Google adjusts Buzz setup for privacy, makes 'public' choice more obvious

Already sensing that too many potential users were attributing the "evil" moniker to Google (in the absence of actual evil in the world), the company yesterday made adjustments to its Google Buzz sign-up procedure. In Betanews tests, we found Google's altered dialog box is much more descriptive about the repercussions of setting up a public profile. It uncovers a critical choice about what you share with others publicly, that had been buried beneath an Edit link, by copying it up front where everyone can see it.

The danger involved with a new user setting up Buzz without being mindful of its default consequences, is that her public profile can be automatically filled with the names and profile links of Gmail contacts she communicates with most. Betanews tests this morning indicate that changes Google has made to Buzz setup appear to reduce that danger somewhat:

• When a Gmail user logs in from the Web and is invited to try Buzz for the first time, a dialog box gives that user an opportunity to find people to explicitly follow by default. We noticed that when the user starts typing in names, Buzz does attempt to auto-complete those names, using a list of contacts from the Gmail account. However, at this point in the process, Buzz did not gather those same names into a list of people to be automatically followed, and that's a big difference. Here, the user is effectively creating a new default list of people to follow that is devoid of automatic references from Gmail. If she starts her Buzz setup by accepting this invitation, she may be able to avoid inadvertently publishing her list of followed members to the world right away.
• The dialog box for editing one's new Buzz-compliant profile now appears the first time the user tries to enter a comment into Buzz (the equivalent of tweeting). But at this point in time, the user's Google profile is not public. That's significant, because it means information the new user is just now entering into Buzz isn't being broadcast to Google's search caches, before she has an opportunity to make it private.
• The revised dialog box at this point now includes the Show the list of people I'm following and the list of people following me on my public profile check box -- which had been buried behind an Edit link -- up front, as well as behind the Edit link where it was before.
• Although Buzz urges the new user to create something called a public profile, the degree to which Google publicizes that profile to the world depends on two factors: 1) the amount of information the user includes in it; 2) whether the user opts to give her profile a public URL. Although signing up for Buzz does result in the creation of a "public profile" of sorts, it is only directly viewable to Buzz users (and perhaps, through a circuitous route, to other Google social services, such as Google Talk). That profile page will include a list of entries shared via Buzz, which does include tweets made using Twitter. It will also include links to the Buzz user's lists of followers and followed contacts, but only if the user allowed them to be visible to others. Yes, visibility is the default choice, but that choice is no longer buried. And until the user fills in profile details such as career, location, and a list of one's superpowers (yes, that's one of the blanks provided in Google Profile), it cannot be searched from the Web.
• Google Profile pages created by Buzz are only "public" by default in a limited sense. Specifically, for a Google profile to be searchable, one still has to edit her profile page manually, outside of Buzz. Checking the option at the very bottom enables anyone to browse to http://www.google.com/profiles/Gmail_name, thus giving everyone -- even non-Buzz users -- access to what the user is buzzing. Although this isn't stated explicitly, enabling this option is what makes the profile searchable like a public Web page, with results that show up in Google searches. Buzz does not check this option by default. Until the user checks this option, the profile page's URL does not include the user's Gmail name, but rather a large integer at the end. So although it is technically public, it's not something that's designed to be given away, and no one is likely to be able to guess that integer's 21-digit value.

Google's changes do set up a few new speed bumps along the way to creating a Buzz profile, which new users will notice, and many may not appreciate. We know from experience how folks reacted to the abundance of security warnings shouted out by Windows Vista. But when making folks aware of the security risks inherent in doing things automatically, this is a good thing. And the fact that one's Google profile page is not broadcast to Google's searchable caches by default, gives Buzz users an important safeguard.

4:50 pm EST February 12, 2010 · Today on his personal blog, a white-hat hacker who only goes by the name theharmonyguy announced that he had discovered how one can use Picasa to learn the Google username -- the Gmail name -- of any Google user (who is, unofficially, a Picasa user) using the long-integer numeric profile address. With this method, a person whose "public Buzz profile" is only public in a limited sense, could become public in the literal sense.

"With the introduction of Buzz, Google is encouraging users to take advantage of Google profiles," he wrote. "But in the process, Google is tying together services that many users may have treated quite distinctly in the past. If you want your Gmail address to remain private, you need to manage properly the other Google services you use to avoid one of them exposing your Gmail username."