Slashdot Mirror
Google Voice Mails Found In Public Search Engine
bonch writes "Google Voice Mails have been discovered in Google's search engine, providing audio files, names, and phone number as if you were logged in and checking your own voice mail. Some appear to be test messages, while others are clearly not. Google has since disabled indexing of voice mails outside your own website."
and dont really care if you do. But bad move google.
This doesn't sound like a bug or leak, more like some users set up links or otherwise made their messages public.
Looks like they got my message to Steve Ballmer.
My work here is dung.
UPDATE: It seems as if these voicemails have been publicly posted/shared online and Google indexes them. Here’s official word:
“Since the initial idea behind posting a voicemail, was precisely to share it with others, we did not restrict crawling of those messages that users post on the web, but we can certainly understand that users would want to make them public on their sites but not necessarily searchable directly outside of their own website. We made a change to prevent those to be crawled so only the site owner can decide to index them.”
Like everything on the internet, if it's public, a web-spider will find it (eventually). But I'm seriously impressed by the speech-to-text engine Google uses, quite nice.
Was that appropriate? Posting that voice mail that has names numbers and locations?
Extremely poor ethics here at Slashdot.
Could at least mention that the link you linked to has the express updated statement from google:
"Since the initial idea behind posting a voicemail, was precisely to share it with others, we did not restrict crawling of those messages that users post on the web, but we can certainly understand that users would want to make them public on their sites but not necessarily searchable directly outside of their own website. We made a change to prevent those to be crawled so only the site owner can decide to index them."
These are messages that people went out of their way to make public, via a URL with a hash. There's a question of whether there should have been a different type of authentication here, but this story is an alarmist knee-jerk reaction at best.
"You know, Hobbes, some days even my lucky rocketship underpants don't help" -- Calvin
I'm Dialing Lucky
I'm sure "SlashdotMedia" will improve on all the wonders that Dice Holdings blessed us all with
The real problem, IMO, is that Google Voice voicemails are world-readable to begin with. The only security is the URL scheme. If that can be reverse engineered, the privacy of all google voice users will be in danger. (fyi I have tested this myself. The url scheme is "https://www.google.com/voice/fm/20-digit account id/long b64 encoded binary string", and these urls can be viewed by unauthenticated users. Note the use of https; while no man in the middle will read my voicemail, the man on one end can ;)
Butt dialing on a roller coaster?
This guy's the limit!
Dont want data to be found online? Dont put it out there for people to find.
Total non-issue.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
I've been experimenting with the voicemail-to-text transcription services out there, and compared to both GotVoice and PhoneTag the quality of transcription from Google Voice is something of a bad joke.
I understand that currently it's free (as opposed to $10+/month from the commercial services), and I have hopes that it will improve, but "quite nice" seems like a heck of a stretch at this point.
Anecdotally, here's an edited for privacy transcription from PhoneTag: "Hi, Alan. It's Nancy at Village Surgeons. My number is 123-456-7890. I'm following up on my e-mail that I sent you last week with regard to backup of our (quicken?) system here. (Paul Oddlastname?) was, had a concern that it wasn't backing up. So, I just kinda wants to touch base with you about that. When you have a chance. Give me a call. Thank you. Bye."
And here's an edited for privacy transcription from Google Voice today: "Hi Alan, it's gia Craig over at Northeastern collagen help topped and my computer is dead. It's definitely not working or managers on my phone's working. I checked the lines it doesn't look like. Anything's Unplugged, but I've pushed in any way you push the button to turn it on. There's no white that goes on movie then Maher of a machine starting. It's just absolutely dead and so could you do call me back and and come today. I do have to run over to delivery of the office for a few minutes this morning and then but I did not half hour. I might be at Colin's desk and that is extension 251. If I'm not at my own here and I'm 253. Thanks a lot. Bye bye."
fencepost
just a little off
Google only hides the voicemail files with a monster-long URL. Though served over https, they are still world-readable. This is not an accident. This is deliberately done so that one can post a link to it somewhere else (email to coworker comes to mind) and they can hear it. Google did not simply forget to have access control; they purposefully chose this way over the Docs' everyone-must-signup-for-any-reason style.
Now, some morons have posted those voicemail URLs on public sites, along with the text translation. Along came a spider and sat down, er, crawled over them. These URLs and texts then appeared in search engines.
There's really no shock here. If I post links to my family photo gallery, everyone will see those, too, unless I have an account-based system which requires all my relatives to jump hoops in order to get access. Google tried to pick the lesser of two evils - whether they picked the right one I don't know.
The government can't save you.
The digital photo was an example... I was having a hard time converting 4MB into Library of Congresses in my head.
Aside from the occasional office event (work sponsored with a camera), we did send a lot of .zip files. One-off reports, server logs, sample data sets, etc.
The preferred method for sending these files was a Windows share drive. Except nobody bothered to tell us that, probably because my satellite office wasn't big enough to get one. The biggest drawback is that Windows Shares don't work very well for people outside the firewall... like my customers. For irregular customer communication, it was email or nothing. Regular customer communications (daily data feeds, etc) was on an FTP site, but those were not available for ad-hoc file transfers. I tried to get a hole opened in the firewall for an ad-hoc (ie: locally administered) FTP site, but was denied.
Before we were acquired, I was the system/mail/database/web admin (yeah, yeah, entitlement issues). As a non-Exchange shop, I had no problem providing reasonable email limits. And even (gasp!) changing them when the business needed it. Once we were acquired (and required to use Exchange), the uselessly low limit were imposed. There were valid reasons for it, but I wasn't given any alternative.
My home computer was used as a last resort, after several Senior VPs asked if there was "anything I could do to make it work". It was always one-off, and always torn down and cleaned up. I am quite willing to bend the rules to make the customer happy, as long as it's done correctly.