Hacker News Reader

Comment by jacquesm | Hacker News Reader

So, whitelisted partners get the ability to rip your data?

I'm sure that will go down just fine. FB just got into a lot of trouble over something like that (arguably a lot more serious, but still).

View on HN

They also state in the same Twitter thread that they were aware of the issue before the blog post was written. IANAL but even if the shutdown was intentional (as opposed to being the example of terrible damage control it looks like), willfully leaving a bug in production that allows a set of whitelisted partners to deanonymize their visitors without their consent seems like something that shouldn't fly in countries with data protection laws?

I just received a message back on Twitter saying that the whitelist wasn't the fix and they are still making more changes.

This is seriously denting my continued belief in Google's security chops. I know they have some of the finest security researchers on the planet but this was handled in a ham-fisted and ineffective way so far.

And best of all: without 'partner' status you won't be able to check if has been fixed.

>This is seriously denting my continued belief in Google's security chops. I know they have some of the finest security researchers on the planet but this was handled in a ham-fisted and ineffective way so far.

This is a great demonstration how a company can have all of the right talent but still manage to become incompetent through poor organizational policies.

Lets hope it doesn't happen again.

It would be fine if they only gave whitelist access to people who could already simply access your data by request. But GDPR would only require that they know who could access, and that the access list be less than "the entire world".

Just wait a couple of weeks until GDPR takes effect

Reply on news.ycombinator.com