Whoa, Google, That's A Pretty Big Security Hole
See Updates at bottom of post. — Facebook would probably just consider this a feature, but the rest of us will definitely consider this a big security hole. The creator of http://guntada.blogspot.com (don't visit that site just yet) emailed us this morning to explain.
Context & Ripple Effects
This disclosure lands in one of Google's worst privacy stretches on record. The company had already spent 2010 absorbing fallout from the February Buzz privacy flaw, which auto-exposed users' most-contacted Gmail addresses, and just yesterday (November 19) committed to deleting UK Street View Wi-Fi data after confirming it had captured full emails and passwords from unsecured networks.
The new hole, disclosed by the creator of guntada.blogspot.com, sits squarely in that pattern: TechCrunch's framing that 'Facebook would probably just consider this a feature' points at contact-harvesting via Facebook's Find Friends tool, which drew on Gmail address books. Facebook's same-day removal of Gmail from its third-party email provider list signals how quickly the two companies moved to contain it.
First-order effects
- Facebook pulls Gmail from its Find Friends third-party email providers, immediately breaking contact-import for users who relied on Gmail address books to find friends on the service.
- Google faces pressure to patch a hole that lets an external site enumerate user data, with the disclosure already public via TechCrunch rather than a quiet fix.
Second-order effects
- The Gmail-Facebook contact-import spat sharpens into a data-portability standoff: each side can now restrict what the other harvests, and rival social networks weighing Gmail integration have to price in the same exposure.
- With UK regulators already forcing deletion of Street View Wi-Fi captures, a fresh consumer-facing hole hands privacy critics another concrete example to fold into existing complaints.
Third-order effects
- If the pattern holds — Buzz in February, Street View through the year, now this — Google's ship-first-remediate-later approach invites structural responses: regulator-mandated privacy review before product launches rather than after incidents.
The trend: Google's recurring privacy failures across Buzz, Street View, and now its contact APIs are shifting the debate from isolated bugs to whether launch-speed itself needs regulatory friction.