Slashdot Mirror
"Going Google" Exposes Students' Email
A ReadWriteWeb piece up on the NY Times site explores the recent glitch during the move of a number of colleges onto Google's email service that allowed a number of students to see each others' inboxes for a period of more than three days. Google would not give exact numbers, but the article concludes that about 10 schools were affected. "While the glitch itself was minor and was fixed in a few days, the real concern — at least at Brown — was with how Google handled the situation. Without communicating to the internal IT department, Google shut down the affected accounts, a decision which led to a heated conversation between school officials and the Google account representative. In the end, only 22 out of the 200 students were affected, but the fix was not put into place until Tuesday. ... The students had access to each other's email accounts for three solid days... before the accounts were suspended by Google. Oddly enough, this situation seems to be acceptable [to Brown's IT manager, who] 'praised Google for its prompt response.' (We don't know about you, but if someone else could read our email for three days, we wouldn't exactly call that 'prompt.')"
Is that three days after they were notified, or did the affected students keep it quiet for a couple of days for 'research purposes'.
Invaders must die
Sue.
The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
I bet most of us could read everyone else's email at school...
...social networking.
Taking it to a new level, no joining or other conscious actions required to share everything about your life.
The Mothership
So that's the use of that button!
We don't know about you, but if someone else could read our email for three days, we wouldn't exactly call that 'prompt.'
Look, I think we can all agree that if there were some major security breach like this for which we were responsible and we sat around for 3 days before doing anything, then unilaterally suspended a bunch of accounts before finally fixing the problem, we'd be fired.
On the other hand, if I were the head of IT at some place and we've decided to migrate everything to some giant, well-liked third party with a reputation for excellence, it'd be really easy to say, "That's just how tech is, it's hard to do right even for Google, get used to it. Oh, and while you're looking for ways to prevent such a 'catastrophe' from ever happening again, consider boosting the IT budget, will ya?"
I'll bet that IT manager is pretty happy right now, student complaints aside.
i could just imagine the awkwardness when you find your best friends gay porn collection due to a software malfunction
"Two things are infinite: the universe and human stupidity; and I'm not sure about the universe." - Albert Einstein
" Oddly enough, this situation seems to be acceptable [to Brown's IT manager, who] 'praised Google for its prompt response."
In my NSHO three days is pretty fast for a free service. You want faster response times, 100% avail and dedicated engineers? For free? Sorry, no can do.
Everytime i see an article like this all i can think is "what Microsoft backed puppet wrote this crap?". Microsoft is working very hard to make out Google as craptastic, greedy and customerhating as them. For me it has the opposite effect, Google becomes the underdog with Microsoft kicking them in the groin. I find myself feel for Google in the search market despite their 90% marketshare.
Way to go Microsoft, no PR in the world coming from Google could accomplish that feat, feeling sorry for a market leader. ;D
HTTP/1.1 400
How the fuck the "glitch itself was minor"? I'm not sure if it actually violated any privacy laws given the extensive cover-your-ass EULAs, but still, it was a a serious breach of privacy, and indeed was much more important than "how Google handled the situtation". With respect to the latter, temporarily shutting down all affected e-mails, _immediately_, was completely justified, and in fact, was the only thing to do until Google had the chance of finding out exactly what was going on, who and how is affected, and how to fix it. I'm much more of the opinion that Google, as a free (as in beer) service, ows you no performance SLAs whatsoever (it may even shut down Gmail completely tomorrow, and if you lose e-mails, its too bad for you for not backing them up). But even so, AS LONG as Google provides a mail service, it DOES have some obligations to respect the privacy of its users. So guaranteeing privacy > guaranteeing performance, and Google acted correctly in this case.
In the ether, thousands of janes are shrieking 'OMG!?!?!?! he really does fancy me!'
Ah Brown, generally home to spoiled rich kids who's kids buy their way through college (all Ivy's have this, but Brown is the worst) and the least rigorous of any Ivy. Not surprised to see them shill a bit...
You do realise that google has to comply with terror-laws don't you? gmail has been used for years. Inteliigence suggests students are most likely to be the ones who will be recruited for terrorism or do school shootings or become a suicide bomber.
All cows eat grass!
While the glitch itself was minor and was fixed in a few days
Pardon my ignorance, the glitch was minor?
What?
The fact that emails contain back-mailed passwords to many kinds of online services, including those involving payments (which is stupid practice, but the online service providers do it anyway, they send you the password when you sign up)...
The fact that I can reset your password to any third-party online service account where I know that you use it and that you associated it with this email account...
Still minor glitch? Reading others emails? Really? I or TFA must be missing something.
Is Google Apps for Edu in beta? :-)
"While the glitch itself was minor and was fixed in a few days"
That's not exactly what I would call a MINOR breach.
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
In Finland reading someone else's mail, of electronic or snail variety, is illegal. What about other legislations? This sounds like something that would be taken rather seriously here.
(Actually, due to how seriously this is taken a recent law has (unfortunately) been put in place, to explicitly allow employers to read employees' work mail. Google "lex Nokia" for more info.)
.: Max Romantschuk
The article makes a great point about communication being a problem when migrating services to the cloud environments. But this issue is not exclusive to cloud-sourcing, it's prevalent in most outsorcing today. How many call centers and admin management have been moved to different country with cheaper resources - countless. And how many times you had to make a third and even a fourth call to something resolved with say your favourite telecommunications provider?
If you've worked in an organisation that outsources services you will have encountered communication problems like this and worse every week. The fact that Google is a high-profile outsourcing vendor means that everyone gets to hear about it.
But I would still choose Google over 99% of other outsources because these guys care about quality, and as a rule they don't make the same mistake twice.
"We don't know about you, but if someone else could read our email for three days, we wouldn't exactly call that 'prompt.')"
um....someone else can read your email, and for more than 3 days. You store your email on an external server or send it through other servers unencrypted, and someone else can and probably does read it. Period.
If you want some bit of privacy, use encryption and don't store your email on other people's servers.
When concerning inidivdual citizen liberty and privacy, history has PROVEN. People cannot be trusted. Corporations can be trusted less. Governments can be trusted least of all. For those who are confused, the US founders created a 2nd amendment with the INTENTION of having a government which feared it's citizenry. If there was going to be a rebellion, they WANTED the citizens to win.
i wiped my ass with a koran.
fuck all muslims. they're fucking pigs. i shit on allah.
Worse than just a breach of privacy of email, students use their college-provided accounts to communicate with their faculty. If other students are able to see their emails, that constitutes a potential FERPA breach. As a college IT administrator, I would be screaming at Google for not sharing info and reacting immediately. Waiting a day to shut the accounts down temporarily is inexcusable.
probably because his neck is on the line, and he's trying to save face with management. Oops.
Why is it even necessary, in this day and age, for a school to provide their students with email? I can understand, back in the dark ages, when I was at university, and few incoming students had email addresses. But these days, doesn't every one of these incoming students have an email address somewhere? Wouldn't it be better to have the professor email out to the student's personal email account that the student had before they went to university, and will likely have long after they leave the university?
Or lack thereof.
This wasn't IT's fault, but in my university CS department, there was a period of about three months during which we had passwordless logon to our department course Wiki, which provided the option to use Perl in place of Wikicode as the source for a page. Said Perl ran with the webserver's username on the server.
As far as I know, nothing bad came of it. The seniors just enjoyed not needing to bother with passwords. (To be clear, we repeatedly notified the professor responsible for the Wiki, who repeatedly said he'd take care of it. After a couple weeks, it just kind of became normal.)
Why was this feature^H^H^H^ bug present in the first place? It's not like this is the 1st time Google has had to implement email for 3rd parties.
Did Brown give a list of "superusers" to Google that had the ability to read global mails and someone botched it? O Oh.
"Ah.. CRAP. I think we cut and paste the wrong names on the God list." ... ? What do you mean NO? .... Oh yeah the whole space-time thing.... . Err.. can we just call it a Google bug? .... ? What do you mean we have to deal with our own PR?" ... click.
"What... Call Google, quick!"
"Hello Google.... can you spin back time... ?
That I see their failure as a possible bright spot in the failure of the Global Economy.
Crash, Baby! Crash!
"Speaking the Truth in times of universal deceit is a revolutionary act." -- George Orwell
acne information acne treatment acne after 40 acne practise acne cure acne race ooh yeah is this all necessary??
Somewhere at Google HQ there is a guy saying "I told you we still weren't ready to come out of beta!"
3 or 4 years later. Hahaha. Google stinks.
While the issue took three days to resolve, the unilateral shut down of the accounts prevented students from reading other students' emails during that period.
So for review, no one got to read others' email for three days, instead, they got to read no email for that time and email sent to the accounts which were routing wrong was bounced back.
If you really want something to be private you don't put in your emails anyway. This is pretty well known by now isn't it, that privacy on the 'net is a myth? Can we stop with the "omg, I thought it was private" b.s. now? When I communicate on the 'net (or on my mobile phone, now, too) I always treat it like I'm using a p.a. system, no matter how many people the communication is addressed to.
This is an account given to the students by the school, right? I would assume the school is reading my email in that case. Just like the email address given to you by your employer, it is not yours, it is theirs. You are better off just assuming someone is snooping it. Don't use your work or school email for anything but work/school. Do we really need to tell people this still?
However, the real issue that concerned the university was the matter of communication between Google and the CIS department. Before fixing the issue on Tuesday, Google suspended the affected accounts, a necessary step that was taken so no more data was improperly shared. What angered the IT director, though, was that the accounts were suspended without first notifying CIS.
Translation: We sent you an email communicating the issue at hand. However, we had to disable your email account so nobody else could accidentally view it.
"I've spoken very forcefully with the account (executive), my boss, senior administrators at Brown -- including the president. (Google needs) to find a better way to communicate with us," said Tom.
Translation: We told them to stop or else we'll say stop again.
People who use Google services will be too scared to send privacy info over email. They then stop sending anything personal on personal email ;-)
After sometime, it occurs to people, why they should use an email account to exchange info. that every one can share with everyone.
After that, it becomes, Google Social email or Social conversations if you like it.
Then suddenly, people move away from email to Social Mail/Social Conversation platform. Email is so last century ;-)
I wonder if this was because they converted usernames that had periods in them and some that didn't, or just in slightly different places.
Gmail had some issues with this when it started off, because it allowed you to sign up as "j.smith" but would treat it the same as "jsmith", regardless of where you put the period. This led to some problems for my ex, who had "first.last@gmail.com" and someone else who just had "firstlast@gmail.com" because they would routinely get mail for the other one. Eventually, she contacted google and got an account name changed. If you had say, "j.smith" and "js.mith" as email accounts you were converting to google apps, it will probably see them the same way, and the inbox thing doesn't entirely shock me.
Nor was the 18-36 hour outage that followed.
The only reason that this has been labelled small is because they only transitioned 200 accounts. Supposing they transitioned 20000 accounts (How many people are at Brown anyway?)
in this case. it seems in my experience more and more that most companies do not care how long the outage is or what caused it, or how poorly the service performs so long as the price is rock bottom and they avoid the IT department asking for more cash each year.
this is a self correcting problem as more industries move into a greater reliance on computers. you cant just make IT another blindly outsourced number at the end of the day, and the decision cant come from a group of boardmembers who think gmail is a typo.
Good people go to bed earlier.
Clouds are translucent.
The "cloud" is some trendy IT buzzword now and Google tries to be the frontrunner for it yet cannot keep their services up and secure when it hits the big time.
Why aren't these universities running their own mail servers? There are plenty of people who are tech savvy to run them and do not give away personal info to Google.
I am a student at St. Ambrose University, a medium sized Midwestern school that's recently 'Gone Google'.
Here was our old microsoft exchange authentication scheme -
username: Student ID (rp7830284)
password: randomly generated string (h38Kbht8)
Now withGoogle Apps -
Google Apps username: email address (LastFirstM@sau.edu)
Google Apps password: Student ID (rp7830284))
That's right, they used our student ID's as passwords! I immediately logged into a couple of my friends email accounts in disbelief. Worst of all, the IT folks just said 'well, they can reset it'. An informal poll revealed that practrically no one had done so, knew how, or even desired too.
Now consider that this is the fourth combination of usernames/passwords that Ambrose has given everyone for various web services.
WTF
This same thing happened to Slashdot a few months ago for an afternoon. Every time I, and others, refreshed the page I was logged in under another Slashdot account. Other people had reported this in article comments until it got fixed.
...is why I still use POP3 or IMAP.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
Little glitches like this just reenforce the idea that Google is not a safe pair of hands for confidential data. We just had a memo at work saying that Google docs was not suitable for confidential data and they are cutting off all access to the site. Now, I don't know the rights and wrongs of that decision but I guess Google are losing the battle for the confidence of system administrators.
If you're not encrypting your e-mail (and you really have no choice in some cases - such as those back-mailed passwords) - you have no real privacy.
'E-mail security' fits into the same group of word combinations as 'military intelligence' and 'honest politician'.