28

I just received a notification "Important Information about Google+ APIs" about the profile information leak to apps by Google+ API.

The attachment states that the app "Stack Exchange" had access to my "About, Partial Birthday, Gender, Relationship Status" but

We have no evidence that the app developers who inadvertently had this access for six days were aware of it or misused it in any way.

Now, in my case there was no data to leak (I think), and personally I trust that Stack Exchange didn't rush to mass-download data, but can we have an explicit confirmation by Stack Exchange that they didn't download or store such data? Maybe there are cases where it was transmitted unwittingly and stored on some log file. :-)

Improve this question
1
  • 2
    Pretty sure SE takes only real name and profile picture from the Google+ account and don't really care or store any other detail. :)
    – Shadow Wizard Is Sad And Angry
    Jan 3, 2019 at 8:42

1 Answer 1

Reset to default
33

Our request to Google is scope=profile+email. It hasn't changed in so many years I got tired of going back in git...but it's way, way past their incident in November. We only care about what we present to you on the user join screen:

  • Email (so we can contact you, reset account, etc.)
  • Display Name (just to make sign up easier)
  • Profile Image URL (again, just to make sign up easier)

If they sent us additional JSON during the period they had the bug, we didn't deserialize it and it was garbage collected in gen0 without any thought. We don't log the JSON response from these requests unless there's a really bad error that ends up in the error log (we have no errors for that time period).

To better illustrate this to coders, here's our C# POCO we're deserializing into. The rest is thrown away just by nature of not being cared about:

Google Auth JSON

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .