Everyone, that is, except for Mr Matthew Brock of Swiss Cottage. I have it on good authority that the gentleman in question, an old friend of mine, is giving Google+ a miss.

It’s not that he dislikes social networking as such. He long ago signed up to Facebook with only a cursory grumble, and he’s frequently to be found sharing photographs on Twitter (@_mattbrock, if you’d like to be friends). But he tells me he’s uneasy about Google’s continued expansion into ever more online markets – and, in this case, about its acquisition of a huge amount of personal information to add to its already vast database. He has therefore decided to be a conscientious objector.

As podcast listeners will know, when it comes to issues like this, my personal privacy policy is “get over yourself”. If Google’s gurus reckon they can make money from me uploading pictures of Mike Jennings in a daft hat then I say good luck to them. Even as I nodded sympathetically along with Brock’s explanation, I admit I felt he was being perhaps a little paranoid. Did he really suppose Google had some evil master-plan?

Little did I imagine that within 24 hours I’d be eating those, er, thoughts.

Changing details

My epiphany began innocently enough that evening, when I decided to change my email address. This isn’t something I do very often, but there comes a point when a mailbox receives so much spam there’s nothing to do but abandon it and move on.

There comes a point when a mailbox receives so much spam there’s nothing to do but abandon it and move on

I should have realised I was opening a can of worms when I discovered there’s actually no way to change a Gmail address. To move to a new address, you must open a new account. That only takes a minute, but I was piqued to find I was unable to migrate my contacts, and to transfer my mail across I had to set up a rather roundabout POP3 transfer.

That wasn’t the only problem, as I realised when I tried to move my Google+ account to my new address. It turns out this isn’t possible either: each profile is permanently linked to the Google account it was created under. Since my Google+ profile was only a few weeks old, it wasn’t exactly stuffed with memories, but it was still irritating to have to ditch it and start afresh.

At that point my phone chirped to tell me I had a new email, and it hit me: my phone too was tied to my old Google account. A quick web search revealed that the only way to set my new address as my primary account would be to perform a factory reset and set the phone up again from scratch.

In the end, moving to a new email address meant losing access not only to my archives and my Google+ account, but also to my Android Market purchases, my Google Docs, my Google Calendar and my Google Checkout history. I also ended up losing all my stars on Angry Birds. (It may have been this realisation that really made me question the wisdom of allowing Google to control so many different services.)

Big mistake

To be fair, the root of the problem isn’t Google’s size as such, but the way it ties its services together. A well-designed database should use some sort of anonymous internal value, such as a serial number, as the key field, so that personal information can be freely modified without breaking the links between tables. Google appears to have ignored this fundamental principle, instead using the email address as the key field. That’s quite literally a schoolboy error – I learnt about key fields way back in GCSE Computer Studies – and Google should be ashamed.

But it wouldn’t be a problem if Google weren’t tying everything together in the first place. Facebook, Twitter and even PayPal accepted my new address without a murmur. If only Android were similarly decoupled from the main Google database, I’d still have my golden eggs right now.

So – to my admitted surprise – I find myself in sympathy with Brock’s position. I’ve never really believed that a big company must necessarily have a malicious agenda; but now I realise you don’t need a plan to cause havoc. With the best will in the world, people – and hence companies – make stupid decisions from time to time. The bigger we allow Google, or any company, to grow, the more scope those stupid decisions have to screw us all.

Update: I’m most grateful to Alan Robertson, in the comments below, for pointing out workarounds for some of the problems mentioned above. The latest version of the Android Market application (which, oddly, doesn’t appear to be available from the Android Market itself) does indeed allow you to install purchased applications from multiple accounts – although this of course means you have to keep your old Google account active alongside your new one, which is a pain.

More usefully, as Alan also mentions, if you have an Android phone or tablet you can configure it to sync your contacts and calendars from your old account – then switch over and resync them to your new account. I’m not sure how you’d do this without an Android device though, as importing contacts directly across Gmail accounts isn’t supported. And it’s still the case that to switch your primary account you must perform a factory reset.

In all, it seems Google is gradually addressing the problems involved in using multiple or changing identities, but there’s some way to go. And, as I mentioned above, the problems are largely ones that in a more diverse market would never have arisen in the first place!

Since the holidays ended, security vendors have been happily telling me that spam levels have dropped dramatically. The spammers, they say, have taken some time off.

That may well have been the case as far as email spam was concerned, but back in the real world — which includes any business running a vBulletin forum for customer support — things have been far from quiet. In fact, there’s something of a spam crisis going on right now as it appears the bad guys have worked out how to crack the reCAPTCHA system that safeguards vBulletin-powered forum registrations from automated bots.

Google officially remains adamant that there is no problem with the reCAPTCHA system, which it operates. A Google spokesperson told PC Pro that it has “found reCAPTCHA to be far more resilient than other options while also striking a good balance with human usability”.

However, the simple fact is that currently it seems to be as much use as an ashtray on a motorbike to anyone operating a vBulletin forum. In fact, it became pretty useless on 4 January when spammers apparently got their collective hands on a piece of software that circumvents reCAPTCHA and allows for a fully automated registration process. The bots have been busy, very busy indeed, ever since.

It seems to be as much use as an ashtray on a motorbike to anyone operating a vBulletin forum

A number of small businesses running vBulletin-based support forums have noticed a dramatic increase in the number of new member registrations during the past week. At first they were naturally quite pleased with this, until it dawned on them that the new members all hailed from Russia and had started to post spam of the worst possible kind (child porn and rape video links, for example). Over the weekend the software had obviously started to get more widely distributed as new member registrations turned up in volume from numerous locations around the world, all intent on posting spam.

For some, the forums provide more than just customer support, they actually are the business itself. For them, this has been a troublesome week, with huge demands on their resources both in terms of the bandwidth being used by the spammers and the manpower required to keep track of them and delete their accounts and their postings.

A Google source who did not wish to be quoted directly confirmed that the company had recently noted a higher amount of spam getting through on some forums, but insisted there was no evidence to suggest it was automated or impacting on larger sites.

On the front line

I disagree, having been on the front line with one such large site that was victim to an attack. The registrations came through at such a rate that it beggars belief to think it was anything but automated. Those registrations stopped dead when reCAPTCHA was eventually supplemented with an alternate method of validation, as instantly as flicking a switch. If the attack was not automated, and if humans were manually completing the registrations, adding another layer of verification would have made no difference.

Yet that same Google source insists the company modifies algorithms “rapidly to respond to new types of automated attacks” and any type of spam increase will not remain for long if it’s bot-produced. The evidence suggests otherwise when one large forum was under attack from the 4th January until the 11th January, with hundreds and hundreds of automated registrations until an additional layer of validation was introduced. I’m not sure what the Google definition of rapid response is, but eight days wouldn’t be mine.

What to do

Thankfully there is a relatively easy solution available, and it has proved to be 100% effective for those which have now implemented it: simply add the vBulletin Question and Answer Verification option into the registration process. This requires human thinking to be able to complete a registration, by asking a question such as “what colour was the white cloud?” or “what is the fourth word in this sentence?” for example.

To do this, enter your vBulletin Admin Control Panel and choose ‘Human Verifications Options|Image Verification|Question & Answer|Save’ then click on ‘Add New Question’ and save your question before clicking on ‘Add New Answer’ and then saving that.

Of course, if you just have one question and answer the spammers will soon get wise to it, so it’s best to have multiple Q&A sets. Then, vBulletin will choose one at random to present as verification during the registration process.

I’m also advising clients to add another layer of protection at the same time by implementing the vbStopForumSpam plug-in modification, available for free to registered vBulletin license holders from the vBulletin site, which employs a RBL database approach to blocking known spam IP and email addresses. During the registration process it will then check the data against the known spammer list and reject it if there’s a match.

It sounds like a chore – it is a chore – but just sometimes I’m tempted to leave the spam on because they’re so ridiculous. So here, in no great order, are my top ten spam comments left on PC Pro.

1. “When one conceives the issue at hand, i have to agree with your finishes. You distinctly show cognition about this subject and i have much to learn after reading your post.Many salutations and i will come back for any further updates.” That was for a halitosis site, just for the record.

2. For some reason we also get tonnes of handbag-related spam, of which this one is typical. “It is the dream of every young man look for the chic and trendy. The best way to do it is, in fact, wore designer Luxury Leather Handbags . The more accessible because of its price, the more they seem to fascinate young girls.” There was more, but it got a bit boring. But if you ever want to buy a replica handbag, I can point you in the right direction.

3.Talking of which: “There are various materials used to make our chemicals needed every day, but most favorite is the leather. It has been used since ancient times, when man not as civilized as it is now, but the preference for leather remains current.”

4. “justly I realistically like your web log keep method which are expertise I will definitely pop in a number of many occasion for tartan out several even more take pleasure in it.,H.LFCicieiH” Naturally, that one was for circus performers.

5. We’re also seeing a new line in complimentary spam: “Thanks for posting this article. I’m unquestionably frustrated with struggling to search out germane and brilliant commentary on this topic. Everybody now goes to the very far extremes to either drive home their viewpoint that either: everyone else in the planet is wrong, or two that everyone but them does not really understand the situation.” We couldn’t have put it better ourselves.

6. “I revelled reading it. I require to read more on this subject…I am admiring the time and effort you put in your blog, because it is apparently one great place where I can find lot of reusable info..” Recognise the style? Yep, same spammer again. But I like him.

7. This one is from the DIRECT school of marketing: “APPLY ONLINE AT http://xxxxx.com AND WE WILL CONTACT”.

8. “I’m having a tiny issue I cannot subscribe your feed, I’m using google reader fyi.” Full marks for subtlety, but we ain’t falling for it.

9. “I have to say, you chose your wods pretty well.” We did indeed.

10. “I can’t believe LeBron is going to the Bulls, he should really just stay where he is.” Utterly true, but not really an appropriate comment for a blog about cloud computing.

We’re investigating ways to permanently beef up our spam defences. In the meantime, we appreciate your patience and please don’t respond to the spammers. Even to call them rude names on comments.

Thanks.

Why was I fooled? For one, it actually had my name in the email, and for another we as a magazine have been focusing on eBay for the last month or two as part of the investigative cover feature that adorns the current issue (eBay exposed). Could it be some sort of malicious attack from an eBay devotee, a paranoid part of my mind wondered?

So, with a deal of trepidation, I pressed the link – and was impressed to see how effective the combination of Mozilla Firefox and McAfee’s SiteAdvisor service is.

A huge red flash appeared in my browser window warning me that this site was considered to be a “web forgery”, and then I was auto-forwarded me to the SiteAdvisor page with the full description of its perils.

It’s a beautifully efficient system that just works, and if we’ve learnt anything from the McColo affair (where, after a big prosecution that took down US-based ISP McColo, spam fell by as much as 40% only to return to historic levels a matter of weeks later) it’s that cutting off the botnets doesn’t work – they’ll simply reappear.

You need to get rid of the commercial incentive of spam – and admittedly I’m talking “merely” about phishing-based spam here – which to my mind means integrating SiteAdvisor into every web browser out there. And updating to the latest web browser, not sticking with an old one out of habit or laziness.

In the meantime, if you haven’t, head over to the official SiteAdvisor site now for the free download.

Good day my dear

How are you today? I hope you are fine. If so thank be to God almighty. Please excuse me, I saw your contact email while browsing through the internet so I decided to contact you despite that I have not seen you in person. It will be my pleasure to communicate with you.

My name is Mercy John, from Siere_Leone in West Africa. I am single girl looking for honest and nice person. Somebody who care and fear God whom I can partner with. I don’t care about your colour or ethnicity. I would like to know you more, most especially what you like and what you dislike. I’m sending you this beautiful mail, with a wish for much happiness. I am looking forward to hear from you. Write me on my personal email [removed]@gmail.com) Thanks and God bless.

Greetings from,

MERCY.

Obviously I’ve already got in touch with Mercy and I fully expect us to be married next Autumn, but just how many rivals will I have for her affections? Let me know below, and if necessary we can duel at dawn for the right to her hand.

So it seems that you can now get away with sending spam from one country at least, guess which; Russia? Africa? China? Nope. The good old US of A.

Thanks to a court decision last week which overturned the notorious spammer Jeremy Jaynes’ nine-year prison sentence, it’s now deemed “unconstitutional” to jail spammers.

The argument is that mass, unsolicited communication should be legal so that citizens can promote certain religious or political ideas. Fair enough; it’s important that if someone has some staggering news they can get it out there for the public good.

If someone had proof, for example, that George W. Bush was an alien, and that his whole administration was part of an intergalactic plot to take over the world, then I’d like to know, through spam or otherwise.

However, do spammers really need to fall under this protection? News of a new penis enlargement drug, whether it’s of interest to me or not, is spam. It’s quite simple to differentiate – if the sender is making money, then its commercial, and therefore spam.

Of course, non-commercial messages could be construed as spam, too, but banning commercial outfits is a good start. One that the US had made, but now seems to have reversed.

It doesn’t look like my inbox will be empty anytime soon, and not just because I’m lazy at replying to legitimate messages.

MySpace has been quick to make much fuss about this being a record payout, about it being the biggest judgement in a CAN-SPAM Act ruling yet. Fair play, at face value there does seem cause for celebration. Anything that helps take down the spammer scum has got to be good news, right?

Wrong.

Mainly because this judgement will do no such thing, MySpace might just as well have been awarded a billion bucks, or even a gazillion for that matter: they will never see a penny of it. Sanford ’spamford’ Wallace already owes millions in fines to other folk and so ordering him to compensate MySpace to the tune of $100 in damages for each and every spam message that was sent to its members is pointless. More so when you consider that he went to ground ages ago and, to para-phrase Gordon Ramsey there is as much chance “of Anthony Worrell Thompson getting a Michelin star” as there is of him coughing up the cash.

Still, the fact that Judge Collins issued an injunction against Spamford and his cohort in crime to prevent them from participating in similar spamming activity in future will do the trick though…

The truth is that Spamford is no stranger to lawsuits and court, I can recall him being sued by AOL and CompuServe way back in the 90’s as well as more recently being on the receiving end of a $4 million ruling. Why on earth would any successful spammer shut up shop when the sheer scale of the money they can make is obvious to everyone? we are not talking hundreds or thousands of pounds here, not even hundreds of thousands, but millions.

No, the only way to stop spam and put the spammers out of business is for YOU to stop reading the stuff, stop buying the products advertised and stop clicking on the links within.