Google Loses Trust with Sitemaps

[rustybrick]

Basically, if you sign up with a Google Account, accept Sitemaps TOS and then add AOL.com and other sites to your list, and then verify, you can see their stats!!!!

Dave has a ton of info at http://www.davidnaylor.co.uk/archive...ogle-sitemaps/

I got some screen shots at http://www.seroundtable.com/archives/002826.html

Google!!!!!

[dannysullivan]

Major Security Flaw With Google Sitemaps Stats up on the SEW Blog lacks the cool screenshots Barry and Dave have but explains things in a little more spelled out detail.

[TwisterMc]

Just remove or rename the file and no one else will get access to your stats as they won't be able to verify your site.

[dannysullivan]

You don't understand. If your site isn't putting out proper 404 errors, renaming or removing the file does nothing. That's because the server itself would still be saying that the file was found just fine.

[TwisterMc]

Oh. I just tested it on my site and I must have proper 404 errors as I can't verify it anymore. But I do agree, Google has some fixing to do. I think the verify code should change every time someone adds a new site to their Google Site Map admin area. That way the code would be truly unique.

[simons1321]

I was thinking about this exact topic this morning when I noticed yesterday that a site I have listed in Google Sitemaps which was not previously verified (due to monstercommerce server header issues) was now mysteriously verified! Hmmm... not good

[erik]

This doesn't relate specifically to error codes and their relationships to Google Sitemaps, but I posted a while back about how Microsoft IIS platforms seem to be particularly susceptible to giving off the wrong error codes on 404 pages.

[dannysullivan]

Overall, this was a bad way to do things. It should have at least been tied to putting a file with SOMETHING in it, rather than the existence of a file at all.

Let's get productive. How should they rebuild security?

I can see having to put code in robots.txt, easy to do, and nice way to say you want control over the entire domain.

Something page-based also makes sense. But JavaScript on a page at the root level, seems hard for someone to fake.

[DaveN]

yep a include on the homepage, or a file with with the google code inside it so it has something to actually verify, not just the file maybe be there.

DaveN

[AussieWebmaster]

Hey they will be sharing info soon anyway once Google Analytics is more pervasively used.....

[rustybrick]

Seems like its not working anymore.

Please confirm...

[simons1321]

yeah i tried to verify a couple sites just for fun and even my own(see above post) on a different Google account and I cant add that one either.

[esoos]

Anybody see the line in this recent Fortune article about Google's product development:

Hundreds of projects go on at the same time. Most teams throw out new software in six weeks or less and look at how users respond hours later.

Perhaps they'll want to rethink that process.

[donelson]

Yes, I had an old 404 redirect to one of our home pages, and Google flagged it when I Verified. I had to add a 404error page to get it to verify, so they have closed that hole.

[Chris_D]

Google seems to be more interested in announcing the products, rather than the products themselves.

Its amazing the privacy issues/ breach of trust issues that seem to be arising in such a short space of time.

As a new SEW member points out here - http://forums.searchenginewatch.com/...7&page=3&pp=20 - read para 6 of the Google Analytics TOS:

....Further, Unless You notify Google otherwise in writing, Google and its wholly owned subsidiaries retain the right to identify You as a valued customer and optionally issue a press release that, at a minimum, discloses You have licensed the Product and that the Product is Your preferred web analytics package.

http://www.google.com/analytics/tos_en-US.html

Over at WmW, http://www.webmasterworld.com/forum30/32090.htm someone claims to have been able to make an e-book from a copyrighted work, and break their security.

And now Dave N comes through with this!

[Head SEO Bull]

Hi,

thanks Chris_D for finally being the first to acknowledge my posting re the TOC of GA! I thought I was imagining things there, because no-one replied.

I'm that NEW member. Glad that my first posting got mention on this forum. Everyone, PLEASE read para 6. Read it again.
Hopefully these are not precedents of things to come.
Google Analytics shall not be "my preferred web analytics package"
Google, please take this as my written statement to that effect.

[PhilC]

Originally Posted by donelson

Yes, I had an old 404 redirect to one of our home pages, and Google flagged it when I Verified. I had to add a 404error page to get it to verify, so they have closed that hole.

I have the same problem - returning a useful 200 page when a file doesn't exist, but I'm not going to change that usefulness just to get the site to verify. Google really should adopt a different verification method. I suppose I could add a line in the .htaccess file just for Google's 404 probe.

<added>
yep - that worked.

[donelson]

Originally Posted by PhilC

I could add a line in the .htaccess file just for Google's 404 probe.

<added>
yep - that worked.

What line?

[PhilC]

RewriteRule ^GOOGLE404probe.* [R=404,L]

It returns a 404 when any file that starts with "GOOGLE404probe" is requested. It works fine with the exact URL, but you'd need to get that from your logfile - that's if it doesn't change each time.

The actual URL is that, followed by a long hex number, and ending in ".html". e.g. "GOOGLE404probe57ea3456789024bd.html"