172

Today I've googled for my phone number and received an unexpected result (the 3rd one here):

Google search

I'm concerned about a few things now:

  • I don't remember when I provided my phone number to Stack Overflow.
  • I don't want people to be able to find my name by my phone number.
  • I can't remove it via account settings.

Why did this result appear in Google search? There is no phone number displayed in my CV. Well, I think that's because my number is specified in the CV page source code.

Some CVs affected by the issue:

(Right-click on a page, choose 'View page source', and search for "phone")


My questions:

  1. How does StackOverflow know my phone number?
  2. Why does StackOverflow disclose it? Is it intentional?
  3. How can I remove this search result? (I think the best way would be to remove a phone number from the source code.)
13
  • 23
    Thanks for the post. We're looking into it now and will provide an update shortly.
    – Kit
    Nov 28, 2016 at 11:30
  • 44
    Maybe posting this to meta wasn't such a good idea. I'd consider this a security flaw, and SE advises to report security issues with the contact form only: stackexchange.com/about/security
    – Magisch
    Nov 28, 2016 at 11:44
  • this is fixed i think ....But still appearing in Google results.
    – Sandeep
    Nov 28, 2016 at 11:58
  • @Magisch yes, maybe. I'm thinking about deleting this question. Nov 28, 2016 at 12:03
  • 9
    This has now been fixed. We're still investigating and I'll post an update later today.
    – Kit
    Nov 28, 2016 at 12:06
  • 1
    @Kit Thank you! It would be great to get an answer for the first question anyway. Nov 28, 2016 at 12:08
  • @naXa indeed. I'll provide an answer shortly.
    – Kit
    Nov 28, 2016 at 12:09
  • 8
    SO Staff, hotfixing security issues on production server in two hours tops since 1989™ Nov 28, 2016 at 15:49
  • 4
    @Lafexlos Kudos for editing the image to remove the phone number - when doing this, it's worth flagging for a moderator to clean up the rest of the revision history as they can redact info from other revisions too. (I've already flagged and waited for it to be done before mentioning it, before anyone goes looking!) Nov 28, 2016 at 15:57
  • @James Thorpe: already handled.
    – BoltClock
    Nov 28, 2016 at 15:58
  • @BoltClock It is now, it wasn't when I flagged :) Nov 28, 2016 at 15:59
  • @James Thorpe: I went to look for your flag only to realize it was already handled :(
    – BoltClock
    Nov 28, 2016 at 16:00
  • @BoltClock Yeah, sorry for the confusion - has literally been the last couple of minutes Nov 28, 2016 at 16:00

2 Answers 2

68

Thanks for finding this. We've fixed it immediately as it was never supposed to be exposed information.

The phone number is listed under your Job Match preferences and would be used as a way for employers to contact you if you have expressed interest in being contacted or when you’ve applied for a job. Should you want to change or remove the phone number from your profile, that is where it is located.

The only place the phone should ever been seen is to you as the user in your settings, to employers who you expressed interest in or applied to a job for, or on the PDF view of your Developer Story. We never meant for this to be exposed elsewhere and the issue has been fixed.

Thanks again for reporting this!

20
  • 13
    OP wrote "I don't remember when I've provided my phone number to Stack Overflow.". Did they simply forget? Nov 28, 2016 at 12:54
  • 6
    Yes i't entirely possible @AndrasDeak it's not like we got the phone number from anyone else or from anywhere else. But to be specific, the number was on their CV in Careers.
    – Taryn
    Nov 28, 2016 at 13:01
  • 24
    @AndrasDeak yes, I suppose I have been drunk while filling this in. Nov 28, 2016 at 13:02
  • 23
    Is there going to be a proper announcement / "post-mortem" stickied on main so people actually know you leaked their information to the public, during what period and what information?
    – PeeHaa
    Nov 28, 2016 at 14:08
  • 18
    @PeeHaa The team is meeting later today to discuss post-mortem and next steps.
    – Taryn
    Nov 28, 2016 at 14:51
  • 7
    Good time to bring up that the Safe Harbor self-certification expired last August 2nd. Nov 28, 2016 at 15:10
  • 2
    @bluefeet Any update? Nov 29, 2016 at 10:35
  • 14
    @JayIsTooCommon We got most of the information that we need in order to fully understand what happened, how, why, for how long, etc and we're working very hard to mitigate any potential future inconvenience for users that were affected by this bug. Once we're certain that we've done that to the absolute breadth of our abilities, we'll be posting a very transparent post-mortem with all of the details, including what we've got in place to detect and prevent this sort of thing from happening again. Please be patient, and please stay tuned :)
    – Tim Post
    Nov 29, 2016 at 14:18
  • 3
    @TimPost I would like to inform you that Google has updated their caches recently and there is no more my CV within search results. =) Thank you for the quick fix! We are looking forward to hear more details about this bug. Nov 29, 2016 at 18:51
  • 2
    Just a friendly reminder that it has been two weeks since the public disclosure here. We can haz post mortem? @TimPost
    – PeeHaa
    Dec 12, 2016 at 12:12
  • 2
    @JayIsTooCommon clean-up as in we're doing our due diligence with various search engines to make sure anything cached is gone. We want to make sure that we've done everything possible on our end.
    – Taryn
    Dec 12, 2016 at 16:37
  • 5
    It's been a month since this has been made public by this meta post. I realize your are waiting for search engines to clear cache, but the information is already out there and have been for at least a month. Don't you agree it's getting kinda silly waiting around hoping 3rd parties will magically purge their history while the information is already available on your own site in the form of this meta post?
    – PeeHaa
    Dec 28, 2016 at 9:58
  • 2
    @bluefeet Surely this has gone on long enough and users should now be officially made aware of this? Jan 4, 2017 at 8:36
  • 4
    @JayIsTooCommon I totally appreciate your concern. It's the nature of the incident that took us this long, because cleaning it up to the very best of our ability required coordination and cooperation from so many different third party services (e.g. Google, Yahoo, Yandex, Etc, etc, etc, etc). I'm posting something today or tomorrow as we're finally at the point where we feel it's okay to shine a bigger light on it. It's not us being tight-lipped, I promise. It's us just being a bit fanatical about cleaning it up prior.
    – Tim Post
    Jan 4, 2017 at 13:46
  • 13
11

This also happens to me if you google your email in double quotes...

 "[email protected]"

I get a result of my Stack Overflow CV that has no mention of my email on that page.

enter image description here

6
  • 1
    The bug has already been fixed (per @bluefeet's answer), it'll take some time for search engine caches to be refreshed.
    – user247702
    Nov 28, 2016 at 16:06
  • 2
    @Stijn I am on about emails, not mobile numbers. Unless there both fixed?
    – Matt
    Nov 28, 2016 at 16:07
  • Yes, email addresses were also affected by that same bug, so both issues are fixed.
    – user247702
    Nov 28, 2016 at 16:07
  • 12
    @Matt This was fixed with the phone number.
    – Taryn
    Nov 28, 2016 at 16:15
  • @Stijn Ah ok excellent!
    – Matt
    Nov 28, 2016 at 16:17
  • @bluefeet Excellent :)
    – Matt
    Nov 28, 2016 at 16:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .