I’ve been outed by Google

If you’re at all variant in American society in a way that doesn’t scream serial killer, whether your variation is sexual (as in “Hi, everyone, I’m queer!”) or it’s the fact that you really, really, really thought that Voyager was the best installment of the Star Trek TV franchise, coming out of the closet can be both a joy and a relief. When that coming out is something you choose to do it happens because you’ve finally reached a point where your own comfort with who you are is more important to you than society’s often arbitrary and exclusionary mores. Getting outed, though, is painful no matter what. It’s especially painful when it happens because a technological system fails to work in the way it’s been advertised to work.

Much has been made of Google and its potential to abuse the massive amount of data it is collecting both in aggregate and about you personally when you’re logged into your iGoogle account. Google has been accused recently of participating in Chinese government sponsored censorship and of failing to comply with California’s online privacy laws by making their privacy policy difficult to find. And while some of the critiques of Google may present slightly paranoid, it says something about the power of the data they collect that over two years ago the U.S. Justice department issued subpoenas to all of the major search engines as part of their attempt to enforce a controversial anti-pornography law.

Though the Electronic Privacy Information Center’s Gmail FAQs is a comprehensive, well thought out list of reasons why you shouldn’t use Gmail it doesn’t mention Gmail’s one major flaw: it can expose your identity without your knowledge.

See, Gmail has this great feature that allows you to retrieve e-mail from other accounts into your Gmail box. Handy for people like me who have multiple e-mail accounts separated by function – one e-mail account for social networking, one for neighborhood political activities, one that fronts my blog identity – but who don’t want to have to log in and log out of several accounts multiple times per day. Ostensibly with your Gmail account you can set different identities in your umbrella account, the one that you’re using to pull from all your other e-mail, so that when you send e-mail to your boss telling him you’re sick it doesn’t come from cupcakelover56 it comes from Jill Jones. What Gmail doesn’t tell you with these identities is that each e-mail that’s sent carries your umbrella address with it.

When the Compose window looks like this:

it implies that your e-mail will be received as being from you with no association to any other e-mail address. Unfortunately, that’s not the case. Check it out: This message was sent from my umbrella account (that’s my blog-fronting address) but was sent using my “professional” identity.

That blur at the top is my actual name. The blur at the bottom is another of my e-mail addresses. But that thing in the clear, that’s the address of the umbrella Gmail account I used to send the message.

I found this out this out the hard way: by finding my blog-identity e-mail address associated with my real name in documents that are part of the public record relating to the siting of a charter school in my neighborhood.

So whether you’re trying to separate your Facebook identity from your identity as a level 70 Tauren Druid, beware of Google’s hidden privacy flaw. Otherwise, your boss might be getting e-mail from BromopneaDruid without you ever knowing it.