Google's next attempt at a more secure Buzz may take a few more days

A Google spokesperson confirmed to Betanews this afternoon that a second round of privacy changes, the nature of which was revealed last Saturday evening, is still being developed, and may yet go live "in the next couple of days."

Among those changes will be a more obvious way to turn Buzz off (no pun intended), a feature that remained obscure after the service's first round of privacy changes last Thursday. At that time, Google chose to un-hide an option that new customers may easily have ignored: to not only build a list of followers from existing Gmail contacts, but to publicize that list on the Buzz user's public profile. Depending on what other Google services the customer may have been using, that profile could possibly have been visible to anyone, including non-Buzz users.

On Saturday, the company announced it would change Buzz again, not with regard to profiles (which will apparently continue to be made public, if only to other Buzz users, by default) but rather, followers. As Buzz product manager Todd Jackson wrote, "Starting this week, instead of an auto-follow model in which Buzz automatically sets you up to follow the people you email and chat with most, we're moving to an auto-suggest model. You won't be set up to follow anyone until you have reviewed the suggestions and clicked 'Follow selected people and start using Buzz.'"

Google's mockup of Buzz's new "auto-suggest" list, produced Saturday, appears to collect a larger swath of Gmail contacts for possible inclusion than the "auto-follow" list demonstrated last week. What we will not know until the rollout date (Google is not providing further details until then) is how this process would make a material difference over the method Buzz uses presently. Specifically: At present, Buzz gives the new user a more direct option for seeing the list of people who will be followed. Assuming the user finds and activates this option, he can then uncheck those people from the list he does not want to follow, and then click Save profile and continue. At that point, he's a Buzz user, and whomever he didn't uncheck is now a followed contact.

Under what appears to be the new system (we won't be able to test it ourselves until it's finally rolled out), it's no longer a question of whether the user sees his contacts. He will see them, and he will be given a chance to uncheck the ones he doesn't want, before clicking on a new button labeled Follow selected people and start using Buzz. At that point, he's a Buzz user, and whomever he didn't uncheck is now a followed contact.

From that perspective, it doesn't appear to matter whether Buzz enrolled a cavalcade of Gmail contacts into the user's Buzz profile before he removed them and launched his own Buzz status, or refrained from enrolling those contacts until the user reviewed the list. Or in short, whether we call it an "auto-follow" or an "auto-suggest" model may not actually matter, except to the extent that it may change the public's perception of how Buzz implements its privacy model. What will change for certain is that all incoming users will see their list of suggested contacts prior to signing up.

Also over the weekend, Google essentially admitted it was not the best of ideas to assume that items already shared through Picasa and Google Reader, on a local basis, should become automatically shared through Buzz; new users were discovering they were already sharing Picasa photos without ever having given their permission. What we have also yet to see next week is whether Buzz users can still make use of a trick that a security engineer discovered last Friday, to use Picasa to ascertain one's semi-public Google Profile URL as though it were a fully public one.