NOVEDGE blog

Google Docs Security Seriously Compromised?

I don't consider myself a geek, but I'm always intrigued by new technologies, products, and ideas. I can't hold on my curiosity, I have to try new things. When Google released a new service called Google Docs based on Writely, claiming to have a sort of online alternative to Microsoft Office, I immediately opened an account and started playing with their word processor. I used Google Docs mostly as a notepad for my blog posts. It has the great advantage of allowing me to write from the office and then continue from home without having to change any settings on my computer or the network. Despite these advantages, after some time I considered abandoning the Google environment because I was still finding the word processor too primitive even as simple notepad.

On September 17 Google officially announced a new feature for Google Docs, a sort of online PowerPoint clone. I immediately logged in to my Google account to try the new tool. On the Google Docs page I noticed something unusual: the list of documents I created included a few unknown items. The first three documents, pictured above, were not mine, nor were they shared with me by someone else. Opening them, I found them to be written in Italian (my primary language) but absolutely not something I could have created. They seem to be written by someone in the book publishing business, obviously an Italian. A very wild guess is that the documents were created by someone from Fernando Folini Production, a minor Italian publisher with no relationship with me, although our surnames are the same. But this this is just a guess.

Someone wrote a document with Google Docs, didn't share it (as you can see on the picture), and Google misplaced the document assigning the document to a different user (me) instead of the correct author's directory. I wonder if there is an author out there who is missing a document?  This is exactly the kind of breach of security that you absolutely don't want to happen with your personal or business documents. Before putting anything more on Google Docs, I would like to know the origin of this problem. I leave the comments to my blog readers.

Franco Folini

From Google Docs Help pages
What measures is Google taking to protect the privacy & security of my content?
Rest assured that your documents, spreadsheets and presentations will remain private unless you publish them to the Web or invite collaborators and/or viewers. Once you're logged in, you can grant access to whomever you'd like. Until then, your documents, spreadsheets and presentations are private.

UPDATE September 22, 2007
I ran a Google search with some of the sentences in my more foreign documents and I found that they came from an Italian library, the Biblioteca Giuridico Economica Giovanni Ghirotti, located in Cesena. No relationship with me, I didn't even know this library existed before running the Google search.

Is Google Fair?

Let’s start with the facts.

A few days ago I was working at the data feed for a Google service called Google Base, previously known as Froogle. It’s an online service that allows sellers to upload a list of products with price and description and lets users search online for products to compare prices, shipping fees, and seller ratings.

for Google Base, PayPal is not a syntactically valid option

The new Google Base accepts a feed in a few different formats. One of the most flexible formats available is RSS 2.0, a popular XML format.
The accepted payment type is among the optional information sellers can provide for each product. The following is a snippet of the XML code I submitted to Google. I’m confident that you don’t need to be an XML guru to understand this code:

<g:payment_accepted>
    MasterCard
</g:payment_accepted>

<g:payment_accepted>
    Visa
</g:payment_accepted>

<g:payment_accepted>
    PayPal
</g:payment_accepted>

A few hours after the upload I received a notification that the syntax of my XML feed was not valid. Here is the error message I got:

cvc-enumeration-valid: 
Value 'PayPal' is not facet-valid 
with respect to enumeration 
'[Cash, Check, Cheque, Visa, MasterCard,
Discover, AmericanExpress,
WireTransfer, GoogleCheckout]'.
It must be a value from the enumeration.

Translation in plain English: You specify that your online store accepts payment by Visa, MasterCard, and PayPal. For Google Base, PayPal is not a syntactically valid option, while GoogleCheckout is.

Is this just an oversight? Should we blame the omittance of PayPal on a Google programmer who perhaps forgot to include PayPal (Google Checkout's competition) in the list of payment options?

Or is this a poor implementation of the Google motto “Don’t be evil”?

Franco Folini

P.S.: According to this online Google Base Schema (line 419) PayPal is a syntactically valid option for payment, while Google Checkout is not even listed.  I guess this is not the Schema used to validate my feed. I would not recommend to check the XML schema if you are not familiar with XML.