25

When using the Try Search for Free feature in Stack Overflow, it shows a list of sample profiles, like mine (User #50530).

The idea is that you cannot see the entire profile of user #50530, since you have to be registered for that. The problem is that you might still be able to see the profile if you search in Google using the following terms:

inurl:careers.stackoverflow.com + inurl:print-preview + 50530

It will only show up in results if the profile user linked it from an external source like Blogs, LinkedIn, etc., but I still think it shouldn't happen.

I also noticed that only uk, fr and de sites appear when searching.

Improve this question
14
  • 1
    That just looks like your CV, not your entire profile. You're claiming that your CV should be behind the registration wall?
    – user102937
    Commented Nov 2, 2013 at 23:08
  • Reproduced with my id, but my profile is public. Do sample profiles match the search criteria? Answer: ah, they do.
    – Martijn Pieters
    Commented Nov 2, 2013 at 23:09
  • Your profile is here: careers.stackoverflow.com/omederos, and I can see it.
    – user102937
    Commented Nov 2, 2013 at 23:10
  • I've never seen the site as an employer, so I don't know what other information they can see from my profile, but if you look at the bottom of the print-preview page, there is a link to my complete profile.
    – Oscar Mederos
    Commented Nov 2, 2013 at 23:10
  • ...which is public. Are you sure this is a security hole?
    – user102937
    Commented Nov 2, 2013 at 23:10
  • 2
    @RobertHarvey: Not a security hole so much as revealing actual matches. A search for potential candidates can then reveal the real candidates from the numbers, including contact info.
    – Martijn Pieters
    Commented Nov 2, 2013 at 23:12
  • Of course, it is public, but I thought the user that is using the Try Search for Free feature isn't supposed to go to my profile. Let's suppose someone searches for C# programmers in Dubai, and 3 profile appears. They can search on Google using that, and have access to those 3 profiles. Perhaps that's not a big deal, but I thought that was the intended behaviour. Otherwise, why show User ### instead of the full link to the profile (for public ones)?
    – Oscar Mederos
    Commented Nov 2, 2013 at 23:14
  • OK, got my upvote.
    – user102937
    Commented Nov 2, 2013 at 23:15
  • 8
    This is a serious issue, I'm working on it right now.
    – Nick Larsen
    Commented Nov 2, 2013 at 23:24
  • A fix is on its way out. I'll add details once I verify it's working.
    – Nick Larsen
    Commented Nov 2, 2013 at 23:44
  • 2
    @NickLarsen *its, FTFY
    – Ry-
    Commented Nov 2, 2013 at 23:55
  • 2
    @minitech pretty sure I'm right, its-not-its.info
    – Nick Larsen
    Commented Nov 3, 2013 at 0:14
  • @NickLarsen: I edited it for you. :)
    – Ry-
    Commented Nov 3, 2013 at 0:19
  • 1
    @minitech in that case... damn it
    – Nick Larsen
    Commented Nov 3, 2013 at 0:21

2 Answers 2

Reset to default
11

When I first saw this, I of course tried it out on myself and saw my own url with my own email address and had a small freak out moment. When I working on the fix however, I noticed that I could see my email address because I was logged in as me. So for the record, no email addresses were ever exposed.

As pointed out, the issue was that our robots.txt does not handle our localized routes particularly well (eh, not at all), and some of our print preview pages were exposed via google search index as a result. That should not have happened.

For an initial measure, I changed the hash function (more on that in a second) that generates the value at the end of the url, breaking all the existing links indexed and added nofollow to all links pointing to that page as well as adding a nofollow header directly to the print preview page.

The hash function page for print preview exists because we have a share feature for employers to email links of applications to other people at their company, who then have the ability to print those profiles. Those links can be viewed anonymously as long as you have the url. The share links show what would be the public profile view (the one you create your own custom url for).

Improve this answer
2
  • 1
    I can confirm that the indexed print-view URL for my CV now returns a 404; there is still a Google Cache present, but that'll eventually be cleared automatically.
    – Martijn Pieters
    Commented Nov 3, 2013 at 1:42
  • 1
    Pays to debug in incognito mode.
    – j08691
    Commented Nov 4, 2013 at 16:30
10

There are three two problems here:

  1. The print preview reveals contact information (email address) breaching the privacy of those posting profiles. The print preview (linked from public CVs) should not include the email address; as the careers page promises that street address, phone and email are only shown to employers you approve. - only when logged in and already given access (like on your own profile).

  2. Using actual candidate ids lets employers bypass the Careers system altogether, finding candidates and contacting them directly without ever paying Stack Exchange for the service.

  3. Print previews should not be indexable by search engines. The print-preview route is blocked in robots.txt but the per-location URLs (starting with /uk, /de, etc.) have opened up these URLs to indexing again.

Improve this answer
8
  • I'm taking care of #3 right now by adding no-index directly to the print preview html.
    – Nick Larsen
    Commented Nov 2, 2013 at 23:28
  • I'll have more information on the others shortly, but it's a little more complicated than it seems. The main problem is these pages are not supposed to be indexed.
    – Nick Larsen
    Commented Nov 2, 2013 at 23:29
  • @NickLarsen: indeed, I saw /cv is disallowed, but /uk/cv is not, which opens hole #3. It's the combination of #1 and #3 that makes #2 easy. Without those two it would be almost impossible to do #2.
    – Martijn Pieters
    Commented Nov 2, 2013 at 23:31
  • Agreed. I also thought it was because the id was included in the profile HTML source, but it really isn't. I mean, it is, but Google isn't indexing it as part of the page content, since it only appears in that link and in a JS variable.
    – Oscar Mederos
    Commented Nov 2, 2013 at 23:33
  • @MartijnPieters in 1... does it really happen? I mean, the email is included only if I include it manually in my Personal statement, Background, etc., right?
    – Oscar Mederos
    Commented Nov 2, 2013 at 23:36
  • 2
    To be clear, no the email does not show up unless you can see it. That requires you to be linked to the info in some way, like being the owner of the CV or being logged in as an employer who has received an application with this CV attached.
    – Nick Larsen
    Commented Nov 2, 2013 at 23:46
  • Ah, indeed. In incognito mode the email is gone. I can see it because I was logged in and the owner; will strike that one.
    – Martijn Pieters
    Commented Nov 2, 2013 at 23:51
  • @Oscar: turns out the email is only visible to authorised accounts so that one can be stricken from the list.
    – Martijn Pieters
    Commented Nov 2, 2013 at 23:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .