Comment by blakeross | Hacker News Reader

Comment by blakeross | Hacker News Reader

Parent Full thread

Hey all,

I work at Facebook, but this is not an official media statement.

This doesn't appear to be a Facebook bug that leaks anyone's private email address. It appears that all the examples indexed in Google exist in Google because they were already published publicly on other Internet sites. We're committing a fix right now to stop indexing this page in Google, but even that wouldn't prevent email addresses from being published because it appears that users are already republishing their addresses in other non-Facebook venues.

For example, if you see http://www.facebook.com/o.php?k=afc4a7&u=1018862530&... in isolation, it appears to be divulging private information.

However, the original Facebook email that links to that page and contains the user's email address was republished publicly on a mailing list archive by the owner of the email address: http://games.dir.groups.yahoo.com/group/Living_Greyhawk/mess...

Does anyone see an example where this is not the case that constitutes a privacy leak?

Blake Ross

Furthermore, the author of the blog post in question republished his own Facebook email on http://corywatilo.com/reminder-cory-invited-you-to-join-face...

Although his email opt-out link has been edited out of that email (see "please clic to unsubscribe." at the bottom), it appears that the email was originally published to Posterous in its entirety via his iPhone and then edited later, after it was picked up by Google.

(Update: The author of the original blog post acknowledges this below.)

Good point. That blog post has a link "to sign up for facebook", and when you click on it, it reveals the gmail address of the user (which is something @gmail.com). At least that answers the question of how Google found it.

This is possible. +1 Blake

Would be nice for FB to exclude that page from getting indexed though.

Thanks for the acknowledgment Cory. FYI, we collaborated with Google and these pages are no longer indexed as an extra precaution:

http://www.google.com/search?q=site%3Afacebook.com%2Fo.php

Blake,

Thanks for following up. My personal email address is indexed, but is nowhere else on the internet. Shoot me an email at hi@corywatilo.com and I'll give you the address.

Hi Cory -

Can you see my response below regarding Posterous?

Also, it does appear that your email address is available on the Internet, e.g. http://groups.google.com/groups/profile?enc_user=nBw3lBQAAAA...

Thanks, Blake

Wow, I didn't even know that was out there. But, it doesn't look like Google indexes those.

Google doesn't index ... Google Groups?

The mail address is truncated, and the real information is hidden behind a captcha.

Listen, this isn't the point.

The point is that Facebook should be responsible for protecting their own indexing vectors.

Plain and simple.

Sorry, but it is a Facebook bug. Facebook could've easily instructed google not to index these pages.

It wouldn't have mattered. The user republished a Facebook email on a non-Facebook venue (such as a public mailing list archive), thus exposing their email address. See, for instance, http://groups.yahoo.com/group/salemwhitemagic/message/89

That's a lame excuse and as corywatilo has pointed out is untrue (at least for his email... and probably others).

There is no way for Google to find those pages unless those pages are linked from somewhere else or Google is getting URLs from users' browsing activity. The first scenario makes this relatively harmless. The second makes it a privacy issue on Google's end.

Even so, why put private details on a publicly accessible page?

That page has to be publicly accessible. It is sent to users without Facebook accounts. It doesn't need to be indexed, but it's not the huge bug people are making it out to be. It's a tiny bug.

I understand that the page has to be public, but why include the email address there? The person who received the link knows what email address it applies to. Every opt out/unsubscribe page I've used didn't display my email.

> The person who received the link knows what email address it applies to.

No they don't. Plenty of people have multiple email addresses forward to one account. Showing the email address helps, and it's harmless unless people post the link somewhere else on the internet.

Maybe a better term would be oversight.

Reply on news.ycombinator.com