Slashdot Mirror
"Going Google" Exposes Students' Email
A ReadWriteWeb piece up on the NY Times site explores the recent glitch during the move of a number of colleges onto Google's email service that allowed a number of students to see each others' inboxes for a period of more than three days. Google would not give exact numbers, but the article concludes that about 10 schools were affected. "While the glitch itself was minor and was fixed in a few days, the real concern — at least at Brown — was with how Google handled the situation. Without communicating to the internal IT department, Google shut down the affected accounts, a decision which led to a heated conversation between school officials and the Google account representative. In the end, only 22 out of the 200 students were affected, but the fix was not put into place until Tuesday. ... The students had access to each other's email accounts for three solid days... before the accounts were suspended by Google. Oddly enough, this situation seems to be acceptable [to Brown's IT manager, who] 'praised Google for its prompt response.' (We don't know about you, but if someone else could read our email for three days, we wouldn't exactly call that 'prompt.')"
Is that three days after they were notified, or did the affected students keep it quiet for a couple of days for 'research purposes'.
Invaders must die
...social networking.
Taking it to a new level, no joining or other conscious actions required to share everything about your life.
The Mothership
We don't know about you, but if someone else could read our email for three days, we wouldn't exactly call that 'prompt.'
Look, I think we can all agree that if there were some major security breach like this for which we were responsible and we sat around for 3 days before doing anything, then unilaterally suspended a bunch of accounts before finally fixing the problem, we'd be fired.
On the other hand, if I were the head of IT at some place and we've decided to migrate everything to some giant, well-liked third party with a reputation for excellence, it'd be really easy to say, "That's just how tech is, it's hard to do right even for Google, get used to it. Oh, and while you're looking for ways to prevent such a 'catastrophe' from ever happening again, consider boosting the IT budget, will ya?"
I'll bet that IT manager is pretty happy right now, student complaints aside.
I'm French
Just save us the trouble and surrender this argument now.
Most people don't keep that on their email accounts...
Most people don't keep that *what* on their email accounts?
Private stuff?
Passwords?
User ids?
$25,000,000 money-making invitations?
Shakespeare quotes?
I know one fact about email which makes it an incredibly important security risk - the 'I forgot my password' link. Log on to a site you think the user uses, click that 'forgot' link, read his new password a few moments later. erm.. profit.
That said, this is google mail we're talking about, the one that bills itself as "store everything on us" we're safe and you'll never lose an email again thanks to our massive storage, indexing and searching facilities. So, for some people email is downloaded immediately and never stored on the server, for many many others, it stays right on the server.
I'd have cancelled the account, the way it was handled is not acceptable, even a free service has reasonable expectations of security. To let it linger for 3 days... that's simply not good enough.
I'm sorry, perhaps you missed the part where students could read each others emails.
Microsoft participation is not required in this case.
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
I bet most of us could read everyone else's email at school...
Not convinced. Mine used Solaris's default maildrop security, which is pretty effective, and I think was fairly standard practice until recently.
While the glitch itself was minor and was fixed in a few days
Pardon my ignorance, the glitch was minor?
What?
The fact that emails contain back-mailed passwords to many kinds of online services, including those involving payments (which is stupid practice, but the online service providers do it anyway, they send you the password when you sign up)...
The fact that I can reset your password to any third-party online service account where I know that you use it and that you associated it with this email account...
Still minor glitch? Reading others emails? Really? I or TFA must be missing something.
What the fuck.
This is a really big deal. And if the excuse is that 3 days (admittedly, 2 of them weekend days) turnaround on an absolute security breach is what you get for free, and to expect better you must pay for it, then the proper response is to pay for better and not use this service because it's shit-broken. It is my understanding that Google Apps for Education is not a tiered service -- you're a school, you get it free; there is no paying for better. If there IS paying for better, then we should spread awareness that the free version is bad.
Might I point out that losing privacy on your email and THEN losing access is pretty much the worst possible failure mode? This is an enormous fuck-up. This has nothing to do with Microsoft. Why would you bring up Microsoft? YOU are the one twisting something into what it is not to make some other company look bad. If I were as paranoid as you, I'd suggest that Google or Apple or somesuch was paying you to do this, but in fact, I know that you're capable of being fuckwitted all on your own.
Jesus Christ. Google Apps' security fails utterly, and that's Google kicking Microsoft in the groin to you? Maybe Google can start a puppy-stomping program; I bet that's just like Google ripping Microsoft's arms off.
I'd be a lot more comfortable if Google said "yeah, we fucked up, here's what we're going to do to prevent this from happening again". Instead we get the self-contradictory "it was a small hiccup [...] it's an issue we've taken extremely seriously".
What the FSCK! How lame is your college that it can't run an email system?
When you finally get out you might want to check and see if your diploma is signed.
"I'm sorry, perhaps you missed the part where students could read each others emails."
If we are to be true, students could not reach other students inboxes. During migration mails wore put in wrong inboxes. Its a pretty big difference if the source system is on crack or if there is a security breach in the target system. In this case the problem could lie in the software used to migrate the users mails but it did not lie in Google Apps itself.
HTTP/1.1 400
Worse than just a breach of privacy of email, students use their college-provided accounts to communicate with their faculty. If other students are able to see their emails, that constitutes a potential FERPA breach. As a college IT administrator, I would be screaming at Google for not sharing info and reacting immediately. Waiting a day to shut the accounts down temporarily is inexcusable.
Google docs is another liability, when it comes to security. A while back, Columbia experienced a major data leak -- tens of thousands of social security numbers, names, dates of birth, etc. (everything you need to open a bank account) -- all because someone was using Google docs. Frankly, if you want the same level of document/email integration, there are a lot of free-libre and proprietary packages that will do that; MS Office, or KOffice+Kontact, for example. Being willing to put up with a slightly less convenient, but far more secure (in terms of data) method is all it really takes.
Palm trees and 8
It isn't FREE, people.
Google advertises all over the place. They store your mail for an indeterminate period of time.
They link your gmail account cookie to your google account cookie, which is linked to various advertising streams.
Do you think TV is free? Really? Ever heard of commercials?
TV is a deployment method for commercial advertising. It's at breaks (standard commercials). It's during TV shows, with in show spots for products.. such as actors pumping various products. It's at the bottom of the screen, with dancing advertising logos and such, while you watch the show!
This is not free. This is an arrangement between two entities. You watch our shows, and we try to sell you things. Clearly your time has value, you watching has value, and that is why TV is on the air. It isn't on the air to be 'free'.
That is, unless you think that 'free' means 'no hard currency was exchanged'. If you do, then I suppose you help your friends move for 'free', and the beer and pizza after isn't compensation?
Gmail is not different. It isn't free. Google is making a PROFIT on this -- or if not, it will be. It will make money by examining the relationships between people that use gmail. It will make money by examining those relationships, and what you search for on the web. It will make the same money, by looking at those relationships, your financial data (Google finance), the places you search for on Google Maps, the apps you download with Andoird/Gphone, the people you call in your gphone, and on and on and on.
Google has become the largest depository of human interaction. They span more than email and searches. They know who you are in contact with, who you buy from, and the list goes on and on.
Further, they store this information for an indeterminate period of time.
Whether or not you like this, whether or not you approve, it is what you pay for using their service.
Free? Hell no!
This will make me unable to moderate, but what the hell?
Brown had a unix based backend for years. A few years back, they got a new IT head, who insisted on off-the-shelf packages for everything. So out went postoffice, and in came Exchange. It's been running Exchange since then, and yes, untold numbers of problems (though nothing like this). We're not even on the most recent version of Exchange, which will make my office's future transition to Snow Leopard problematic since afaik the native Mail interoperability with Exchange that comes in 10.6 won't work with anything but the latest.
AFAIK, the plan is to move everyone to Google eventually, departments too. Once they get all the security figured out. This isn't helping, of course.
That is, unless you think that 'free' means 'no hard currency was exchanged'.
Yea, that's pretty much what we all think. do you really think someone is reading your post and going
"holy crap, he's right - they DO look at my data! and tv DOES have ads! none of this is FREE!!!!"
Yea, we all know we are giving up time, or letting company X gain something by giving our time, or whatever, but most of the general public (including me!) considers only their pocketbook when thinking about whether or not something is "free". Hell, even if i have to spend 20 minutes doing something (lets say filling out a rebate on something so that the final price is $0), i STILL consider it free!
No, why don't you RTFA and get off your high horse. According to an article linked from TFA, Google acknowledged the problem was on their end, and an earlier comment from a Brown sysadmin indicates that Google upgraded their migration tool right before this happened. It may have "only" been 20 out of 200 accounts, but the problem is squarely Google's fault; stop blaming the Brown sysadmins.