{"id":37737,"date":"2018-10-12T13:00:32","date_gmt":"2018-10-12T11:00:32","guid":{"rendered":"https:\/\/www.rudebaguette.com\/?p=37737"},"modified":"2019-04-26T18:30:30","modified_gmt":"2019-04-26T16:30:30","slug":"the-ugly-side-of-the-google-plus-demise","status":"publish","type":"post","link":"https:\/\/www.rudebaguette.com\/en\/2018\/10\/the-ugly-side-of-the-google-plus-demise\/","title":{"rendered":"The ugly side of the Google+ demise"},"content":{"rendered":"

It’s not really<\/span> a surprise. Google has announced the end of Google+ for consumers. It seems logical since you <\/span>probably<\/span> can’t recall the last time someone told you “please join my Google+ circle so we can stay in touch”<\/span>. But there is a back story to it. A story of flaws, cover up and a touch of hypocrisy.<\/strong><\/p>\n

\n
\u00a0<\/span><\/div>\n<\/div>\n
\n

The facts<\/span><\/h2>\n<\/div>\n
\n
\u00a0<\/span><\/div>\n<\/div>\n
\n
Google announced this week the demise of its social network Google+. With 90% of users staying on the network for less than 5 seconds at a time, it’s hardly a surprise. <\/span>This would seem like a wise marketing decision if it hadn’t <\/span><\/span>been triggered by<\/span><\/span> a vulnerability detected last March<\/span><\/span>.<\/span><\/div>\n<\/div>\n
\n
Yet, flaws and bugs happen all the time and Google <\/span>quickly<\/span><\/span> patched it. So what is the problem?<\/span><\/div>\n<\/div>\n
\n
The problem is that Google only revealed it now, 7 months later. Amid the launch of the new Pixel 3 phones, bound to drain all the attention.<\/span><\/div>\n<\/div>\n
\n
What is even more disturbing is that <\/span><\/span>Google’s chief privacy officer testified before the Senate Commerce Committee on September 26, 2018<\/span><\/a>. That’s two weeks ago. His testimony was on the issue of privacy yet he didn’t mention the bug.<\/span><\/div>\n<\/div>\n
\n
It’s only when the <\/span><\/span>Wall Street Journal published an article on October 8th<\/span><\/a>, stating Google had chosen not to disclose the flaw that the Internet giant made a statement<\/span><\/span>. <\/span><\/div>\n<\/div>\n
\n
\u00a0<\/span><\/div>\n<\/div>\n
\n

The bug<\/span><\/h2>\n<\/div>\n
\n
\u00a0<\/span><\/div>\n<\/div>\n
\n
The vulnerability lied within the Google+ People API (Application Programming Interface). An API is a software intermediary that allows two applications to talk to each other. Here, it gives third-party apps some information located in the Google+ profile.<\/span><\/div>\n<\/div>\n
\n
The flaw was that it also gave access to information that was not meant to be public such as the real name, email address, occupation, gender, age…<\/span><\/div>\n<\/div>\n
\n
This <\/span>was patched<\/span><\/span> as soon as it <\/span>was detected<\/span><\/span>: in March 2018<\/span><\/div>\n<\/div>\n
\n
\u00a0<\/span><\/div>\n<\/div>\n
\n

The “no harm no foul” explanation<\/span><\/h2>\n<\/div>\n
\n
\u00a0<\/span><\/div>\n<\/div>\n
\n
Google argues that it didn’t need to <\/span>be brought<\/span><\/span> to the knowledge of the public as <\/span>there is no evidence the flaw was used<\/span><\/a>.<\/span><\/div>\n<\/div>\n
\n
The explanations are a bit dodgy though. <\/span>The flaw <\/span><\/span>potentially<\/span><\/span> affected the accounts of 500,000 users through 438 apps using the API from 2015 until 2018<\/span><\/span>.<\/span><\/div>\n<\/div>\n
\n
Because Google only keeps logs of the past 2 weeks of API usage and because the record was clean during the two weeks preceding the discovery of the bug, it declares no one <\/span><\/span>was affected<\/span><\/span>.<\/span><\/div>\n<\/div>\n
\n
So, sure, the network was seldom used and two weeks of logs were clean but that can’t be proof nothing leaked, ever.<\/span><\/div>\n<\/div>\n
\n
So why did Google put the lid on it?<\/span><\/div>\n<\/div>\n
\n
\u00a0<\/span><\/div>\n<\/div>\n
\n

March 2018 was Cambridge Analytica month<\/span><\/h2>\n<\/div>\n
\n
\u00a0<\/span><\/div>\n<\/div>\n
\n
When the vulnerability <\/span><\/span>was discovered<\/span><\/span>, Facebook was under heavy fire because of the Cambridge Analytica scandal<\/span><\/span>. <\/span>The Wall Street Journal accessed a memo exposing fears that such disclosure would “draw regulatory scrutiny and cause reputational damage”<\/span><\/span>.<\/span><\/div>\n<\/div>\n
\n
It’s a wonder such a <\/span>barely<\/span><\/span> used network could draw such damage. Google+ and Facebook don’t compete in the same league, well not anymore.<\/span><\/div>\n<\/div>\n
\n
Unless, <\/span>maybe<\/span><\/span>, Google needs to hide other intrigues.<\/span><\/div>\n<\/div>\n
\n
\u00a0<\/span><\/div>\n<\/div>\n
\n

Project Strobe, Project Zero, and the hypocrisy twist<\/span><\/h2>\n<\/div>\n
\n
\u00a0<\/span><\/div>\n<\/div>\n
\n
Project Strobe and Project Zero both come from Google. <\/span>Strobe <\/span><\/span>was launched<\/span><\/span> early 2018 and looks into third-party access to Google account and Android device data<\/span><\/span>. <\/span>It is Project Strobe that <\/span><\/span>uncovered the API flaw in March and suggested the shutdown of Google+ for consumers<\/span><\/a>.<\/span><\/div>\n<\/div>\n
\n
Project Zero, <\/span>on the other hand<\/span><\/span>, has been around for a little while longer. A team of Google security specialists scans software for flaws since 2014. Not <\/span>just<\/span><\/span> Google software mind you, they look into everything.<\/span><\/div>\n<\/div>\n
\n
The procedure is well established. When a flaw <\/span>is detected<\/span><\/span>, it <\/span>is reported<\/span><\/span> to the manufacturer. They then have 90 days to fix it before Google informs the public. Google didn’t hesitate one second <\/span>to expose a Windows 8.1 bug<\/span><\/a> that wasn’t patched within the 90 days. Including the code to exploit it.<\/span><\/div>\n<\/div>\n
\n
It’s lucky<\/span><\/span> the two services don’t meet on a regular basis or there wouldn’t have been a 7-month lapse between discovery and exposure [editor’s note: sarcasm intended]<\/span><\/span>.<\/span><\/div>\n<\/div>\n
\n
\u00a0<\/span><\/div>\n<\/div>\n
\n

What next?<\/span><\/h2>\n<\/div>\n
\n
\u00a0<\/span><\/div>\n<\/div>\n
\n
Despite disclosure amid the noisy Pixel 3 launch, Google may not have heard the end of it yet. It’s not the bug that bothers the public and administrations but the cover-up. <\/span>The American Senate has asked Google CEO Sundar Pichai<\/span><\/a> to produce the memos requesting the cover-up by October 30th<\/span><\/span>. <\/span>Along with seven rather intrusive questions seeking to find if other cover-ups took place<\/span><\/span>.<\/span><\/div>\n<\/div>\n
\n
\u00a0<\/span><\/div>\n<\/div>\n
\n
With Halloween closing in, let’s see what other monsters <\/span>are hidden<\/span><\/span> under the Google bed.<\/span><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

It’s not really a surprise. Google has announced the end of Google+ for consumers. It seems logical since you probably can’t recall the last time someone told you “please join my Google+ circle so we can stay in touch”. But there is a back story to it. A story of flaws, cover up and a<\/p>\n","protected":false},"author":77,"featured_media":37739,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"subtitle":"","footnotes":""},"categories":[113],"tags":[7347],"class_list":["post-37737","post","type-post","status-publish","format-standard","has-post-thumbnail","category-finance","tag-google-en-2"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/posts\/37737","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/users\/77"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/comments?post=37737"}],"version-history":[{"count":0,"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/posts\/37737\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/media\/37739"}],"wp:attachment":[{"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/media?parent=37737"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/categories?post=37737"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rudebaguette.com\/en\/wp-json\/wp\/v2\/tags?post=37737"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}