×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

145 comments

User action? (5, Insightful)

jbohumil (517473) | more than 3 years ago | (#29800841)

This doesn't sound like a bug or leak, more like some users set up links or otherwise made their messages public.

Re:User action? (5, Insightful)

Anonymous Coward | more than 3 years ago | (#29801037)

Exactly.

IMHO, totally a non-issue: google doesn't spider their own service, but if you post links to your voice mail on a public page with a permissive robots.txt, it gets spidered and shows up in search results with them or anyone else.

I completely get why Google is now removing these from search results -- they must be seen to be fixing this before it blows up as a scandal -- but shouldn't this sort of media panderage qualify as the evil they purportedly "don't be"? You'd think they're big enough to stand up and enlighten morons about robots.txt specifically, and about the general truth that when you post something on the internet, it's there forever.

Re:User action? (3, Insightful)

Capt. Skinny (969540) | more than 3 years ago | (#29801889)

You'd think they're big enough to stand up and enlighten morons about robots.txt specifically

Cars have been around for about a century and there are still morons who haven't been enlightened about changing a flat tire, so I have my doubts about robots.txt

Re:User action? (0)

Anonymous Coward | more than 4 years ago | (#29803775)

my guess is that moron has not been around for a century.

Re:User action? (3, Funny)

causality (777677) | more than 3 years ago | (#29801071)

It sounds like something that wouldn't happen if you used commodity PC hardware to set up your own voice mail system. Sure, you could make a similar mistake, but it's less likely considering that no one is as interested in safeguarding your data and privacy as you are. It's difficult to put a dollar amount on it, but maintaining control over your own data and systems is quite valuable all the same. I think it's great that Google wants to make services like these available to people who want them, but I for one won't be jumping on that bandwagon.

Re:User action? (3, Funny)

Mister Whirly (964219) | more than 3 years ago | (#29801171)

Why stop there? Set up your own ISP and mail servers also. And screw Youtube, I went there once and it was down so I am setting up my own multi-media server. I also don't trust any commercial Maglock system, so I am setting up my own Maglock server to monitor all the door access as well. So, 18 million dollars later and I can guarantee no down time at all. Of course if 99.999% downtime would have been acceptable, I could have done all of that for free, but I would rather pay the big bucks to ensure that extra .001 % of uptime. Anyone who doesn't spend lots of time and money administering all of their own systems is a sucker!

Re:User action? (4, Interesting)

geekboy642 (799087) | more than 3 years ago | (#29801373)

You speak facetiously, of course, but spending the time and effort to setup your own email server is a very valuable exercise. And at the end, you get an email account with no limits. Want ridiculously tight spam filters? Easy. Want to send and receive 1GB email attachments? Your insanity can be catered to.

And best of all, nobody is sitting there watching all of your emails and serving you ads based on what you're emailing about.

Re:User action? (2, Insightful)

Anonymous Coward | more than 3 years ago | (#29801435)

Good luck sending those 1GB attachments to anyone else......

Re:User action? (1)

lewiscr (3314) | more than 4 years ago | (#29802561)

You can email me. The first thing I do with postfix is add three zeros to every parameter with limit in the name. Then I install postgrey.

Sure, sending a 1Gig email takes 15 minutes, but what I do I care? Disk space and LAN bandwidth are cheap as dirt. And so few people can send me such a big email that I'm not worried about Internet bandwidth.

The last place I worked capped emails at 4MB. I couldn't even send one digital photo from my camera, because it was > 4MB after the base64 encoding. I ended up creating account on my home PC for several business customers so that they could send me a 10MB zip files. What a fsck'ing joke.

Re:User action? (1)

socsoc (1116769) | more than 4 years ago | (#29803063)

Why are you sending digital photos from your camera out of your work email account?

Because that *was* his work? (1)

ChipMonk (711367) | more than 4 years ago | (#29803135)

Maybe he's working for a graphic design studio, or an advertising agency.

Re:Because that *was* his work? (1)

socsoc (1116769) | more than 4 years ago | (#29803307)

Oh sure, they always cap emails at 4mb. If that was the case, there must have been a preferred method of moving those files, FTP for instance.

He's just another user who wants to disregard the policies that are in place for a reason and start using consumer grade accounts for business which degrades the professionalism of both him and his organization.

Re:Because that *was* his work? (2, Informative)

lewiscr (3314) | more than 4 years ago | (#29803773)

The digital photo was an example... I was having a hard time converting 4MB into Library of Congresses in my head.

Aside from the occasional office event (work sponsored with a camera), we did send a lot of .zip files. One-off reports, server logs, sample data sets, etc.

The preferred method for sending these files was a Windows share drive. Except nobody bothered to tell us that, probably because my satellite office wasn't big enough to get one. The biggest drawback is that Windows Shares don't work very well for people outside the firewall... like my customers. For irregular customer communication, it was email or nothing. Regular customer communications (daily data feeds, etc) was on an FTP site, but those were not available for ad-hoc file transfers. I tried to get a hole opened in the firewall for an ad-hoc (ie: locally administered) FTP site, but was denied.

Before we were acquired, I was the system/mail/database/web admin (yeah, yeah, entitlement issues). As a non-Exchange shop, I had no problem providing reasonable email limits. And even (gasp!) changing them when the business needed it. Once we were acquired (and required to use Exchange), the uselessly low limit were imposed. There were valid reasons for it, but I wasn't given any alternative.

My home computer was used as a last resort, after several Senior VPs asked if there was "anything I could do to make it work". It was always one-off, and always torn down and cleaned up. I am quite willing to bend the rules to make the customer happy, as long as it's done correctly.

Re:User action? (2, Insightful)

Anonymous Coward | more than 3 years ago | (#29801785)

And best of all, nobody is sitting there watching all of your emails and serving you ads based on what you're emailing about.

Oh noes, teh privacy. Except that if you actually cared, you'd be using PGP for important correspondence. Also, IMAP = no ads. kthxbai

Re:User action? (1)

MrCrassic (994046) | more than 4 years ago | (#29802729)

Unless you have a dynamic IP address, where you're still confined to somebody else's mail server for sending email out...

Setting up a mail server is pretty easy, whether it's a simple IMAP+SMTP server or a much bigger suite, like Zimbra or Exchange. As an added bonus, you gain some skills which are REALLY handy in a business...if that's an end-goal. Finally, because it's most likely a single user system, it's REALLY REALLY fast.

(After turning off my Exchange server in favor of Google Mail, I realized exactly how much speed I lost. Getting my mail from any client takes ages, and sending mail is much, much slower.)

Re:User action? (2, Informative)

DusterBar (881355) | more than 4 years ago | (#29803451)

I have had my own server (EMail and other) for a long time (almost 2 decades) and I have to say that with SPAM these days, nothing beats the GMail spam filters. I tell my family that I can forward email to their GMail accounts for spam filtering. They get to use GMail for the client (and imap/pop support from GMail) and get all of the spam filtering support while still controlling our email domain. This works far better than what I could ever support on my own server. (The large community of GMail customers and engineering to support them just beats my humble efforts...)

Re:User action? (4, Funny)

antifoidulus (807088) | more than 3 years ago | (#29801685)

if 99.999% downtime would have been acceptable

Some people have such high standards, I mean jeez the server was functional for 8.64 seconds today, isn't that enough?

Re:User action? (4, Interesting)

antifoidulus (807088) | more than 3 years ago | (#29801723)

Actually it was 86.4 milliseconds, but when you are only expecting .0001% uptime, you cannot expect your service provider to be able to do arithmetic :P

Re:User action? (1, Funny)

Anonymous Coward | more than 3 years ago | (#29801823)

0.01 cents?

Re:User action? (0)

Anonymous Coward | more than 4 years ago | (#29803695)

I've finally found the use for wolfram alpha - to refute [wolframalpha.com] people on the internet.

(You did the subtraction wrong, GP screwed up... err, something else. But if you average out the power of ten of the two numbers I guess you get the right answer?)

Re:User action? (1)

The MAZZTer (911996) | more than 4 years ago | (#29802511)

I'm curious to know how you keep your 100% uptime when the power goes out and your backup power solutions all fail at once. :)

Re:User action? (1)

Mister Whirly (964219) | more than 4 years ago | (#29803247)

Power goes out? You think I would rely on the power company for my precious servers? Hell no. I have my own generators - an array of solar, wind, steam, and diesel. It's all within the 18 million dollar budget.

Re:User action? (1)

MichaelJE2 (833360) | more than 4 years ago | (#29803437)

Power goes out? You think I would rely on the power company for my precious servers? Hell no. I have my own generators - an array of solar, wind, steam, and diesel. It's all within the 18 million dollar budget.

You left out coal, oil, and nuclear. I have 3 of each sitting in my back yard. (solar, wind, steam, and diesel)

Re:User action? (1)

martas (1439879) | more than 4 years ago | (#29803811)

except, of course, there might be a 0.001% chance that you'll die tomorrow, which means that 100% uptime is wasted anyway.

Re:User action? (3, Interesting)

DragonWriter (970822) | more than 3 years ago | (#29801641)

It sounds like something that wouldn't happen if you used commodity PC hardware to set up your own voice mail system.

Yes, if you used commodity PC hardware to set up your own voice mail system, you probably wouldn't have automatic transcription that it would be even theoretically possible for you to directly post your voice mails on the web, so it wouldn't be possible for you to expose information the way you could choose to do with Google Voice.

OTOH, it would be a lot more expensive for the fewer features you would get, so I'm not sure its all that worth it. It would be easier just to use Google voice and not post your own voice mails.

Note that all of these emails are emails for which the URLs were posted by the user on a public website, and which were subsequently (and as a result of that posting) crawled and indexed by search engines.

Oh, noes! Search engines find things that are posted publicly on the internet. The horror!

Re:User action? (3, Insightful)

Jah-Wren Ryel (80510) | more than 3 years ago | (#29801835)

This doesn't sound like a bug or leak, more like some users set up links or otherwise made their messages public.

I can't log into google voice without telling my browser to accept cookies from google. If they are going to use cookie-based authorization, then there is absolutely no excuse for handing out the data within an account to people who don't have the right cookie authorization.

Even if they don't index it, the URLs are still going to be accessible to anyone who can figure out the URL.
It appears to be a classic case of security through obscurity.
Obscurity as an extra layer is fine, but google voice seems to have no layers excepet for obscurity and that's a ridiculous design decision for a company as big a reptuation for technical acumen as google.

Re:User action? (4, Insightful)

Omnifarious (11933) | more than 4 years ago | (#29802279)

The obscurity in this case happens to be a random number that's at least 100 bits long if not a lot longer. Sure I could guess that, but I could guess your 128 bit symmetric cipher key too.

No, what happened here is that people used this extremely obscure URL to provide public links to their voicemail messages and google happily indexed those links. And, you know, when you publicize links to things, they show up in search engines.

Now, google could additionally require authorization before letting people have access to those links, but the way you find out what the big long random number is is by clicking on something saying something along the lines of "I want to share this voicemail with someone." which means that you want someone other than yourself to have access to it. Making the link require authorization to get to would completely defeat the purpose of sharing it with someone.

No, in my opinion, what google should do is have a per-voicemail switch that lets you decide whether or not the public sharable link works or not. Then you can share the link with a friend, and when you want to close up access so your friend can't share the link with their friend or post it on the internet or whatever, you click on the little check box and the link stops working.

Voicemails that you schedule for deletion should become private by default when they hit the trash can.

Re:User action? (1)

Nemyst (1383049) | more than 4 years ago | (#29803425)

A bit like Google Docs then? I'm actually surprised they don't share their design ideas around.

"someone" != "everyone" (0)

Anonymous Coward | more than 4 years ago | (#29803459)

And that is why Google failed.

Their designers made the same mistake with Google Voice that Microsoft made when they added "accounts" to pre-NT Windows -- they failed to consider the concept of controlled access. There really is a vast middle ground between "share it with the entire world" and "nobody but me can see it" and Google's designers need to understand that before they're allowed to play with business-sensitive (Google Docs and Google Voice) or PII (digitized health records) data.

Re:User action? (0)

Anonymous Coward | more than 4 years ago | (#29803461)

I agree with what you said except this:

The obscurity in this case happens to be a random number that's at least 100 bits long if not a lot longer. Sure I could guess that, but I could guess your 128 bit symmetric cipher key too.

It's a bit different here because you have this giant pool of 100 bit (or whatever) keys that you can try to guess from. It's not the same as trying to guess a specific user's key as in the case of guessing someone's symmetric cipher key. If you have 100 million users then the key size is reduced by that much. You can try and random key and hope to get a hit within that pool of 100 million valid keys. Still hard but the more users, the easier it would be to guess a valid key.

Re:User action? (0)

Anonymous Coward | more than 4 years ago | (#29803627)

I can't log into google voice without telling my browser to accept cookies from google. If they are going to use cookie-based authorization, then there is absolutely no excuse for handing out the data within an account to people who don't have the right cookie authorization.

Even if they don't index it, the URLs are still going to be accessible to anyone who can figure out the URL.

It sounds like a classic case of URL is autogenerated when I click the share link. If I want to post a voicemail on my blog I don't want all of my readers to have to be individually assigned access.

Biggest story here is the (probable) inability to unshare voicemails once you have shared them.

People are just making an assumption that emails you haven't yet shared are also stored at these links, but there is no evidence of it.

Re:User action? (1)

Anonymous Coward | more than 3 years ago | (#29802009)

how is a page that shows private user data without requiring a cookie or authentication not a bug or a leak?

they are playing the microsoft security through obscurity card and taking in a long message id and treating it as security credentials to view that message.

that is FAIL.

three words: (-1, Offtopic)

Anonymous Coward | more than 3 years ago | (#29800867)

Tucker Max FAIL!!!!!!

Article is already updated (5, Informative)

vxvxvxvx (745287) | more than 3 years ago | (#29800905)

UPDATE: It seems as if these voicemails have been publicly posted/shared online and Google indexes them. Here’s official word:

“Since the initial idea behind posting a voicemail, was precisely to share it with others, we did not restrict crawling of those messages that users post on the web, but we can certainly understand that users would want to make them public on their sites but not necessarily searchable directly outside of their own website. We made a change to prevent those to be crawled so only the site owner can decide to index them.”

Re:Article is already updated (2, Insightful)

v(*_*)vvvv (233078) | more than 3 years ago | (#29800987)

Honestly, I wonder how many people post stuff on some obscure URL thinking only the friends and family they send it to would see it, just to find out watching CNN Headline News that it got indexed by Google and journalists were reporting on bloggers blogging about it.

Re:Article is already updated (4, Funny)

Beardo the Bearded (321478) | more than 3 years ago | (#29801163)

Common. I remember when Beenz did that for a grand prize, and someone found the URL and claimed the prize. They got the equivalent of $500USD in Beenz.

Younger readers are wondering, "what the fuck are Beenz?".

Re:Article is already updated (4, Insightful)

Mr.Bananas (851193) | more than 3 years ago | (#29800999)

At around 10am, a comment [boygeniusreport.com] on the same page linked by OP revealed what the parent has pointed out, and even linked to a GV forum post explaining as much.

And yet, at 5pm, Slashdot posts this as news...

Re:Article is already updated (0)

bonch (38532) | more than 3 years ago | (#29801271)

I mentioned Google's update in the last sentence of the summary.

Isn't it enough of a story to remind people that their data gets indexed and becomes searchable everywhere for an indefinite period of time if they post it to a personal website? It's easy to forget the ramifications of posting something online, especially when it has names, addresses, and phone numbers associated with it.

For example, even though Google has disabled access to these voice mails through their search engine, Yahoo's search engine now has them indexed as well. The data has propagated in ways users may not have expected or intended.

Re:Article is already updated (0)

Anonymous Coward | more than 3 years ago | (#29801587)

This might be news to my grandma, who has never heard of Facebook, Myspace, or the fact that public content on the web is crawlable by Google...

Re:Article is already updated (2, Insightful)

noidentity (188756) | more than 3 years ago | (#29801009)

"[...] we can certainly understand that users would want to make them [voice messages] public on their sites but not necessarily searchable directly outside of their own website. We made a change to prevent those to be crawled so only the site owner can decide to index them."

So in other words, Google supports robots.txt? Still, if you put them on your website, some search engine will index them. Moral of the story: don't make something accessible by anyone on the web unless you want anyone to be able to access it.

Re:Article is already updated (1)

Animaether (411575) | more than 3 years ago | (#29801267)

This seems a bit odd...

we can certainly understand that users would want to make them public on their sites but not necessarily searchable directly outside of their own website. We made a change to prevent those to be crawled so only the site owner can decide to index them

Don't we, and Google, usually tell people to use robots.txt if they want to restrict crawling?

Re:Article is already updated (1)

TubeSteak (669689) | more than 3 years ago | (#29801303)

Don't we, and Google, usually tell people to use robots.txt if they want to restrict crawling?

Indeed. I'm slightly confused by Google's wording.
Does the change prevent other search engines from indexing your voicemails?

Re:Article is already updated (1)

The MAZZTer (911996) | more than 4 years ago | (#29802521)

I wonder if Bing or Yahoo or other websites have the voicemails in their indexes as well?

If it's out there (4, Insightful)

El_Muerte_TDS (592157) | more than 3 years ago | (#29800969)

Like everything on the internet, if it's public, a web-spider will find it (eventually). But I'm seriously impressed by the speech-to-text engine Google uses, quite nice.

Re:If it's out there (1)

gravos (912628) | more than 3 years ago | (#29801159)

What's really impressive about it is that it's able to make any sense at all out of the terrible obscenely band-limited quality most phone messages are. I'm sure they have to use a bunch of statistical techniques based on their observations of common english text (eg, was "Dear aunt, let's set so double the killer delete select all" really what that person was probably saying?) to have any hope of producing something close to the correct answer.

Re:If it's out there (-1, Troll)

Anonymous Coward | more than 3 years ago | (#29801363)

Do they also support nigger english? Whattup fo'! Who dis! Holla! Aight!

Re:If it's out there (3, Funny)

zippthorne (748122) | more than 3 years ago | (#29801821)

Huh. I figured they just outsourced the translation to an indian sweat shop and the little checkbox next to the translation "was this useful?" results in a beating if you click "No."

Re:If it's out there (1)

Cal27 (1610211) | more than 3 years ago | (#29801245)

I agree, I've often wondered when Google is going to make a voice command and dictation program.
I guess you could always just dictate to your voicemail box until then.

Google voice to speech is (relatively) crap (3, Informative)

Fencepost (107992) | more than 3 years ago | (#29801387)

I've been experimenting with the voicemail-to-text transcription services out there, and compared to both GotVoice and PhoneTag the quality of transcription from Google Voice is something of a bad joke.

I understand that currently it's free (as opposed to $10+/month from the commercial services), and I have hopes that it will improve, but "quite nice" seems like a heck of a stretch at this point.

Anecdotally, here's an edited for privacy transcription from PhoneTag: "Hi, Alan. It's Nancy at Village Surgeons. My number is 123-456-7890. I'm following up on my e-mail that I sent you last week with regard to backup of our (quicken?) system here. (Paul Oddlastname?) was, had a concern that it wasn't backing up. So, I just kinda wants to touch base with you about that. When you have a chance. Give me a call. Thank you. Bye."

And here's an edited for privacy transcription from Google Voice today: "Hi Alan, it's gia Craig over at Northeastern collagen help topped and my computer is dead. It's definitely not working or managers on my phone's working. I checked the lines it doesn't look like. Anything's Unplugged, but I've pushed in any way you push the button to turn it on. There's no white that goes on movie then Maher of a machine starting. It's just absolutely dead and so could you do call me back and and come today. I do have to run over to delivery of the office for a few minutes this morning and then but I did not half hour. I might be at Colin's desk and that is extension 251. If I'm not at my own here and I'm 253. Thanks a lot. Bye bye."

Re:Google voice to speech is (relatively) crap (1, Informative)

Anonymous Coward | more than 3 years ago | (#29801869)

You're comparing automatic speech recognition to human transcription services. Why?

Re:Google voice to speech is (relatively) crap (1)

Mr2001 (90979) | more than 4 years ago | (#29802341)

Here's one I got a few weeks ago from Google Voice:

Hello voice subscriber what. Hey if you few questions for you. They can feel me 6 like a year like 2 years ago to like forever. Go you came over and I was locked out of the password didn't know the password so much and we wanted. Anybody passed it. I don't know how you guys have a good i just took it out for the first time in years and it says your class is expired. I must be changed and I go to that the windows X P professional you went and dollar dishing whatever it is really old addition, windows 85,001 yet and it's give me a change. Faster screen and says, administrative, which is still around. Funny has got hold us for new password. I confirm you got through. I've any idea what the password again, 30, or if you're more than the who knows no idea what it would've been so if you tell me but sister for you know the next week, otherwise, I was gonna go out to confirm for some a long time, so if you should come pick the and a case.

Appropriate (2, Insightful)

C_Kode (102755) | more than 3 years ago | (#29801061)

Was that appropriate? Posting that voice mail that has names numbers and locations?

Extremely poor ethics here at Slashdot.

Already explained by google, in TFA. (2, Informative)

gehrehmee (16338) | more than 3 years ago | (#29801079)

Could at least mention that the link you linked to has the express updated statement from google:

"Since the initial idea behind posting a voicemail, was precisely to share it with others, we did not restrict crawling of those messages that users post on the web, but we can certainly understand that users would want to make them public on their sites but not necessarily searchable directly outside of their own website. We made a change to prevent those to be crawled so only the site owner can decide to index them."

These are messages that people went out of their way to make public, via a URL with a hash. There's a question of whether there should have been a different type of authentication here, but this story is an alarmist knee-jerk reaction at best.

The Real Problem is ... (5, Interesting)

itzfritz (822208) | more than 3 years ago | (#29801097)

The real problem, IMO, is that Google Voice voicemails are world-readable to begin with. The only security is the URL scheme. If that can be reverse engineered, the privacy of all google voice users will be in danger. (fyi I have tested this myself. The url scheme is "https://www.google.com/voice/fm/20-digit account id/long b64 encoded binary string", and these urls can be viewed by unauthenticated users. Note the use of https; while no man in the middle will read my voicemail, the man on one end can ;)

Re:The Real Problem is ... (3, Insightful)

noidentity (188756) | more than 3 years ago | (#29801503)

The real problem, IMO, is that Google Voice voicemails are world-readable to begin with. [...] The url scheme is "https://www.google.com/voice/fm/20-digit account id/long b64 encoded binary string", and these urls can be viewed by unauthenticated users

And my gmail account is available to anyone who knows my username and an n-character string (hunter2, starred for obvious resons).

Re:The Real Problem is ... (1)

kybred (795293) | more than 3 years ago | (#29801653)

You know, if you type in your password, Slashcode will convert it to stars.

See I'll type in my password:

*********

Slashcode converted it to stars. Try it yourself!

Re:The Real Problem is ... (0)

Anonymous Coward | more than 3 years ago | (#29801713)

Let me try:

(null)

You see any stars?

Re:The Real Problem is ... (0)

Anonymous Coward | more than 3 years ago | (#29801743)

You know, if you type in your password, Slashcode will convert it to stars.

See I'll type in my password:

*********

Slashcode converted it to stars. Try it yourself!

oh, really?
you can go hunter2 my hunter2-ing hunter2
haha, does that look funny to you?

Re:The Real Problem is ... (1)

hldn (1085833) | more than 4 years ago | (#29802139)

oh, really?
you can go hunter2 my hunter2-ing hunter2
haha, does that look funny to you?

lol, yes. See, when YOU type hunter2, it shows to us as *******

Re:The Real Problem is ... (1)

93 Escort Wagon (326346) | more than 3 years ago | (#29801635)

The real problem, IMO, is that Google Voice voicemails are world-readable to begin with.

I'm not really meaning to argue, but I believe the biggest part of that "real problem" is that a lot of users simply don't care about the security of their personal information.

Quite by accident, I discovered that the transcripts are open to the world not long after my brother got a Google Voice account. He was commenting (via email) on the funny misinterpretation of a message I'd left him - he sent me the text and as chance would have it left the original link intact. When I clicked on it, I heard the message I'd left him! But when I told him about this glaring security problem (IMHO), he basically said "this isn't really a big deal".

Companies won't have much reason to pay real attention to security until a large percentage of their customer base forces them to pay real attention from the get-go.

Re:The Real Problem is ... (1)

BobPaul (710574) | more than 3 years ago | (#29801687)

Is that even true? If you choose "Download" and copy the URL it gives you for the wav file, you can't use the link unless your logged it. It's my assumption that to get a public URL of the scheme "google.com/voice/fm/*" you need to first choose the option to e-mail a voice mail and include a public link. Perhaps that's a poor assumption on my part. Do we have evidence that it's one way or the other?

Re:The Real Problem is ... (2, Interesting)

Omnifarious (11933) | more than 4 years ago | (#29802349)

And, you know, if I 'reverse engineer' the right bunch of binary digits I can read all the credit card information in your https transactions. That bunch of binary digits being your AES key.

If Google was in the least intelligent, that string would either be a random number or a hash (basically a random number if you don't know the exact data that went into it) of the voicemail contents plus the user and some other stuff. Personally, I expect they are in the least intelligent and that the URL is about as 'reverse engineerable' as the AES key your browser used to talk to the place you bought your latest motherboard from.

Re:The Real Problem is ... (1)

farnsworth (558449) | more than 4 years ago | (#29802977)

The real problem, IMO, is that Google Voice voicemails are world-readable to begin with. The only security is the URL scheme.

http://some-site/some-service/some-item/2bdccb1f-08d9-4f0d-a270-bc061f0c475f [some-site]

http://some-site/some-service/some-item?user=youruserid&password=12345 [some-site]

Which is more secure? "Authentication" is just a URL, after all. (true, posts are handled slightly differently by browsers, but it's essentially the same as a get. It's all http in the end.)

I like obfuscated URLs since I don't have to create a new thing to remember to access it. I can just look up the URL in my mail client or whatever. And I don't believe that it significantly reduces the access control. Let me know if I'm wrong.

my favorite (so far) (3, Funny)

gEvil (beta) (945888) | more than 3 years ago | (#29801119)

Re:my favorite (so far) (1)

nschubach (922175) | more than 3 years ago | (#29801789)

Murder in progress, definitely. My guess is the assailant is a demented clown from the sound of the laughing...

Re:my favorite (so far) (0)

Anonymous Coward | more than 4 years ago | (#29803771)

An interesting one I heard posted on another site... here's the comments from the person who posted it.

it's apparently a conversation between thach nguyen and his psychiatris http://www.thachnguyen.com/

The most fucked up part is at 11min where the doc tell him that he needs to stop helping other people through the work he does.

The doc is talking shit the entire time.

Scientology was right all along...

They were talking about this voicemail [google.com].

Looks like (0)

Anonymous Coward | more than 3 years ago | (#29801277)

kdawson figured out timothy's password.

data posted on the internet found on the internet! (2, Interesting)

Kenja (541830) | more than 3 years ago | (#29801297)

Dont want data to be found online? Dont put it out there for people to find.

Total non-issue.

There is no free lunch... (0)

Anonymous Coward | more than 3 years ago | (#29801407)

... or free service. No business will give you anything for free. You pay for google services with your privacy. Some people find that this is a fair trade, others use secure services with guaranteed privacy, like xebba.com [xebba.com] in exchange for the service fee.

Voice MailSSSSS? (0)

Anonymous Coward | more than 3 years ago | (#29801661)

What are mails? It's mail. Not mails. Learn it, love it.

Catpcha: pointing... pointing out small mistakes?

Google is Big Brother? (-1, Troll)

Orion Blastar (457579) | more than 3 years ago | (#29801777)

Is this a violation of privacy via Google Voice? We already know Google allows us to search our GMail email files, what if they too get made public? Google Voice Mail files should only be readable/audio to the person it is assigned to and not made public for everyone to listen in to.

The text to speech of Google Voice is clearly vary good. Almost as good as the Vonage text to speech in voicemail.

But I don't want to use Google Voice Mail if Voice Mail is made public. This is a security problem for Google who should have known better. Voice Mail should be private unless the owner wants it published like for example in a law suit or something where it is used as evidence.

Re:Google is Big Brother? (2, Informative)

bendodge (998616) | more than 4 years ago | (#29802389)

Google only hides the voicemail files with a monster-long URL. Though served over https, they are still world-readable. This is not an accident. This is deliberately done so that one can post a link to it somewhere else (email to coworker comes to mind) and they can hear it. Google did not simply forget to have access control; they purposefully chose this way over the Docs' everyone-must-signup-for-any-reason style.

Now, some morons have posted those voicemail URLs on public sites, along with the text translation. Along came a spider and sat down, er, crawled over them. These URLs and texts then appeared in search engines.

There's really no shock here. If I post links to my family photo gallery, everyone will see those, too, unless I have an account-based system which requires all my relatives to jump hoops in order to get access. Google tried to pick the lesser of two evils - whether they picked the right one I don't know.

The voicemails were published (not by google) (1)

mysidia (191772) | more than 3 years ago | (#29801957)

Other websites provided links to the voice mails.

Google gives each voicemail a secret URL. If you choose publish the secret URL of one of your voicemail messages, then the voicemail message is no longer secret.

Google's search service was just making URLs of messages that has been published searchable.

Any search engine could and (does) index the very same.

GoogleBot doesn't have any privileged access to index Google Voicemail messages that the account holder didn't make public (by publishing URLS to)

If you ask me, however: I think Google Voice should default to only allowing the account owner to see messages.

If you want to "share" a message, there should be a flag you need to set on the message to make it publicly visible (that you can later revoke), or an account-wide setting you need to turn on before you can share messages.

This way, people who don't normally share their messages will have a protection more like what they are familiar with re. E-mail.

As far as I know, you can't (yet) publish a Gmail.com URL online and let other people read one of your e-mail messages... what justification is there for Google Voice to be different by default?

Most people do not commonly publish their voicemail messages, although some might wish to share with friends.

An issue is that voicemail messages generally include phone numbers, and these are generally considered personal/private.

It is poor etiquette to publish someone else's phone number without permission.....

Therefore, a (suitable) privacy default for shared voicemail, should in some manner censor phone numbers (such as by replacing with a handle, alias, or nickname)

Re:The voicemails were published (not by google) (1)

nog_lorp (896553) | more than 3 years ago | (#29801999)

I assumed it would be set up like GMail documents: you click a "publish" button, and a link is enabled + given to you to publish. Can anyone confirm/deny this?

Re:The voicemails were published (not by google) (1)

mysidia (191772) | more than 4 years ago | (#29803363)

Not exactly.. how it works is each message has a "More" link, you click the link, you choose "Embed" or "Email" from the menu, and it either prompts you for an e-mail address to send the link to, or for Embed, it displays some HTML code to allow you to embed the message on your web site, for Email you check a box "include a link to this message".

BGR isn't the "exclusive" first story (1, Interesting)

Anonymous Coward | more than 3 years ago | (#29802031)

BGR stole it from 4chan's /g/ (technology) board last night. See Google's index [google.com] for proof. We were discussing it at 2AM, someone tipped off google, and BGR saw it on 4chan & reported on it. They misrepresent themselves as the story source, though.

ehh (1)

cl0s (1322587) | more than 4 years ago | (#29803101)

I understand this is not necc Google's fault but their fix doesn't necc stop Yahoo or Bing from crawling it. I mean if you want to share your voicemail on your blog its like girls who post pictures wearing a bra and panties in the bathroom mirror on myspace, you can't be too mad when someone you didn't want to finds it.

I do agree they should make the voice mail completely private and only activate the URL from outside if specifically "shared". Funny because less than 10 minutes ago I setup my G1's voice mail to forward to Google Voice so I can use it as visual voice mail (works great by the way) -- didn't know this was going on though.

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...