Dan-Q

Original author here. Upon inspection, these passwords are clearly not chosen by the user and, as far as I can tell, consist only of numbers and uppercase letters.

I'm the original author (but not the poster here on HN).

Yeah, I considered that. I even wrote the code in such a way that it supports that. But I'm concerned about the legality of distributing it. Given that it hits API endpoints that were expected to be private to the developers' app, giving away a "tool" that bypasses the app (which hosts ads, albeit for their other products, and so serves as a money-maker for the app's owner) could be illegal.

At the very least, it could be a violation of the terms of service or just an annoyance to the app developer, either of which could lead them to trying to stop me from doing it, which would be an inconvenience. So maybe I'll wait until after the trip, when the page becomes useless to me, and THEN open-source it!

Often I'm lazy and just black out revealing information, like I did in my blog post about how British Gas can't understand my name (https://danq.me/it-is-only-q).

But sometimes I've done the same thing in other places and gone further, sometimes concealing "fun" messages. In my post about Halifax putting the wrong names on a letter to me (https://danq.me/halifax-dun-goofed), I changed my address to a message along the lines of "what, you think I'd put my actual address here, like it's my first day on the Internet" and then blurred that.

Incidentally, I think that one was the first times that anybody contacted me to say that they'd noticed the unblurrability of my images, but I've been using this approach for years!

Yeah, it was a bad metaphor. I was sleepy.

Blurring makes sense as a way to say "this is private". It's almost lampshading, in this case, because it's the bit I want you to look at!

But blurring doesn't make sense from a privacy perspective, because unblurring is pretty easy. So I modified the number to a known-fake, will-never-be-valid one.

But if I just did that, people would probably try to call it, or would say "but you've put it back online here", or similar. Or else would say "that number's fake anyway, why are you worried?". Blurring it as well achieved the best of all worlds: it lampshades the bit I'm talking about, and it indicates that the kind of data stored there should be considered private, and it prevents the actual extraction of the (real) private data from the image. Win, win, win.

Unless the question "why bother" was to imply that blurring was hard to do? Because it definitely wasn't. Changing the number took much more effort! The blur was just two clicks; significantly less effort than, say, explaining why I chose to do so! :-D

Could be! My only counterpoint is that every time they've previously made a change, they've emailed to say so, and I've searched my email (including spam) and not found any such mention this time around. /shrug/

Sorry, I got mixed-up between this and another thread. You're right, the Google Play one was provided separately (and has now been corrected).

My post was about the Business Profile one. Which started (seemingly randomly) containing the same phone number.

To indicate to the reader that the information represented by this area of the image should be considered private.

It's like how they blur nipples on TV. We all know what nipples look like! But they're blurred to say "yeah, but maybe you shouldn't be looking".

For the business account.

I wanted to take control of the Google Business Profile (back then: Google My Business) listing. To do that, Google asked for a phone number they could call. I provided one, and then double-checked that they hadn't put it on the public profile (they hadn't).

They emailed me about once a year after that to suggest that I might like to put a phone number on the business profile. I declined. But I always checked, and sure enough: they hadn't put one on there. All was good.

Then one day, randomly, my phone number started appearing on the public profile/being served to search users. That's the whole story here.

I don't yet know how or why it started appearing. A few ideas have been posed here and elsewhere, including:

1. Some runaway automated process at Google, trying to "fix" the absence of a business phone number, took the one that was previously used to ID the business contact. (Some folks seem to think that this is what I'm claiming happened, but I'm only putting it forward as a possibility.)

2. Google "joined the dots" from the Google Play profile and the Google Business Profile. This currently seems like the most-likely explanation, to me. I'm getting the former corrected anyway; we'll see what comes out of it.

3. Some third-party Google user added it. That seems possible, but in my experience once you've verified and own a Google Business Profile, you get an email to confirm any "suggested changes" and I didn't see any such email.

4. Some kind of user error by me or by somebody else who has access to the profile. I obviously can't rule this out, but I've checked and I personally haven't even logged into it in over a year (and I've had emails since that confirm that a phone number wasn't listed), so it seems unlikely. Also, the message said that Google had updated the phone number (not me).

Sure. But I still don't think it covers Business Profile. But I'll check.

My phone number is on my CV, and that's deliberate (I want a job!). It's in plenty of other places online too.

But none of them (except the Google Play one, which I'm fixing) are associated with the business or were provided for the purpose of sharing when people search for a business that I happen to be involved with!

(I'm sure you wouldn't want your phone number to turn up every time anybody searched for your employer, even if you were happy for your phone number to appear on your personal website, right?)

Yes, there is.

I'm not claiming that my personal phone number shouldn't be online anywhere. There are plenty of places it's pretty easy to find!

I'm just saying that I didn't put my personal phone number onto a public Business Profile (only providing it for identity verification, many years ago). But then, randomly, one day Google decided to start publishing it to anybody who searched for that company name.

No, I gave my phone number to Google to gain access to Business Profile, as part of an identity verification process, and specifically didn't give them one to publish on the business listing. And they correctly didn't publish one. For 4+ years.

And then one day then decided to publish the one I'd given them for an identity check... in search results. I don't yet know why.

Post author here. Nope, I'm in the UK, and therefore covered by the DPA2018 (which is basically the copy-paste version of the GDPR that the UK government made post-Brexit).

Not sure that Google offer Takeout on Business Profiles. Businesses aren't often protected by the kinds of PII-protecting laws (GDPR etc.) that individuals are, and so tech companies are less-inclined to make tools to streamline bulk export of data.

Post author here. There shouldn't be one on the website (and I can't see one?), but the Google Play developer profile is unfortunate: thanks for pointing it out.

Blog owner here. You're welcome to unblur it: I swapped the number out in the screenshot for one of Ofcom's list of official never-to-be-assigned telephone numbers for drama (e.g. film & TV) use (https://www.ofcom.org.uk/phones-and-broadband/phone-numbers/...) before I applied the blur.

That number isn't mine, and will never belong to anybody!

No JS on that page either!

Thanks; I hadn't noticed that. It's a side-effect from some terrible CMS plugin I thought I'd disabled. Fixing it now.

Edit: Fixed! Thanks again!

Thanks for the shout-out! Even though I know it cheats (and how) I still play against Cheatman sometimes; the challenge is to make guesses that force the computer to bisect its search space into two approximately-even subdictionaries rather than - as it would prefer - splitting the search space into a smaller (rejected) one and a larger (adopted) one. It means thinking-ahead by about as many steps as there are undiscovered letters in the word, but it's just-about doable!