Google+ leaks connections between personae

[alexbayleaf]

Crosspost from G+, here, because this seems like it could be of particular interest to DW people and especially fannish people...


Well now that's interesting. People with multiple gmail accounts (especially for distinct personae), take note.

The other day I created a new gmail account, more or less to name-squat the name, but had no plans to use it immediately. I had not sent any email from it, had not signed up for anything with it, had quite simply not done anything with it. It was a completely pristine gmail account.

Today I logged in to mess with the settings and start using it. Along with the three standard welcome messages I expected to find in my inbox, I also found that my new account had received a G+ share-via-email/invitation to join. This was from a friend (+Andrew Pam), who did not know about my new account, resharing a #nymwars post. It was extremely disconcerting to find something that I might have expected to find on my "K Robert" account show up on this new one.

So somewhere in the depths of G+, it's associating multiple gmail accounts owned by the same person, and cross-recommending them to people you might know. The only thing I can figure out that might connect those accounts is the backup email address or phone number I gave at registration time. I must say, I'm not too happy if Google is implicitly leaking this connection, when it asked for the backup emai and phone number just for account verification/recovery purposes.

Comments

[copracat]

This is not new. Sometime in the last 18 months a friend of mine created a gmail pseud account to sign on to support sites for her medical condition. She didn't want to use her wallet name email, understandably. She found her wallet name email profile name attached to her gmail pseud account in emails and was a bit surprised. Not in the good way.

I imagine it's because she used the same recovery email for both.

[rainbow]

i specifically don't use recovery emails (or at least not the same ones) between accts i don't want to ever have connected, nor do i add in phone numbers, etc. if they require a zip code, i use my previous one, not my current one (i'm an abuse survivor and have been stalked before. i have *cough* a few privacy issues...)

i learnt the hard way many years ago that many web sites do use them to track and connect and ... well. there you go. :/ (iirc it was yahoo and ... argh, i can remember the other one. hotmail, maybe? that i ran into that issue with. it was in the late 90s, so if they were around then, it was probably those 2).

sometimes deleting the info *and putting in new info* (rather than leaving the field blank) is effective to break the connection. not always, and i don't know if it works iwth google.

[tuzemi]

Another thing that may connect them is seeing logins from the same IP address. Since most people have a NAT box at home, it only takes two different devices checking different email addresses from the same home network to create a link between them.

If that doesn't work, the fact that Google owns DoubleClick is definitely enough to link up multiple accounts. At some point you will log out of one account and log into the other from the same browser, with one DoubleClick cookie to tie them together.

(Can you tell I used to work for a web analytics firm?)

It's trivially easy to make the link. What's more disturbing is that Google is doing it as a matter of routine, and is also leaking the links to the world. In this case it feels less like "a deliberate choice to do evil" and more like "evil arising from oblivious incompetence."

[silverhare]

Fuck. I'm sticking to another server for my pseud, then.

[delladea]

Ugh, dammit. Guess I'll have to find another service for one of my accounts.