Can webpages using the Google plus button get my name?

Question

When I'm logged into my Google account, and I visit a web page that contains the Google Plus "+1" button, does a script have access to my name, even if I don't interact with the Google Plus widget?

Answer 1

No, the page you access does not get your name or any other data from Google.

If you have a close look the button is in an iframe. An iframe is technically like a webpage in another window. Because of the same origin policy those pages can not interact with each other.

The only way the page can get personal information about you is over the Google API. Like if you login to this page using your Google account they can request data about you but this transfer needs to be granted by you.

Answer 2

I did some research on this in 2012 for a blog I was working on at the time. However, my research was more tailored to what a webmaster can see after a user clicks the +1 button. The conclusion I came to was this:

http://analytics.blogspot.com/2011/06/1-reporting-in-google-webmaster-tools.html

"Finally, the Audience report shows you aggregate geographic and demographic information about the Google users who’ve +1’d your pages. To protect privacy, we’ll only show audience information when a significant number of users have +1’d pages from your site."

The information available to a webmaster from the audience report can be seen here: https://support.google.com/analytics/answer/1012034?hl=en

• Demographics (Age, Gender)
• Interests
• Geo
• Behavior (New vs Returning, Frequency & Recency, Engagement)
• Technology (Browser & OS, Network)
• Mobile (Devices)

Answer 3

Not officially, but there was a bug that was only recently fixed as documented on http://webkay.robinlinus.com/ that could gain access to currently logged in Google+ info.

I think it's safe to assume there will be other vulnerabilities both present now or in future, just like there was another in the past that has also been fixed and don't forget there's click-jacking too where you may not think you are interacting with a social networking element but you are as you interact with the website.

I stay logged out unless I require a site.

Answer 4

No, they can't get your name through the Google+ API.

The widget interacts with cookies stored on your PC (or browser session) to auto-login with the google services (which runs on google, and not the website), any information of google send to the API in the website can be sniffed out, but its hihgly likly to be encrypted (along with the login details the API uses in your cookie to auto-login to the google+ service).

You can spot the same with Twitter and Facebook Widgets, some Facebook Widgets display which freinds liked the page of the current visiting Website/Webpage, they use about the same method.

Answer 5

I think you'll find this very interesting to read: http://words.zemn.me/csp

Core message: What I realised was that what CSP abuse allowed me to do was to allow me to make assertions about redirection and use the results of those assertions to determine information about the user. (...) Something like this could easily be used to work out who the user visiting your website was with just a little investigative work, but in addition information about their browsing habits and the powers they had on those sites. (..) This made me all the more worried, so I reported the exploit to the internet, and opened another bug with Google, this time concerning disclosure of current login on Google Plus.

(Note: this is not my article, I'm just copy pasting the relevant parts for you.)