

Tell HN: Warning, Google ignores opt-out for Buzz if you set an away message - yalurker

Well, my opinion of Buzz just did a 180.  When it first asked me to join I opted out and moved on.  I didn't see the big deal for privacy concerns, since I could easily opt out and never use it.<p>Today, I set a status message for google chat as an away message, and suddenly I was auto-enrolled into buzz.  My away message was published as a status update, I had followers auto configured, the whole deal.  I think I've successfully killed it now, but already my privacy has been lost (just the auto-follow behavior exposes who I chat/email with through gmail).<p>So a warning to other HN readers: be wary in using google chat status updates, or you may find yourself enabling buzz even after explicitly opting out.<p>And if anyone from google is reading this: No means no.  If you enable buzz after I explicitly say no, then you just buzz-raped your user.
======
carbon8
Out of curiosity, I just tried it on an account with an existing Google
Profile that doesn't have buzz set up and it did not add followers/followings
to the existing Google Profile. It added the status message to the buzz feed,
which isn't a privacy problem since contacts can see it anyway, but it did not
fully set up a buzz profile. Clicking on the Buzz status textarea brings up
the normal "How do you want to appear to others?" form and still won't let me
use Buzz without setting it up.

Also, I can't see the following/follower lists from another account; it just
shows the name, a link to the google profile and the fact that the two
accounts are following each other, but nothing about any other contacts. It
does, however, _appear_ that the profile is fully set up from within the
account, showing the follower/following lists, but outside accounts can't see
this info.

I also follow someone who hasn't created a Google profile or started using
Buzz. She changed her status message and it showed up in the Buzz feed, but
when I click on her name it goes to an empty Buzz profile view that says "This
person does not have a public profile." where the name usually is.

TL/DR: I looked at accounts both with and without an existing Google Profile
and although a status message change is posted to the Buzz feed, in neither
case did it fully sign the account up for Buzz nor did it expose contacts,
despite the fact that it looks like it does. YMMV, but probably not.

~~~
yalurker
Very good information. I didn't do any verification from outside accounts, I
just started immediately trying to stop/undo.

~~~
carbon8
Yeah, it's tremendously confusing. As far as I can tell, looking at it from
another account is the only way to know that the profile doesn't actually show
the following/follower information publicly. It really shouldn't require an
in-depth, multi-person investigation to figure out what's public and what
isn't.

------
jameskilton
So I've yet to create a Google public profile but I just saw a very disturbing
"feature" related to Buzz. To make sure that I was safe from Buzz, I enabled
it and unfollowed everyone it automatically made me follow, then turned it off
again.

But then I went to my Google Reader page, and my "People you follow" list was
now completely empty. Google has hooked up sharing between _everything_ with
Buzz, and that's not cool.

Wow. I'm starting to wonder if I should also start looking for alternatives.

~~~
natrius
Are you sure it automatically followed people you weren't already following on
Reader? If they were, the behavior makes sense.

------
scott_s
My understanding is that you did not opt out of Buzz. What you said "no" to
was taking the tour of Buzz - but you were still auto-enrolled. Hence the
fuss.

~~~
wgj
That's just as bad or worse, if a tech savvy user can come to this kind of
erroneous conclusion.

------
CoryMathews
This whole buzz thing has send me looking for a new email provider. If they so
eagerly give out all my contacts what else are they doing or whats next? The
last couple months have been enough for me to start my move away from google.

~~~
jhancock
If you come up with a short list of alternate email providers, please post as
I'm in the same boat for this and other reasons.

~~~
andrewcooke
see <http://news.ycombinator.com/item?id=1121269>

------
ekiru
That's odd. I even opted in for Buzz but never created a public profile due to
privacy concerns, and my chat status updates aren't be posted on Buzz(although
when I looked in the linked sites dialog to see if it should be, I noticed
that while Google Chat status updates were not linked, Picasa and Reader
were(conveniently, I don't use Picasa and I use Reader exclusively for
reading), although it said that they would not be actually linked until some
further step was taken).

------
aw3c2
I am so glad people finally start seeing Google for what it is. A huge evil
(at least explicetely not "do no evil") corporation with a dangerous market
majority on many things on the internet. Embrace alternatives!

~~~
buster
While the launch of buzz really is a big disaster, i still think most of the
errors that were made, were not because of a manager saying "hey, great, lets
publish all privacy information of our users to the internet, thats a great
business model!" (think of it, the users data is probably the most valuable
data an internet company has today). It looks to me, as if a team had a good
idea (yes, i think buzz as an idea is a good idea, the launch was not) but it
was not properly tested and thought of such cases. All in all it was released
far too early for far too many people. I still wonder why they didn't roll out
buzz on an invite only base like they did with gmail. All this negative press
could've been avoided and most people would be like "yay, thats cool!" without
the "oh shit"-effect.

But that attitude that google fucked up your privacy on intent is just stupid.
I agree, Googles power is scary: Think of it, google may control a lot of
users internet experience from end-to-end in the future
(ISP->Search->Mail->Mobile->Android->Netbooks+advertising = omg, scary!). They
will eventually end up being split into many companies if the trend continues.
But to say they fucked up your privacy on intent is just wrong, imo.

Thanks for the upcoming downvotes in advance, because i don't just repeat what
every little blog is already writing over and over again.

~~~
danudey

      > It looks to me, as if a team had a good idea (yes, i think buzz as an idea is a good idea,
      > the launch was not) but it was not properly tested and thought of such cases.
    

I agree wholeheartedly, which is why I feel they're evil. They believed that
their idea was a good one, and so forced it on everyone without bothered to
test it. Even if you don't attribute their mistakes to malice, the other
option is to concede that they were 'merely' careless and reckless with our
personal, private data.

My issue with Google isn't all the privacy issues around Buzz, it's that all
the privacy issues around Buzz came after no outside testing, and with no
choice on the end-user's part. They made a string of assumptions that turned
out to be false in a not-insignificant number of cases, because no one thought
'hey, maybe we should ask people before we give other people information about
them.'

~~~
buster
Yes, i agree. As i said, it would probably have been a good idea to start with
an invite-only beta stage. Still wondering why they didn't and why they didn't
think the use cases through, that's a shame. To me it feels, like some manager
wanted to push that software out before its time where i hoped google projects
wouldn't be as budget-driven and as marketing-driven as the whole rest of the
industry. Atleast not so much to produce such a disaster.

Although Google did some steps to open up in terms of what data they have on a
user, i hope this incident pushes them to be as open as possible with what
data of me they have and giving me more control over it.

------
lftl
I think the biggest failure of Buzz is how confusing it is. I think this is
one of the most misunderstood products that has ever been launched. I honestly
believe about 90% of the complaints we've seen are misunderstandings of how
Buzz works, and how the information that it sets up looks to other people.

For example, in my experience the autofollow doesn't reveal nearly as much
information as some people expect:

1) It doesn't reveal anything if the person you autofollowed doesn't have a
public google profile.

2) It never reveals the email address to anyone who already didn't know it

3) It doesn't really reveal on what level you have any contact with the
person, because an outside observer has no idea whether you autofollowed this
person or chose to follow them. For example, about 50% of the people I'm
following I've never emailed before (and I still don't know their email
address even though I've communicated with them through Buzz now).

There are some privacy issues with Buzz, but more than anything its biggest
failure is being confusing.

~~~
torial
I'd say the biggest failure is autoenrolling you, and then setting certain
things public. Sure they could see my gtalk status, but I never set anything
up to let my Reader be public, but it was by default. If I want people to know
what I'm reading, _I'll_ tell them!

~~~
lftl
This is one of the other points I think is confusing. What exactly is being
shared out of reader? I use reader, I've got it linked to my profile, but when
I view my profile as an anonymous user it just says no shared items. I never
used the sharing feature of Reader before, so I really have no clue what it
did previously. Is that was was shared automatically on enroll? I definitely
don't see any way for anyone to see what feeds are in my reader.

------
csomar
Strange, Google asked me what feeds I want to include in Buzz and one of the
feeds was Gtalk Status, so are you sure you didn't select this one (for me, it
was unselected by default). If you didn't, then it become really serious.

~~~
torial
I ran into this -- thought I had opted out (turns out only of the tour), then
because of this post, I check the Buzz settings. Reader and Gtalk statuses
were shared by default. And I was already following others (presumably they
were unaware their info was being shared).

------
fnid2
wow. i am so glad I haven't logged into any google products since they
launched this. I may create brand new accounts. I don't use gmail, thank
goodness!

I knew my reluctance to use Google products would pay dividends.

~~~
JeremyBanks
You seem very relived. Would this have actually directly negatively affected
you?

~~~
fnid2
Who knows? It has negatively affected others already.

~~~
JeremyBanks
Sure, but those were uncommon circumstances. I'm not denying that Google
deserves a ton of shit for this, but I don't think it's the kind of thing that
had much of a chance of negatively affecting the average user.

------
robotron
Doesn't this really belong in a bug report somewhere?

------
s3graham
I feel like the only person not pissed off about Buzz.

Email contacts might seed your connections, but I have followers and followees
that I've never spoken a private word to in person or via email.

Honest question: what information is it that people feel is leaking, other
than "I clicked 'Follow' on this person's profile"?

