Detection of second bug quickens Google Plus shutdown plan

The already-planned shutdown of Google Plus is being expedited with the discovery of a second bug, a company official said in a blog Monday.

Blogs written by Alphabet Inc. company officials in October and December said neither bugs affecting its social media platform, which was widely regarded as unsuccessful, led to misuse.

The company said it was moving up Google Plus’s “sunsetting” for consumers to April 2019 from August 2019, and that its Google Plus application program interfaces would be sunset in the next 90 days. An API is a set of commands, functions and protocols programmers use to create software or interact with an external system.

In its latest announcement Monday, David Thacker, vice president, product management, G Suite, for the Mountain View, California-based company, noted that the company had already announced it planned to sunset the consumer version of Google Plus and its API because of “significant challenges involved in maintaining a successful product that meets consumers’ expectations as well as the platform’s low usage.”

In the Oct. 8 blog, Ben Smith, Google Fellow and vice president of engineering, had said that in March it “discovered and immediately patched” a bug that had potentially affected the profiles of 500,000 Google Plus accounts, although there was no evidence any profile data had been misused.

In its latest announcement, Mr. Thacker said the new bug was discovered in November as part of its standard and ongoing testing procedures and fixed within a week of it being introduced. It said no third party had compromised its systems.

It said the latest bug affected about 52.5 million users in connection with its Google Plus API. It said with the bug, apps that requested permission to view profile information that a user had added to his Google Plus profile, such as name, email address, occupation and age, were granted permission to view profile information about that user even when set to a not-public setting. There was no access to financial data, passwords or similar data, the blog said.