Hiding From Google 228
penguinrecorder writes "Google offers Web users a simple trade-off: Let the search giant track a substantial portion of your comings and goings around the Web, and it will offer you a free, superior online experience. Now independent security researcher Moxie Marlinspike is making Web users a counter-offer: take Google's giveaways and keep your privacy too. On Tuesday, Marlinspike launched a service he calls GoogleSharing, a plug-in for Firefox designed to give users access to Google's online offerings while cloaking their identity from the company's data collection tools. By hosting a proxy server with a collection of Google 'identities,' the privacy software will allow users temporarily to route their traffic through another computer that masks their identity by mixing their online actions with those of other users. The system is totally transparent, with no special 'alternative' websites to visit. Your normal work flow should be exactly the same." GoogleSharing only works for those services not requiring a Google login; for the latter, no proxying is done.
Re:"Don't trust Google, trust me!" (Score:3, Interesting)
While you can use the server he provides, you can download the proxy software and run it on a machine you control. Of course, this really reduces the pool of identities you will be mixed with -- to 1 unless you organize some other folks to use your proxy as well.
Re:And we're trusting you because.... (Score:3, Interesting)
ITYM "Inferior Services" (Score:1, Interesting)
Is Google hiding this "superior online experience"? All I've seen is a lot of vastly inferior web crap, like Gmail.
Re:Why (Score:4, Interesting)
Re:"Don't trust Google, trust me!" (Score:2, Interesting)
This is a good point- posting anonymously because I work in the media research industry... When I go to trade shows, I have guys coming up to me trying to sell me panelist data like it's drugs... I'm serious. It is people like this guy that are just trying to collect a buttload of data and then try and find someone to buy it. You have your big players like comScore and Nielsen that rely primarily on their large panels for data, and then you have smaller players like compete or alexa that need as much data as possible. They buy it from guys like this in order to gain greater depth of knowledge.
Remember- a lot of websites (including /.) rely on getting bigger pageview and unique visitor counts. There is a big, shady underbelly of people that can get you an increase in traffic size through the right means. This might be one of the guys that is trying to do that, or maybe he is a good semaritan.
As for Google- they know a hell of a lot and will continue to learn more about us. The larger issue now is passing legislation that keeps our private data private.
Re:Would you pay for Google ad-free? (Score:1, Interesting)
They lost their "Don't be evil" cherry when the Miserable Failure [submitexpress.com] bomb was cleared up within days of Obama taking office, after being there for four years while Bush was in office.
Re:Why (Score:1, Interesting)
It's a corporation. Corporation's goal is to make money. You'd be fool to think otherwise, because that what companies do. Is that evil? No.
Evil would be abusing law or users' trust for their own good. This particular corporation earns money, in an unusual way, while providing some unique services. Is that bad? I don't think so.
I'm having really good time, reading "Google should do X, Y, Z!" being pushed by people who clearly think that they should just receive all of the possible services for free. It's a simple deal, vote with your le^Wtraffic.
Re:And we're trusting you because.... (Score:3, Interesting)
Google desktop search indexes your documents in order to provide a quick search service. There's no way users can be sure the indices aren't shared with Google, despite no technical need to do so in order to provide that desktop user with a quick search of their own data. If Google gets any sensitive data, who's to know how many people get a copy of that data from Google? I imagine this is why institutions with sensitive data tell their workers they are not allowed to install Google Desktop, despite any convenience it may bring. Like any other proprietary program, Google applications are largely uninspectable in any common way, even for programmers skilled in reading program source code. If someone found a security problem in a Google program and patched it the license forbids them from legally distributing their improved version of the program. So we really don't know for sure everything Google apps do when they run and we have no way to help others through distributing improved versions of Google programs.
There is talk of educational institutions outsourcing email (and possibly calendaring) to places like Google and Microsoft as default policy—by default, students get Google/Microsoft accounts instead of accounts hosted by the school. There are also reasonable concerns about what to do with sensitive email/calendaring data not hosted locally. It's not easy to contract around these problems. Institutions can't rely on local law to help (most educational institutions are not in California or Washington). Some educational institutions can't reveal the existence of students at their school (in the US there is the Family Educational Rights and Privacy Act [wikipedia.org] which protects student privacy including divulging whether the person is a student at a particular school). Making it default policy to route student email/calendars through Google's servers risks inadvertent exposure of private student data and places the educational institution in a position where it would be hard for them to do anything to prevent that leak from happening again.
Google isn't unique in what I just wrote. Any organization faces the same challenge: convince the user that their data is safest with the organization. But you asked about Google. As for trusting this (ostensibly) anonymizing service as a front-end to Google's services: I merely find it interesting that people would be willing to try this with so little information about who runs it and what structural forces may result in them divulging your data to anyone but you.
Re:Why (Score:2, Interesting)
Ad-words has everything to do with data retention. There is probably a limit past which more data will just give them too much of a needle in a haystack to sort through (I'd peg it at about 2 years.) However, if you think knowing search history doesn't help them improve results, you're not understanding what Google does properly.
It's not just a question of targeting. A straightforward example (though it only needs continuity over a half hour or so) is following you as you refine your search. If Google sees a lot of people searching for:
haiti
haiti earthquake
haiti earthquake relief
haiti relief organizations
Or some permutation thereof, if they see that everyone's starting at haiti and ending up at relief organizations, they might want to show some of those results when you just search for Haiti. Obviously this is a simplistic example, but you can see how in broader circumstances it's going to seriously improve search quality.
Now as far as ad-words specifically, it's very useful to know what sorts of ads people are clicking on. You don't need to know demographics so much. For a given blog X, if you can see that there's a cluster of people interested in A, B, and C, and another cluster interested in C, D, E, and F, this allows you to refine your advertisements down to just C, since everyone who reads blog X is interested in C. Without continuity, there's no way to know that focusing on C would return much more clicks than just trying anything A-F.
And there are dozens of other ways to use the data, most of which actually are good from an end-user standpoint: better search results, more interesting ads.
Re:Obligatory Onion (Score:2, Interesting)
Last I checked Bing didn't have a cookie-enabled advertisement widget that doubled as a user tracking point on every second web site on the internet. Neither does Yahoo.
Google is the only company that has such a pervasive ability to watch you. Google Ads means they can track you even if you never, ever visit google.com. Once you visit a page with Google Ads, you get a google-sourced cookie and they can track your movement through every other Google Ad toting page until you clear your cookies again.
Oh, and Google isn't interested in "you". They're interested in mining data about the population. *You* are only of interest to parties Google sells data to, such as the government looking to squash anyone who may be thinking about starting an organised rebellion.
Re:Obligatory Onion (Score:2, Interesting)
There are others besides searching on Google, and Google Ads. You forgot about Google Analytics, and embedded "site" Google Searches. They show up in most pages these days. How about when someone embeds a YouTube video? They bought Doubleclick a few years ago, so there's another datamining source.
Google is embedded in enough places to make themselves rather difficult to avoid.
You are quite likely right, I wouldn't be surprised if there are more than just a few intelligence and/or law enforcement agencies with either a well negotiated (strong NDA applied), or they have someone inside already to provide the data.
The organized rebellion is coming. It's just a matter of how it goes in the first few days. There aren't many people out there, that could organize a group large enough to make a serious stand. In all reality, it'll turn out like Ruby Ridge, or Waco.
Excuse me, a black van just drove up, and a nice man in a black suit is knocking at the door. I'm sure he's just lost and is asking for directions.
Re:Why (Score:1, Interesting)
The slide is a manufactured one stemming in direct link from Microsoft. If you look carefully at the bloggers, commenters, journalists etc you will start seeing a pattern. Its the same exact nicks/people lambasting Linux, dancing in joy over any new or old Microsofts product that badmouths Google. Sometime in september -09 Microsoft started a orchestred effort into throwin FUD at Google. Since finding dirt on Google is about as easy as getting a picture of Bill Gates using Linux most of it consists of lame attacks about privacy.
I dont know what Google does about this but at some point they will have to take this up into the open. No company that has tried to ignore Microsofts criminal activities and not take an open fight has ever survived.
PS. I do understand i sound like a raving lunatic to some people but please, read this and come back and tell me Microsoft is your everyday normal corporation. DS
http://www.groklaw.net/staticpages/index.php?page=2007021720190018 [groklaw.net]
http://antitrust.slated.org/www.iowaconsumercase.org/ [slated.org]
Re:Woody Woodpecker says, Use Tor + SSL! (Score:2, Interesting)
It's not about "nothing to hide, nothing to fear". It's about the fact that (as the parent wrote) Google doesn't give a shit about your individual data.
What google are looking for are trends. Not individual behaviour. If I go and visit www.corpse-pictures.com that doesn't help google unless others do. Individuals are outliers on the graph unless there's a lot of people behaving in similar correlated patterns, at which point the data becomes interesting.
People in this world are far too paranoid about their internet data without actually thinking about why they're paranoid. I bet half the people who use Tor to hide their web-surfing have thrown away supermarket receipts into the dustbin without shredding it, or use loyalty cards like Nectar etc when they shop at supermarkets...