What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

When using the Try Search for Free feature in Stack Overflow, it shows a list of sample profiles, like mine (User #50530).

The idea is that you cannot see the entire profile of user #50530, since you have to be registered for that. The problem is that you might still be able to see the profile if you search in Google using the following terms:

inurl:careers.stackoverflow.com + inurl:print-preview + 50530

It will only show up in results if the profile user linked it from an external source like Blogs, LinkedIn, etc., but I still think it shouldn't happen.

I also noticed that only uk, fr and de sites appear when searching.

share|improve this question
1  
That just looks like your CV, not your entire profile. You're claiming that your CV should be behind the registration wall? –  Robert Harvey Nov 2 '13 at 23:08
    
Reproduced with my id, but my profile is public. Do sample profiles match the search criteria? Answer: ah, they do. –  Martijn Pieters Nov 2 '13 at 23:09
    
Your profile is here: careers.stackoverflow.com/omederos, and I can see it. –  Robert Harvey Nov 2 '13 at 23:10
    
I've never seen the site as an employer, so I don't know what other information they can see from my profile, but if you look at the bottom of the print-preview page, there is a link to my complete profile. –  Oscar Mederos Nov 2 '13 at 23:10
    
...which is public. Are you sure this is a security hole? –  Robert Harvey Nov 2 '13 at 23:10
2  
@RobertHarvey: Not a security hole so much as revealing actual matches. A search for potential candidates can then reveal the real candidates from the numbers, including contact info. –  Martijn Pieters Nov 2 '13 at 23:12
    
Of course, it is public, but I thought the user that is using the Try Search for Free feature isn't supposed to go to my profile. Let's suppose someone searches for C# programmers in Dubai, and 3 profile appears. They can search on Google using that, and have access to those 3 profiles. Perhaps that's not a big deal, but I thought that was the intended behaviour. Otherwise, why show User ### instead of the full link to the profile (for public ones)? –  Oscar Mederos Nov 2 '13 at 23:14
    
OK, got my upvote. –  Robert Harvey Nov 2 '13 at 23:15
8  
This is a serious issue, I'm working on it right now. –  NickLarsen Nov 2 '13 at 23:24
    
A fix is on its way out. I'll add details once I verify it's working. –  NickLarsen Nov 2 '13 at 23:44
2  
@NickLarsen *its, FTFY –  minitech Nov 2 '13 at 23:55
2  
@minitech pretty sure I'm right, its-not-its.info –  NickLarsen Nov 3 '13 at 0:14
    
@NickLarsen: I edited it for you. :) –  minitech Nov 3 '13 at 0:19
1  
@minitech in that case... damn it –  NickLarsen Nov 3 '13 at 0:21

2 Answers 2

up vote 11 down vote accepted

When I first saw this, I of course tried it out on myself and saw my own url with my own email address and had a small freak out moment. When I working on the fix however, I noticed that I could see my email address because I was logged in as me. So for the record, no email addresses were ever exposed.

As pointed out, the issue was that our robots.txt does not handle our localized routes particularly well (eh, not at all), and some of our print preview pages were exposed via google search index as a result. That should not have happened.

For an initial measure, I changed the hash function (more on that in a second) that generates the value at the end of the url, breaking all the existing links indexed and added nofollow to all links pointing to that page as well as adding a nofollow header directly to the print preview page.

The hash function page for print preview exists because we have a share feature for employers to email links of applications to other people at their company, who then have the ability to print those profiles. Those links can be viewed anonymously as long as you have the url. The share links show what would be the public profile view (the one you create your own custom url for).

share|improve this answer
1  
I can confirm that the indexed print-view URL for my CV now returns a 404; there is still a Google Cache present, but that'll eventually be cleared automatically. –  Martijn Pieters Nov 3 '13 at 1:42
1  
Pays to debug in incognito mode. –  j08691 Nov 4 '13 at 16:30

There are three two problems here:

  1. The print preview reveals contact information (email address) breaching the privacy of those posting profiles. The print preview (linked from public CVs) should not include the email address; as the careers page promises that street address, phone and email are only shown to employers you approve. - only when logged in and already given access (like on your own profile).

  2. Using actual candidate ids lets employers bypass the Careers system altogether, finding candidates and contacting them directly without ever paying Stack Exchange for the service.

  3. Print previews should not be indexable by search engines. The print-preview route is blocked in robots.txt but the per-location URLs (starting with /uk, /de, etc.) have opened up these URLs to indexing again.

share|improve this answer
    
I'm taking care of #3 right now by adding no-index directly to the print preview html. –  NickLarsen Nov 2 '13 at 23:28
    
I'll have more information on the others shortly, but it's a little more complicated than it seems. The main problem is these pages are not supposed to be indexed. –  NickLarsen Nov 2 '13 at 23:29
    
@NickLarsen: indeed, I saw /cv is disallowed, but /uk/cv is not, which opens hole #3. It's the combination of #1 and #3 that makes #2 easy. Without those two it would be almost impossible to do #2. –  Martijn Pieters Nov 2 '13 at 23:31
    
Agreed. I also thought it was because the id was included in the profile HTML source, but it really isn't. I mean, it is, but Google isn't indexing it as part of the page content, since it only appears in that link and in a JS variable. –  Oscar Mederos Nov 2 '13 at 23:33
    
@MartijnPieters in 1... does it really happen? I mean, the email is included only if I include it manually in my Personal statement, Background, etc., right? –  Oscar Mederos Nov 2 '13 at 23:36
2  
To be clear, no the email does not show up unless you can see it. That requires you to be linked to the info in some way, like being the owner of the CV or being logged in as an employer who has received an application with this CV attached. –  NickLarsen Nov 2 '13 at 23:46
    
Ah, indeed. In incognito mode the email is gone. I can see it because I was logged in and the owner; will strike that one. –  Martijn Pieters Nov 2 '13 at 23:51
    
@Oscar: turns out the email is only visible to authorised accounts so that one can be stricken from the list. –  Martijn Pieters Nov 2 '13 at 23:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .