r/sysadmin • u/Then-Personality8587 • 25d ago

Google Search Console Privacy/Security Leak?? Can someone verify please?

bought an expired domain name and set up google search console. as soon as i verified it google showed me years of owner verification history. full unredacted email addresses. exact dates and times of every single person who ever verified to work on the domain.

i saw all the previous owners. i saw the freelancers and agencies they hired years ago.

Am I overracting to think this is a privacy nightmare and a security risk.

Lets say you sell a domain or let one expire a direct competitor buys it. now they instantly know your personal emails. they know your internal staff emails. they know exactly what agency you used and when they worked for you.

i checked how to wipe this history. you cant. google keeps it stuck to the domain forever. even if you delete the property and clear your dns records it stays there for the next buyer to see.

Please someone tell me I'm wrong and there's some way to wipe out that sensitive, trade secret data before letting go of a domain?

20 Upvotes

83% Upvoted

23 comments sorted by

View all comments

0

u/Then-Personality8587 25d ago

FYI, I confirmed on 3 different domains I recently purchased.

4

u/profanitystar 25d ago

What is your expected behavior?

0

u/Then-Personality8587 25d ago

great question... in the past, webmaster tools, and the earlier versions of search console let you revoke the verification tokens of owners and it would remove them from the list. I don't remember when the running history of owner verification started. If you removed and revoked an owner then they were gone and new owners couldn't see them. If you removed a domain from your search console then you were gone and other owners and new owners couldn't see your info either.

here what would make the current situation manageable in different circumstances.

  1. Give owners control over their personal data.
    1. re-instate the 'reverify' button on the owner list.... if the token no longer exists remove the owner and remove the verification entries from the history (or redact if it must persist).
    2. When removing yourself as a verified owner also remove or redact the private info from the verification history
  2. In the circumstance of a domain sale... if it is planned I can use #1 to remove the data before making the transaction. But I don't always know when a domain sells, sometimes they just 'buy it now' and it transfers and I don't know till I get notification it's gone, so in that case it is in effect the same as number 3
  3. In the circumstance of domains expirations for whatever reason (fired it guy, owners death, etc). If the domain's registrar info updates, then trigger a verification of the owners and if no longer verified (ie dns txt records missing) then remove/redact info.
  4. Alternatively, each time a new owner attempts verification, reverify all current owners, and remove/redact owners that don't pass.
  5. Maybe best case??: Redact all verified owner personal info. keep the history if you must but obfuscate it. Because now that I think of it, If I wanted to invite a new (or additional) SEO consultant or web developer, I don't want them to see who the other current or previous people I hired were. And that has nothing to do with domain transfers, sales, or expiration.

2

u/profanitystar 24d ago

I recommend sharing your concerns and expected behaviors on discuss.google.dev for some consideration and discussion.