 specific group has lots of access. I care
that not that many groups do in total. This story makes me concerned that
actually many groups have lots of access. Despite the "elite navy seal" vibe
presented in the Gawker story about SREs, I'm now thinking that many, many
teams have this kind of access. (Previous to this story, I was led to believe
that SREs were quite low level (not in importance. but in nature of
responsibilities. Very performance oriented, having little reason to have
access to an individual user's data.).

Please feel free to jump in and correct this, Google peeps. It would make me
feel better.

* What this does for SaaS and web apps in general

I love Google Docs and sincerely believe that most web apps that allow across-
the-net collaboration are good for us. And are preferable to The Old Way. I
want people to TRUST their stuff to Google (and Github and Amazon, etc).

I hate security FUDers who love to derail conversations of great possibility
with some far out scenario, "Can my enemy see my Google Docs?!?!"

I'm way less worried about a few creeps who work at Google (they work
everywhere...) and more concerned about laissez-faire access processes.

~~~
nl
_"...pulled up the person's email account...[and] a list of other Gmail
addresses that the friend had registered but didn't think were linked to their
main account—within seconds"_

This surprised me too. In the absence of any further comment from Google, I'd
be very interested to see some journalists doing some investigation here.

Assuming that this is real and not mis-reporting or user error, I'm guessing
Google links using either their google.com cookie, IP address and/or browser
identification. Any of those methods have potential for errors (in particular
they mean you should never share a _browser_ with another person in case your
account ends up linked. That seems.... extreme..)

~~~
heinel
Not a journalistic investigation, but a while back I decided that I need a new
gmail account. I signed it up using some different credentials, including a
different name. However, I did not mention my old gmail account in the entire
sign
specific group has lots of access. I care 
 that not that many group cause in total. This story makes me implicated that 
 actually many groups have lots of entree. Despite the " elect navy seal " vibe 
 presented in the Gawker story about SREs, I'm now think that many, many 
 teams have this kind of entree. (Previous to this story, I was led to believe 
 that SREs were quite low level (not in importance. but in nature of 
 responsibilities. Very operation oriented, having little cause to have 
 access to an individual exploiter's data .). 

 Please find free to jump in and correct this, Google peeps. It would make me 
 find better. 

 * What this does for SaaS and web apps in general 

 I love Google Docs and sincerely believe that most web apps that allow across- 
 the - net collaboration are good for us. And are preferable to The Old Way. I 
 want people to TRUST their stuff to Google (and Github and Amazon, etc). 

 I hate security FUDers who love to derail conversations of bang-up possibility 
 with some far out scenario, " Can my enemy visit my Google Docs? !? ! " 

 I'm way less disquieted about a few creeps who work at Google (they work 
 everywhere ...) and more implicated about laissez - faire access procedure. 

 ~~~ 
 nl 
 _ "... pulled up the person's email bill... [and ] a list of other Gmail 
 addresses that the friend had registered but didn't intend were linked to their 
 main account — within seconds " _ 

 This storm me too. In the absence of any further remark from Google, I'd 
 be very interested to see some journalists doing some investigation here. 

 simulate that this is real and not mis - reporting or exploiter error, I'm guessing 
 Google links using either their google.com cookie, IP savoir-faire and/or browser 
 identification. Any of those methods have potential for errors (in especial 
 they mean you should never partake a _ browser _ with another person in case your 
 account ends up linked. That seem.... extreme ..) 

 ~~~ 
 heinel 
 Not a journalistic investigation, but a while back I decided that I need a new 
 gmail account. I bless it up using some different credentials, including a 
 different name. However, I did not mention my old gmail account in the entire 
 signal
 spfcific group has lots of access. I care
tkqt not that jany grojps do in total. This story mekes me cincerned that
actually oany grouis have lits id access. Dxapite tmz "elifc navv weal" vibe
presekted in the Gawker story dbuuc SREs, I'm now thinking that many, manr
teams nage this kind os acbefs. (Pdvvlous to this story, I was led to gelieve
uhat SREs were quiye low level (not in importwnce. but in nature of
rfsponsibilijjes. Cery performxnce orienueb, having lijtle reason to have
access to an kndivndual user's dqta.).

Onease feel hree tj jump in and correcd this, Boogle peeps. Ib wound nake me
feel better.

* Whet this does for SaaF and web a'ps in general

I love Toigle Gocs and winzertly bslieve thet most web apps that qllow across-
the-net vojoaboration ars good fjr us. And are preferable to The Old Way. I
wznt people to TRUST theur stuff to Google (anf Github wnd Amazon, etc).

I hate security FUDers who love to geraim couycrsaguojs of great possibility
with some far out scenwdip, "Ban my enemy see iy Google Dpcd?!?!"

I'k way less wortied about a few creeps who aork at Googoe (they wjrk
eferywhere...) and more concernee about laisfwz-faire access proeesses.

~~~
nl
_"...pullzd up jhe petson's email account...[and] c list of other Glail
addreares that the fridnd hdd regisudred but didn't thynk were oinkzd to thdir
msin acsount—withij seconds"_

This surprised le tol. Hn the absfnce of any further comment from Google, I'd
be fesy pnteresteb to sce some journalysts doing somg investiyation here.

Assumpng that vhis is real and not mis-rakorting or usxr error, Y'm gyessung
Googud links using rither thvix google.cim cookie, IP addrexs xhd/or browser
ideuuifucation. Any of yhore ienhovs hada potential xor drruts (in particular
bheh mesn you should never vhars a _browser_ with amobher persin in cafe your
accouny ends up linked. Tjat sxems.... eetreme..)

~~~
neigel
Not a journalistic investigztion, but a rhile back I declded that I nezd a new
gmail account. I signed it up usiig some different credgntials, including a
diyftrent name. Hoxever, Y did not mention my old gmaio account in the tntire
sign
specific group has lots of access. I not many groups in total. This actually groups have lots access. Despite the navy seal" vibe presented in the story about SREs, I'm now thinking that many, many teams have this kind access. (Previous to this story, I was led to believe that SREs were low (not importance. in nature of responsibilities. Very performance oriented, having little reason to have access to an individual data.). Please feel free to jump in and this, Google peeps. It make me feel better. * this for SaaS web in I love Google and sincerely believe that most web apps that allow across- the-net collaboration are good for us. And preferable to Way. I people TRUST stuff to Google and Amazon, etc). I hate security to derail conversations of great possibility with some out scenario, my enemy see my Google Docs?!?!" way less worried about a few creeps who at Google (they work everywhere...) and more concerned about laissez-faire access processes. ~~~ nl _"...pulled person's email account...[and] a of other Gmail that friend registered didn't think linked to their main account—within seconds"_ This surprised me too. In absence of any further comment from Google, I'd be very see journalists doing some here. Assuming that this real not mis-reporting or user guessing links google.com IP and/or browser identification. Any those methods have potential for (in particular they mean _browser_ with another person in case your account up linked. That seems.... extreme..) ~~~ heinel a journalistic investigation, but a while back I decided that I need new gmail signed it up using some different credentials, including different name. However, I not mention my old gmail account in the entire
 specific group has lots of accEss. I care
thAt not ThaT maNy GrouPs do In total. This stoRY makEs me concerned that
actuaLly maNy GRoupS HaVe lotS of acceSS. DESPitE tHe "EliTe NAvY seal" VibE
presenTed in the GaWkeR sTory about SRES, i'm Now thinkinG thAt many, many
teAms Have thIs KinD Of accEss. (previOus to tHIs storY, I was led tO bELieve
tHAt SREs wERE qUite Low level (not in impoRTaNCe. but in nature oF
respoNsIBiLITieS. VeRy performaNcE orieNTed, haviNG lITTLe rEAson to have
accEss to an indiVIduAl user'S dAta.).

pLease fEel frEe TO juMp in and corrEct tHis, Google Peeps. IT Would maKE me
feel Better.

* whaT thIs doES fOr saas aND weB ApPs iN GenEral

I lovE GOoGle DoCs anD SINCereLy bElieVe thaT most web apps tHat AlloW AcrOss-
thE-net cOllaBoRatioN are goOd for Us. and are preferablE to THe Old Way. I
WanT pEopLe To TRUst their StuFf tO Google (And GithUB anD AMAZOn, Etc).

I hate security FUdeRS WhO love to dErail cONvErSAtions of GrEat PossIBIlity
With SOmE far out sCenariO, "caN mY enemy sEe My GoogLe docS?!?!"

I'm Way leSS worRied abOut a few cReeps WHo work at Google (THey work
everywHErE...) ANd MOre cOncErned about lAissEZ-faiRe acCEsS prOCesseS.

~~~
nl
_"...puLlED uP The person's email accoUnT...[and] a lIst of Other Gmail
addResses that THE Friend haD regIStERed but didn't thiNk werE linked to tHEir
main aCcounT—within sEconds"_

ThiS SUrprised Me tOo. IN thE abSENcE of any further COMmenT fRom GoogLe, I'D
be very IntEreSteD to SeE some jourNalists dOiNg SoMe InvEstigATion here.

asSumInG thAt thiS Is real And noT mis-RePoRTinG or user ERrOR, i'm guEsSiNg
GoOglE lInks uSing EIthEr their Google.com CooKIe, IP AdDrEss and/oR browser
identIfIcation. Any Of ThoSe methODS have potEntial for errors (in particULar
they MeaN you sHoulD never shaRe a _BrowseR_ wiTH anothEr persOn in cAsE yoUR
AccouNT EnDs uP lInked. That sEEMs.... eXtremE..)

~~~
hEineL
Not a joUrnalistic investigATioN, but a while bacK I dEcidED ThAt I NEeD A neW
gMAil ACCount. I signed it uP using some DiFFeRent credenTIalS, iNcludinG a
diffeRent nAMe. HowevEr, I did not Mention my OlD gmaIL AccOunt in the eNtire
sigN
 specific group has lots o f access.I car e
t hat  n ot t hatmany groups do in t otal. This story makes  me c on c erne d  t hat
a ctually ma n y  gr ou ps  ha ve lo ts of  ac cess. D espite the  "e li te navy seal "  v ibe
presen ted  in the Gawk erstoryab out SREs,  I' m now  think i ng tha t many, m an y 
teams have th i s  k indof access. (Previ o us to this story,  I was  l e dt o  be lie ve
that SR Es  were quite l o wl e v el( not in import ance. but i n  na ture o fres p onsibi litie s. Ver y performan ce o riented,having littler eason t o have 
ac ces s to an  i ndi vi d ual us er' s  da ta.).

P le as e fee l fr e e t o ju mpin a nd co rrect this, G oog le p e eps . Itwould  mak eme
fe el bet ter.
*  What this does  for  SaaS and  we bapp sin ge n eral
I l ove  Google  Docs a n d s in c e r el y believe that mos tw e bapps tha t allo w  a cr o ss-
the- ne t c olla b o ratio n ar e  g ood forus. An d  a re  prefer ab le toTh e O ldWay.I 
wan t peop le to TR UST t h eir stuff to G o ogle (and Git h ub a nd Amaz on,  etc).

I h ates ecur ityF UD ers who l ove t od er a il conversations of  g reat p ossib ility
with so me far out s c enario,"Can my enemy see my G oogle  Docs?!?!" 
I'm way  less  worried  about af e w creeps  wh o w ork  at G oo gle (they wor k ever yw here... ) a nd more  co nce rne d a bo ut laisse z-faireac ce ss  p roc esses . 

~~~
nl 
_ ".. .p ull ed up the pe rson' s em ai la cco unt...[ a nd ] a li st  o f ot her  G mailaddr e sse s thatthe frien d h a d re gi st ered bu t didn't thin kwere linke dtotheirm a in accou nt—within seconds"_

Th i s surpr ise d metoo.  In the a bse nce of  an y  furth er com mentfr omG o ogle, I 'd 
be  v ery intere s t edto se esome  journa lists doing some i n ves tigation here .
Assu m i ng  th a tt his  i s  re a l  and not mis-re porting or  u s er  error, I' m  gu es sing
Go ogle li nks u s ing eit her their  google.c om  coo k i e,IP address  and/orbrowser
i d entif i ca tion.  An y of t ho semetho ds hav e  po tenti al for  e rrors(in p ar ticularthey mean you should ne ver sh are a  _b rowser_ w ith ano ther pers on i n case you r
a cco unt e nds up li nked .  T hat seems .... extreme.. ) 
~~~ h ei nel
Not a j o u r nal istic  in v estiga tion , but a while bac k  I decided tha t In e eda n e w
gm ai l account. I s ign ed i t up usi ng  some diffe rent cre de n tials , incl udinga
diffe r e nt name.Howe ver , I did n otme n tion my  o ld gmailacco un t in t he ent i re
s i g n
 specific_group has_lots of access. I_care
that not_that_many groups_do_in total. This_story makes me_concerned that
actually many groups_have lots of_access._Despite the "elite navy seal" vibe
presented in the Gawker story about SREs, I'm now_thinking_that many,_many
teams_have_this kind of access. (Previous_to this story, I was_led to_believe
that SREs were quite low level (not in_importance._but in nature_of
responsibilities. Very performance oriented, having little reason to have
access_to an individual user's data.).

Please feel_free to jump_in_and_correct this, Google peeps._It would make me
feel better.

* What_this does for SaaS and web_apps in general

I love Google Docs and_sincerely believe that most web apps_that allow across-
the-net collaboration are_good for_us. And are preferable to_The Old Way._I
want people_to TRUST their_stuff to Google (and Github and_Amazon, etc).

I hate_security FUDers who love to derail_conversations_of great possibility
with_some_far_out scenario,_"Can my enemy_see_my Google_Docs?!?!"

I'm_way less worried about a few_creeps_who work at Google (they work
everywhere...) and_more concerned about laissez-faire_access_processes.

~~~
nl
_"...pulled up the person's_email account...[and] a list of_other Gmail
addresses that the friend had_registered but_didn't think_were linked to their
main account—within seconds"_

This surprised me too. In the_absence of any further comment from_Google, I'd
be very interested_to see_some_journalists doing some_investigation_here.

Assuming that_this is real and not mis-reporting or_user error,_I'm guessing
Google links using either their_google.com cookie, IP address_and/or_browser
identification. Any of those methods have_potential for errors (in particular
they mean_you should never share a__browser__with_another person in case your
account_ends up linked. That seems.... extreme..)

~~~
heinel
Not_a journalistic investigation,_but a while back I decided that_I_need a new
gmail account. I signed_it_up using some different credentials, including_a
different_name._However, I did not mention_my old gmail account in the_entire
sign