

No offense, but please don't come visit me.

I'm sure that a lot of Foursquare <http://foursquare.com/> fans will
happily share away. But Buzz also displays buzzes from people near your
location--and identifies them, as well--by exact address. And there are
no preferences in the Android app--no way, near as I can tell--to choose
to broadcast only to the list of people you follow or a group you've
established, as you can in the Web interface. So be equally prepared for
everyone around you to know who you are and where you are when you post
to Buzz from your phone. Yeah, no, really. I'm totally not making this up.

Now, before you get your angry Buzz on, yes. I know. I know I can
unfollow people to protect their privacy (and mine). I know I can use an
annoying string of numbers instead of my username to protect my e-mail
address. I know I don't have to enable location awareness. I know I can,
as I mentioned, post privately and not publicly. But /none/ of that is
the default, meaning that when I sign up for Google Buzz, assuming that
I even know that this massive overshare is about to happen, /all/ of
those "features" will have to be turned off, one by one, in a confusing
and vaguely annoying interface, and I can't do it on my phone. And that
is crap.

I know Google's modus operandi is that it is coming to us from the
future--the future where there are no applications, there is only the
Web
<http://www.google.com/search?hl=en&rlz=1C1GGLS_enUS304US304&q=chrome+os+no+applications&aq=f&aqi=g10&oq=>,

there's no need for printer drivers
<http://www.geek.com/articles/news/google-chrome-os-will-revolutionize-how-printer-drivers-are-handled-but-not-in-2010-2009122/>,

and there's no expectation of privacy
<http://news.cnet.com/8301-1023_3-10166532-93.html> when it comes to
taking pictures of your house for all to see, or you scratching your bum
on the street. And wow, what a brave new world that is.

But I /do/ have an expectation of privacy when it comes to my e-mail,
and I think that even in this age of social-networking TMI, most people
still think of e-mail as a safe place for speaking privately with
friends and family. And for Google to come along and broadcast that
network to the world without asking first--and force you to turn it off
after the fact--is, I think, both shocking and unacceptable.

I will not re-enable or recommend Google Buzz until it has a
brand-spanking-new configuration screen at start-up, with yes or no
options like, "automatically follow all contacts?" and "display list of
people I'm following and who follow me?" and "use e-mail handle as
Google Buzz username?" as well as privacy options in the mobile
interface that include "broadcast to nearby users?"

And I wouldn't mind one that lets me opt out of Buzz /putting all that
crap in my in-box/, too. Without that, I think that only the savviest or
least public of users should even bother to play with Google Buzz
(which, let's be honest, is a redundant and limited thing, anyway, and
relies on everyone in your life using Gmail, which, really, is kind of a
lot to ask, especially when we already have Facebook).

**********
Dit bericht is verzonden via de informele D66 discussielijst (D66 at nic.surfnet.nl).
Aanmelden: stuur een email naar LISTSERV at nic.surfnet.nl met in het tekstveld alleen: SUBSCRIBE D66 uwvoornaam uwachternaam
Afmelden: stuur een email naar LISTSERV at nic.surfnet.nl met in het tekstveld alleen: SIGNOFF D66
Het on-line archief is te vinden op: http://listserv.surfnet.nl/archives/d66.html
**********