I'm fully aware that the first thing a regulatory body will do, whether I go via the Financial Conduct Authority because they're a bank or the Information Commissioner's Officer because they misused my personal information, is tell me that I need to complain to the bank first and give them a chance to respond. So I have: I complained on the day that post went live, and they told me that they're looking into it and will get back to me within 8 weeks.
THEN we'll see about a complaint to the regulator! :-)
I would say you already did the first time it happened. Obviously they didn't actually fix it like they said they did, but this time they will, pinky-promise!
Original author here. Upon inspection, these passwords are clearly not chosen by the user and, as far as I can tell, consist only of numbers and uppercase letters.
I'm the original author (but not the poster here on HN).
Yeah, I considered that. I even wrote the code in such a way that it supports that. But I'm concerned about the legality of distributing it. Given that it hits API endpoints that were expected to be private to the developers' app, giving away a "tool" that bypasses the app (which hosts ads, albeit for their other products, and so serves as a money-maker for the app's owner) could be illegal.
At the very least, it could be a violation of the terms of service or just an annoyance to the app developer, either of which could lead them to trying to stop me from doing it, which would be an inconvenience. So maybe I'll wait until after the trip, when the page becomes useless to me, and THEN open-source it!
Hey, thanks for the follow up! That makes perfect sense to me. Personally, though, I was thinking more of a "competing service" than a "steal your content" kind of offering.
I know hosting an entire sign up process and user content is not something you can just build and forget about, so my thought was that a sufficiently decent website could bundle a package that could be hosted on existing organization infrastructure. A zip file of the user's content that they could upload to dropbox/drive/sharepoint/etc. Then the consumer page would match a url slug to a package file and serve the content that way.
It's... a lot of stuff for a quick workaround project. And it's a pathology of an engineer to make solutions where solutions aren't needed. So grain of salt on any of that. But I did want to clarify since you were willing to engage with the concept, as understood. Hopefully this proposition strikes you as less concerning/illegal! I never want to steal anyone's work or infrastructure. I just believe that better alternatives - even ones borne of seeing how badly other people are doing it - can and should win out, if people ever provide them.
I wanted to ask, why did you go with reverse-engineering using network traffic instead of decompiling the app locally and looking for endpoint definitions?
Post author here. Nope, I'm in the UK, and therefore covered by the DPA2018 (which is basically the copy-paste version of the GDPR that the UK government made post-Brexit).
Not sure that Google offer Takeout on Business Profiles. Businesses aren't often protected by the kinds of PII-protecting laws (GDPR etc.) that individuals are, and so tech companies are less-inclined to make tools to streamline bulk export of data.
So was the identity verification process you spoke about in the blog post for your personal account or your business profile?
If it was your personal account, I really don't see how a personal verification ends up on a business account. I'm not saying it's not possible, but it seems like it would introduce extremely bad data. I've verified my phone number, but (personal speculation) I doubt Google would want my number showing up on my employer's business profile.
If it was for your business account... I can see how that would be unexpected, but also the point of verifying that would I guess be to increase the level of trust that customers could have in the business based on it being verified, and I can see how that might lead to that number being public. It also sounds like this is what you did with Play too, and as a user I would expect that Play's company data aligns with data on Google Search.
I can empathise with the shock here, I've had people call me up from google searches and finding my number on my CV, but I am struggling to find a link here that doesn't make sense.
I wanted to take control of the Google Business Profile (back then: Google My Business) listing. To do that, Google asked for a phone number they could call. I provided one, and then double-checked that they hadn't put it on the public profile (they hadn't).
They emailed me about once a year after that to suggest that I might like to put a phone number on the business profile. I declined. But I always checked, and sure enough: they hadn't put one on there. All was good.
Then one day, randomly, my phone number started appearing on the public profile/being served to search users. That's the whole story here.
I don't yet know how or why it started appearing. A few ideas have been posed here and elsewhere, including:
1. Some runaway automated process at Google, trying to "fix" the absence of a business phone number, took the one that was previously used to ID the business contact. (Some folks seem to think that this is what I'm claiming happened, but I'm only putting it forward as a possibility.)
2. Google "joined the dots" from the Google Play profile and the Google Business Profile. This currently seems like the most-likely explanation, to me. I'm getting the former corrected anyway; we'll see what comes out of it.
3. Some third-party Google user added it. That seems possible, but in my experience once you've verified and own a Google Business Profile, you get an email to confirm any "suggested changes" and I didn't see any such email.
4. Some kind of user error by me or by somebody else who has access to the profile. I obviously can't rule this out, but I've checked and I personally haven't even logged into it in over a year (and I've had emails since that confirm that a phone number wasn't listed), so it seems unlikely. Also, the message said that Google had updated the phone number (not me).
This list seems reasonable, but I do think your blog post strongly implies (to the point of effectively stating it) that you believe (1) was what happened.
I have to be careful about what I say, and very much cannot say in this case, nor do I know anything specific to the business profile area, but my experience of data at Google is that one does not simply join a table and fill in the blanks. In my experience there's a lot of privacy and legal review, and that's only after someone thinks it would be a good product idea (which in this case feels unlikely). At a technical level, there are many safety checks that are intended to prevent things like this from happening unless all that review and sign-off has happened.
If I search my phone number on certain online white-page sites, every single house I've ever lived in for the last 25 years shows up in a list, along with a whole bunch of other very personal information (e.g. the people who lived in the same house at the same time).
Post author here. There shouldn't be one on the website (and I can't see one?), but the Google Play developer profile is unfortunate: thanks for pointing it out.
So what actually happened is you gave Google your phone number for the specific purpose of publishing it so customers of your business can contact you, and forgot. You should update your post so people aren't misled.
No, I gave my phone number to Google to gain access to Business Profile, as part of an identity verification process, and specifically didn't give them one to publish on the business listing. And they correctly didn't publish one. For 4+ years.
And then one day then decided to publish the one I'd given them for an identity check... in search results. I don't yet know why.
I don't believe the phone number in Google Play comes from Business Profile. Business Profile is a Maps thing. The way a phone number gets on the developer page of the Play Store is by you entering it into the Play Store developer console for that purpose.
Since it was published by you as public contact information for your business on Google, either a customer or one of the contractors Google employs to update phone numbers in Maps listings then added it to Maps.
Maps business listings are publicly editable and continuously updated by Google from any source they can find. Especially phone numbers. Google employs people to search the Internet all day long for business phone numbers to update on Maps. You published the number publicly, specifically listed as contact information for your business, on a Google site even. There is no mystery here.
Could be! My only counterpoint is that every time they've previously made a change, they've emailed to say so, and I've searched my email (including spam) and not found any such mention this time around. /shrug/
You still need to update your post to include the obviously relevant information that you explicitly gave Google this phone number for the specific purpose of publishing it as public contact information for your business.
You can set it up in the Twilio studio without having to write code. I'm not 100% positive, but I seem to remember there was a template for it and I just had to fill in the details
This is a fairly recent thing. I didn't realise that Google had actually started publishing this contact but for about the last year or so, they've required that you provide a phone number that they can publish for users to contact you.
Honestly, this policy seems absolutely backwards to me. I'm fine for customers to contact me via e-mail or my website, but why do Google get to suddenly mandate that I need to provide 24/7 global phone support to anyone (who doesn't even need to me my customer)?
My phone number is on my CV, and that's deliberate (I want a job!). It's in plenty of other places online too.
But none of them (except the Google Play one, which I'm fixing) are associated with the business or were provided for the purpose of sharing when people search for a business that I happen to be involved with!
(I'm sure you wouldn't want your phone number to turn up every time anybody searched for your employer, even if you were happy for your phone number to appear on your personal website, right?)
I'm not claiming that my personal phone number shouldn't be online anywhere. There are plenty of places it's pretty easy to find!
I'm just saying that I didn't put my personal phone number onto a public Business Profile (only providing it for identity verification, many years ago). But then, randomly, one day Google decided to start publishing it to anybody who searched for that company name.
Blog owner here. You're welcome to unblur it: I swapped the number out in the screenshot for one of Ofcom's list of official never-to-be-assigned telephone numbers for drama (e.g. film & TV) use (https://www.ofcom.org.uk/phones-and-broadband/phone-numbers/...) before I applied the blur.
That number isn't mine, and will never belong to anybody!
Blurring makes sense as a way to say "this is private". It's almost lampshading, in this case, because it's the bit I want you to look at!
But blurring doesn't make sense from a privacy perspective, because unblurring is pretty easy. So I modified the number to a known-fake, will-never-be-valid one.
But if I just did that, people would probably try to call it, or would say "but you've put it back online here", or similar. Or else would say "that number's fake anyway, why are you worried?". Blurring it as well achieved the best of all worlds: it lampshades the bit I'm talking about, and it indicates that the kind of data stored there should be considered private, and it prevents the actual extraction of the (real) private data from the image. Win, win, win.
Unless the question "why bother" was to imply that blurring was hard to do? Because it definitely wasn't. Changing the number took much more effort! The blur was just two clicks; significantly less effort than, say, explaining why I chose to do so! :-D
Often I'm lazy and just black out revealing information, like I did in my blog post about how British Gas can't understand my name (https://danq.me/it-is-only-q).
But sometimes I've done the same thing in other places and gone further, sometimes concealing "fun" messages. In my post about Halifax putting the wrong names on a letter to me (https://danq.me/halifax-dun-goofed), I changed my address to a message along the lines of "what, you think I'd put my actual address here, like it's my first day on the Internet" and then blurred that.
Incidentally, I think that one was the first times that anybody contacted me to say that they'd noticed the unblurrability of my images, but I've been using this approach for years!
Thanks for the shout-out! Even though I know it cheats (and how) I still play against Cheatman sometimes; the challenge is to make guesses that force the computer to bisect its search space into two approximately-even subdictionaries rather than - as it would prefer - splitting the search space into a smaller (rejected) one and a larger (adopted) one. It means thinking-ahead by about as many steps as there are undiscovered letters in the word, but it's just-about doable!
I'm fully aware that the first thing a regulatory body will do, whether I go via the Financial Conduct Authority because they're a bank or the Information Commissioner's Officer because they misused my personal information, is tell me that I need to complain to the bank first and give them a chance to respond. So I have: I complained on the day that post went live, and they told me that they're looking into it and will get back to me within 8 weeks.
THEN we'll see about a complaint to the regulator! :-)