Google Plus to shut down after massive data leak

Coding error found to have exposed half a million accounts after Project Strobe API review

Google is shutting down Google Plus after it not only failed to gain traction with people happier with the likes of Facebook and Twitter, but also because it discovered a massive data leak affecting up to half a million users.

In a blog post, Google said that after a major security review, dubbed Project Strobe, the social networking service would close. The review found a sizable flaw in Google Plus APIs that meant malicious apps could extract data such as the name, email address, occupation, gender, and age from a person's profile.

"It does not include any other data you may have posted or connected to Google+ or any other service, like Google+ posts, messages, Google account data, phone numbers or G Suite content," said Ben Smith, Google Fellow and vice president of engineering.

Smith said that "the Profiles of up to 500,000 Google+ accounts were potentially affected." However, Smith added that the API's log data is only kept for only two weeks and analysis showed that up to 438 applications may have used this API.

"We found no evidence that any developer was aware of this bug, or abusing the API, and we found no evidence that any Profile data was misused," Smith said. 

Google's Privacy & Data Protection Office reviewed this issue to look at the type of data involved to see if the firm could accurately identify the users to inform, whether there was any evidence of misuse, and whether there were any actions a developer or user could take in response, according to Smith.  "None of these thresholds were met in this instance," he said.

Smith said that despite Google's engineering teams putting in a lot of effort, "it has not achieved broad consumer or developer adoption, and has seen limited user interaction with apps. The consumer version of Google+ currently has low usage and engagement: 90 percent of Google+ user sessions are less than five seconds."

Google Plus will come to an end for consumers next August, but business users will still be able to use the service as an internal corporate social network.

The firm has also promised to institute new security rules, including limits around the types of use cases that are permitted to access consumer Gmail data.

"Only apps directly enhancing email functionality - such as email clients, email backup services and productivity services (e.g., CRM and mail merge services)will be authorised to access this data," Smith added.

Google will also remove access to contact interaction data from the Android Contacts API within the next few months. In addition, Google Account permissions dialog boxes will be spilt to show each requested permission, one at a time, within its own dialog box.

Featured Resources

Preparing for AI-enabled cyber attacks

MIT technology review insights

Download now

Cloud storage performance analysis

Storage performance and value of the IONOS cloud Compute Engine

Download now

The Forrester Wave: Top security analytics platforms

The 11 providers that matter most and how they stack up

Download now

Harness data to reinvent your organisation

Build a data strategy for the next wave of cloud innovation

Download now

Recommended

The IT Pro Panel
Business strategy

The IT Pro Panel

26 Jul 2021
2031: Reimagining the future of life and work
Business strategy

2031: Reimagining the future of life and work

25 Jun 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

26 May 2021
Getting everyone on board with the corporate vision
Business strategy

Getting everyone on board with the corporate vision

13 May 2021

Most Popular

RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021
Zyxel USG Flex 200 review: A timely and effective solution
Security

Zyxel USG Flex 200 review: A timely and effective solution

28 Jul 2021
Preparing for AI-enabled cyber attacks
Whitepaper

Preparing for AI-enabled cyber attacks

22 Jul 2021