Now it is Google+, Google’s social network, which is strewn with a vulnerability that was corrected at the time it was discovered, in March last year.
According to a new report in the Wall Street Journal, Google+ had a vulnerability in one of its APIs that allowed third-party developers to access private (non-public) data from Google+ user profiles, a vulnerability that existed between 2015 and 2018.
Through an analysis conducted by Google as part of the Project Strobe program, the company found that the vulnerability could have potentially affected up to 500,000 user accounts through some of the 438 applications that used the affected API.
In addition, the company stated in a statement that it had not found any evidence that a developer was aware of this vulnerability, nor had it found any evidence of the misuse of affected profile data.
According to the WSJ, Google did not want to make the existence of this vulnerability public at this time, fearing regulatory intervention and the resulting damage to its reputation. Among other things, Google has announced the closure of the consumer version of Google+, which gives users 10 months to obtain and migrate their data using a range of tools.
But Google+ will not disappear completely and will remain available as a business product with new features.
In addition, they announce the release of greater control over users when they grant permissions to applications, they will limit the cases in which applications can request permissions to access Gmail data for end users, and they will also limit the ability of mobile applications to access call logs and SMS on Android devices.