Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
Government Google Privacy Security

NSA Uses Google Cookies To Pinpoint Targets For Hacking 174

Posted by Soulskill
from the another-day-another-way-to-spy-on-us dept.
Hugh Pickens DOT Com writes "For years, privacy advocates have raised concerns about the use of commercial tracking tools to identify and target consumers with advertisements. The online ad industry has said its practices are innocuous and benefit consumers by serving them ads that are more likely to be of interest to them. Now the Washington Post reports that the NSA secretly piggybacks on the tools that enable Internet advertisers to track consumers, using 'cookies' and location data to pinpoint targets for government hacking and to bolster surveillance. The agency uses a part of a Google-specific tracking mechanism known as the 'PREF' cookie to single out an individual's communications among the sea of Internet data in order to send out software that can hack that person's computer. 'On a macro level, "we need to track everyone everywhere for advertising" translates into "the government being able to track everyone everywhere,"' says Chris Hoofnagle. 'It's hard to avoid.' Documents reviewed by the Post indicate cookie information is among the data NSA can obtain with a Foreign Intelligence Surveillance Act order. Google declined to comment for the article, but chief executive Larry Page joined the leaders of other technology companies earlier this week in calling for an end to bulk collection of user data and for new limits on court-approved surveillance requests."
This discussion has been archived. No new comments can be posted.

NSA Uses Google Cookies To Pinpoint Targets For Hacking

Comments Filter:
  • by mrspoonsi (2955715) on Wednesday December 11, 2013 @05:04AM (#45658909)
    The EU is right on this one...
    • by erikkemperman (252014) on Wednesday December 11, 2013 @05:40AM (#45659005)

      The EU is right on this one...

      I'm not so sure about that. I am afraid this is one of those deals where the compromise (require the user be presented with an opt-out) turns out to be worse than either of the proposed "pure" alternatives (do not regulate tracking at all, vs disallow all tracking, period).

      Because what happens is a site says: either allow my cookies or I will not, or not fully, serve you. And because the average user is basically an idiot -- as is true for any large group of people, and in many instances of course it includes myself -- they go for it.

      Tracking not reduced for all a but a tiny minority of paranoids and actual baddies, and the ad companies can now say they do it with user's consent.

      This PREF cookie is an especially nasty piece of work, seeing how it rides on the very Safe Browsing system that Google "generously" facilitates to protect against online malware. Check the link in TFS.

      • by Anonymous Coward

        It's actually worse. I run Firefox with Cookie Monster, so I already block cookies. That used to work fine, but now I find myself having to accept cookies just to get rid of the stupid 'we use cookies!' banners.

      • by Taco Cowboy (5327) on Wednesday December 11, 2013 @07:20AM (#45659283) Journal

        ... Tracking not reduced for all a but a tiny minority of paranoids and actual baddies ...

        We do need to understand this --- tracking can NOT be totally eliminated.

        Cookie tracking is but one of the various ways they use to track us. The report @ http://truththeory.com/2013/12/10/how-to-see-what-government-agency-is-spying-on-your-phone/ [truththeory.com] tells us about another way (they hack the prepaid phones and track the unique IPs).

        No matter if you are an idiot or a tin-foil hatter, you gotta understand that there is only so much you can do.

        The world we live in a FREE WORLD for the Big Brothers (commercial or otherwise) to do whatever they want with us.

        Even if you only use cash / bitcoin to do purchases, they _still_ can find ways to "understand" you.

        I may sound like a defeatist, I may sound as if I have given up. I am not.

        I am a realist, though.

        No matter what step (or steps) I take to minimize my exposure, they know who I am, where I am, with whom I am, my favorite watering hole, the usual kind of food I take, my regular schedule, and so on...

        In one of my previous posts (some moons ago) I mentioned that we need to keep alert 24/7, and someone replied that if I keep on doing that I'm going to go bonker.

        Perhaps I have already gone bonker, but then, that's what Big Brothers want anyway.

        • by ewieling (90662)
          Maybe the only way to win is to not play the game (at least as far as the internet and cellular is concerned). They can't track my internet usage if I don't use the internet, they can't track my location if I don't have a cell phone, they can't track my purchases if I use cash. I'm not ready to give up the convinces of modern technology yet, but each day I get closer. I have drastically reduced my trackable activity though. Eliminated almost all online shopping, eliminated almost all debit card usage,
          • Hate to tell you this, but cash is serialized and can be easily tracked.
            • Don't use paper money.

              • by Ksevio (865461)
                Gonna need a lot of quarters for that new car. Also, how's he going to get all these quarters?
                • by ewieling (90662) <userNO@SPAMdevnull.net> on Wednesday December 11, 2013 @11:18AM (#45660831)
                  I don't expect to be able to purchase a vehicle anonymously. I am not trying entirely prevent the government from knowing where I live -- that is not practical. I signed a lease on my apartment, I get a paycheck, I have utilities in my name, I have a car registered in my name. None of those things allow the government to track where I go and what I do as part of a "surveil the entire country" program.

                  If the government thinks I'm a "bad guy" and specifically targets me then I'm screwed no matter what I do. Unless I'm the target of a criminal investigation they have no valid reason to know where I go, what I buy, or who I communicate with.
            • by ewieling (90662)
              Can you describe a method where some agency like the NSA might do bulk/automated tracking of cash *and* linking that cash back to an individual person and purchase?
              • I'm sure there are "bulk scanners" going on -- things we are not aware of like Teller Machines and such that are scanning the serial codes.

                I'm fairly sure the have embedded some kind of RFID ribbon in the $100 bill and larger currency. It's not going to track with regular RFID gear, but likely with a specific radio frequency it will give out it's serial number (I mean, that's how I'd do it -- and whatever I COULD do, usually ends up being something that is BEING DONE).

                The NSA is not limiting itself based on

              • There is a reason the serial number is in a large OCR-friendly font. In two places. In magnetic ink.
          • by Ksevio (865461)
            I wouldn't call losing all the great services of Internet/Cellphone/online shopping/social networks because of fear as a win. Many of those make things much more convenient.
        • I'm going to go bonker.

          Please....
          It's bonkers

        • by Vitriol+Angst (458300) on Wednesday December 11, 2013 @10:56AM (#45660621)

          They can't track everyone. If you steal what you want, you don't make a purchase. If you use someone else's machine -- they track someone else -- and if you have no relationship and you bounced it through some anonymous service, there are diminishing returns on knowing you. If you know a bit more, you are spoofing MAC addresses and piggy-backing on other users. Or you do nothing electronically related to your nefarious plans.

          In short; the NSA knows more about innocent people and clueless miscreants than it does about real bad guys. While collecting this massive amount of data -- they are distracted.

          Now, if there goal really isn't security but SOMETHING ELSE -- well, then this should work out just fine for them. If it's security -- it's worse than if they did no tracking at all. If I were up to no good, I certainly wouldn't bother with leaving any legitimate tracks.

        • Well, the government has proven we can't trust them to abide by the Constitution. Our armies are so powerful they need keep no secrets. Troop deployment, arms caches, etc. can be known in advance (and probably are due to spies anyway), so even any military action we'd perform really needs no secrets; What the pathetic terrorists threat? Falling down in the bathtub is a greater threat. The secrecy and spying infrastructure costs too much. We can't trust them to have it.

          If you give a kid a "toy" that's p

      • by DarkOx (621550) on Wednesday December 11, 2013 @07:21AM (#45659291) Journal

        The most sensible solution is to allow only sessions cookies. I know everyone loves their "keep me logged in button" but simple solution is to have browsers silently convert all cookie requests to session cookies no matter what the server or script asks for.

        This should do be the default, as it breaks very few sites and existing web applications other than you have to logon every time. Users should have to manually go white list domains that are allowed persistent storage.

        Browsers need to stop providing useragents, they need to start sending strings like
        "traditional HTML 5.0 ready browser" or "touchscreen HTML 5.0 browser" instead.

        The default behavior should be to only send a referer header when the request is to a page on the same domain as the one already being displayed.

        As much as I hate to advocate it because its a waste of everyone's network resources, the same approach needs to be applied to document caching. There are to many possibilities for script based timing analysis attacks and server side request analysis that will enable tracking with the cache enabled.

        Implement those changes and you will an WWW that still mostly works without alot of changes to existing sites but is decidedly less trackable.

        • by Anonymous Coward
          Even if your session cookies are different once you start doing enough distinctive stuff (log in, unique search) they will know who you are and can track you.
      • "Because what happens is a site says: either allow my cookies or I will not, or not fully, serve you. And because the average user..."

        It's worse than that.

        I'm somewhere in the middle of the pack. My "user side" skills are certainly a step above newbie. But when the "cookies and friends" are mashed into the loading process for a site from twelve component domains, you can't always just blindly turn them off either! Monster.com comes to mind... there are others.

        So then if you're clever sometimes you can custo

        • by Greyfox (87712)
          Sure, but you can happily accept all cookies and drop them when your browser exits. It's quite easy to configure your browser to do this, and those web sites won't be able to tell the difference. If you're getting a third-party cookie from an advertiser who doesn't require a login, you'll look like a completely different person as far as they're concerned. Getting rid of persistent data from flash may be a little more tricky depending on which browser you use, but that's just that much more reason not to ev
    • by daem0n1x (748565) on Wednesday December 11, 2013 @10:51AM (#45660577)

      Advertisers or spies?

      I'm not sure which kind of psychopaths I'm more afraid of being tracked by...

    • by citizenr (871508)

      Cookie tracking is old school and ineffective. Nowadays you fingerprint users.

      OWASP AppSec EU 2013: Web Fingerprinting: How, Who, and Why?
      https://www.youtube.com/watch?v=aSfh0efL7rs [youtube.com]

  • Calling for? (Score:1, Insightful)

    by Anonymous Coward

    Just do it, you moron. You don't need to ask anyone, you can just stop the bulk collection of user data.

  • by Rosco P. Coltrane (209368) on Wednesday December 11, 2013 @05:15AM (#45658935)

    Big data monopolies like Google are the stuff of nightmare for privacy-minded individuals.

    But there's a silver lining to that particular cloud: as the most important player in the field, they're the most visible target for abuse of all kinds. Which means that you have a better chance of dodging the abuse if you simply don't put yourself in the center of the target, by not using any Google product.

    Kind of like when Windows had the lion's share of the OS market, and you could avoid most viruses by running another OS, not because the other OS was more secure, but because virus writers had a better return on investment writing viruses for Windows and left your fringe OS alone.

    • by Anonymous Coward

      Big data monopolies like Google are the stuff of nightmare for privacy-minded individuals.

      But there's a silver lining to that particular cloud: as the most important player in the field, they're the most visible target for abuse of all kinds. Which means that you have a better chance of dodging the abuse if you simply don't put yourself in the center of the target, by not using any Google product.

      Kind of like when Windows had the lion's share of the OS market, and you could avoid most viruses by running another OS, not because the other OS was more secure, but because virus writers had a better return on investment writing viruses for Windows and left your fringe OS alone.

      The only problem with that theory is the one who is actively avoiding Google, Apple, Facebook, Twitter, AOL, Microsoft, LinkedIn, and Yahoo becomes a person of interest because you've now just become an outlier.

      Sitting at home running OpenBSD behind three layers of crypto and Tor proxies? Gee, that doesn't look suspicious.

      You would almost be better off shoving yourself somewhere in the herd. Statistical algorithms tweaked to perfection will find you otherwise.

      • Sitting at home running OpenBSD behind three layers of crypto and Tor proxies? Gee, that doesn't look suspicious.

        Which is why, in addition and in isolation, I run an unpatched Windows XP box on which, every now and then, I emulate an average person and use IE6 to download, uh, nature documentaries from sites so dodgy I have to click past a gazillion warnings even on that leaky browser!

        • by aliquis (678370)

          Yeah. That's why.

          ("I only searched for global thermonuclear war to trick you into thinking I was interesting! Seriously!")

    • by lister king of smeg (2481612) on Wednesday December 11, 2013 @05:36AM (#45658993)

      Big data monopolies like Google are the stuff of nightmare for privacy-minded individuals.

      But there's a silver lining to that particular cloud: as the most important player in the field, they're the most visible target for abuse of all kinds. Which means that you have a better chance of dodging the abuse if you simply don't put yourself in the center of the target, by not using any Google product.

      Kind of like when Windows had the lion's share of the OS market, and you could avoid most viruses by running another OS, not because the other OS was more secure, but because virus writers had a better return on investment writing viruses for Windows and left your fringe OS alone.

      Simply not using Google products won't protect you from this as it is using scripts embedded in web pages. Google analytics Gstatic and Googleadservices just to name a few present here on slashdot embeded and reporting back to Google and by extension the NSA.

      To block them you need to either completely block javascript which will break many if not modern web pages or learn to use ghostery, request policy, AND OR noscript, oh and https everywhere. then block everything by default and whitelist and temporarily allow as needed to make the pages viewable.

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        so I got ghostery noscript https everywhere. I hooked up some VPN.

        to hell with cryptography, there should be laws protecting my privacy and protecting me even if I don't encrypt anything.
         

        • capitalism is not compatible with user privacy. or, so it would seem. we reverve Business (capital B since its akin to God, capital G) to the highest level and if it Helps Business(tm) then its Good For America(tm).

          I hate that shit! its a horribly failed system.

          but if you try to suggest changes or alternate systems they call you names. or worse.

          increase privacy and the business weenies will cry. and they ALWAYS get their way, these days.

          • There was less personal privacy in pretty much all spheres of life under communist rule, before you even begin considering personal liberty, and the economic system was a failure to boot.

            The Collapse of Communist Economic Theory [fee.org] - APRIL 01, 1961

            Factory managers in Russia are examined once a year on political theory. To hold his job, a manager must qualify anew every year in "Dialectical and Historical Materialism," and in "The History of the Communist Party." His compulsory reading list includes 64 official textbooks, plus 93 selections from Lenin, 11 from Engles, 24 from Marx, 13 from Stalin, 14 from Khrushchev, and one from Mao Tse-tung. It is easy to imagine what happens to Russian production when every factory manager is occupied with these predetermined studies as the prime vehicle of his bureaucratic advancement.

            Every factory manager has but one aim in life—to make this month’s production quota. His entire career, and all his incentive bonuses, are based on annual quota accomplishment. On this score, another reputable American economist reported: "The incentive system also encourages falsification of records, the hoarding of labor and supplies, and numerous unusual activities such as working employees on a Sunday and giving them a day off in the following month"

            This general pattern of phony quota-making has resulted in a broad panorama of totally unreliable production statistics from every sector of the Bolshevik economy.

            Russian labor is regimented in a measure which kills all striving for excellence. Trained workers are in short supply in every line of production, and in-plant incentives often are discouraged by meticulously designed production norms delivered by Gosplan, Moscow, for every factory operation.

            Communist China is still in business, so to speak, despite the pervasive surveillance of its police state. Why?

            China's rising GDP and economic miracle [bbc.co.uk] (Follow link to see graph)

            The seeds of China's rapid economic growth since the 1990s were first planted back in 1978 when the Communist Party started to introduce capitalist market principles, initially in the agricultural sector.

            There is an open question about how long Europe will be able to continue under its curren

          • The problem is there is no balance with privacy or "consumer" rights. Every year that goes by the larger corporations call more and more of the shots. Just look at what they want with their free trade agreements like the TPP, etc; Your average citizen gets shite upon daily by the corporations, and we are so used to it no one cares or notices anymore. People complain about the government, yet if you look behind the curtain, it is the corporations that really run the show.

            I would wager that the world w
      • Simply not using Google products won't protect you from this as it is using scripts embedded in web pages.

        Then don't use these scripts either. And if this breaks the web site, complain loudly to the webmaster (outlining the privacy issues, if needed).

        Or at least don't accept cookies from these scripts. Often these scripts still run fine (for the visitor), even with google cookies blocked. (stuff like google analytics will break, but that's actually a feature...)

      • by nullchar (446050) on Wednesday December 11, 2013 @07:10AM (#45659251)

        You can easily run ghostery, request policy, refcontrol, noscript, https everywhere, cookie monster, and BetterPrivacy all at the same time.

        How does anyone browse without these? I setup all of those, except request policy and noscript, for every user I help. They're nearly all passive.

        • by TheGratefulNet (143330) on Wednesday December 11, 2013 @08:51AM (#45659647)

          on mobile, you have to be rooted to run a lot of adblockers and such.

          the first time I ran a non-rooted android phone and saw what everyone else sees on the web, I was kind of shocked. after years of filtering (noscript, etc) at home, I had forgotton how BAD things had gotton on the dirty wide web.

          on systems you can control, its fine. on phones - which a lot are not easily rootable - you have much less control.

          • by Anonymous Coward

            Adblock and Ghostery work on Firefox mobile. Also a bunch of privacy oriented add-ons that are mobile-only, like adding back a quit button that cleans cookies, stored data, etc., setting the user agent, and so on. It's not the snappiest of mobile browsers, but you can view a clean(er) web on android, too.

          • by Anonymous Coward

            On Opera Mobile, you can use a content blocker file (urlfilter.ini) generated elsewhere to block unwanted content. The downside is that you cannot generate or modify one on the device - you have to use an existing one. You can find plenty online or use the one from your desktop browser if you use Opera on your desktop.

            Search for "URL Filter File" on the opera:config page.

          • by Nerdfest (867930)

            On Android, you can use the AdAway application from F-Droid.org unrooted. It uses a proxy and work pretty well.

        • by Anonymous Coward

          How does anyone browse without these?

          Some pages are completely unusable without these. Not everyone has a 1 Gb/s connection and waiting ages to load all that JavaScript makes applets look fast in comparison.

        • Are all of those actually necessary, or do they overlap enough that one or more is redundant?

          • Are all of those actually necessary, or do they overlap enough that one or more is redundant?

            In my experience each will miss something that another catches although yes there is a lot of overlap between some

      • by Anonymous Coward

        > To block them you need to either completely block javascript which will break many if not modern web pages [...]

        Well, that's exactly what I do. Blanket ban on Javascript coming from "out there". Only exception: company-internal stuff (because the dorks here are unable to present an interface which works without). For that, I use a separate browser profile.

        And there is just one site (no, it ain't Slashdot, that's why I always go Anonymous Coward. I'd be a regular user if there were a cookie-free way to

      • by swillden (191260)

        Simply not using Google products won't protect you from this as it is using scripts embedded in web pages. Google analytics Gstatic and Googleadservices just to name a few

        Google provides tools to opt out of Analytics and Ads tracking, which will suppress these cookies.

        See http://google.com/privacy/tools [google.com], the bottom two entries.

        • I went and looked at those you listed the first one only controlled what the share with advertisers and web-masters no with the government or internally. the second is to a web browser plug-in that they claim is to block google analytics but if I can not trust their scripts how can I trust their plugin?

          • by swillden (191260)

            I went and looked at those you listed the first one only controlled what the share with advertisers and web-masters no with the government or internally.

            Note the two opt out links at the bottom of the Ads Preference Manager page. Those shut off tracking of you for targeted advertising purposes, across Google properties, and/or across the web.

            This article is about the government exploiting the cookies Google uses for targeted advertising. By turning those off, there's nothing for the government to track.

            the second is to a web browser plug-in that they claim is to block google analytics but if I can not trust their scripts how can I trust their plugin?

            What makes you think Google's "scripts" are untrustworthy? (Scare quotes because I don't know what scripts you're talking about; this is about cookies.)

    • by Anonymous Coward

      Kind of like when Windows had the lion's share of the OS market, and you could avoid most viruses by running another OS, not because the other OS was more secure, but because virus writers had a better return on investment writing viruses for Windows and left your fringe OS alone.

      MS has been caught doing the same things, if not far worse then Google, you are right about monopoly companies, or closed software/hardware companies getting away with this type of user abuse. But don't think MS isn't also in the b

      • by Anonymous Coward

        "not because the other OS was more secure"

        Bollocks.

        Windows OS was definitely less secure than Linux. By a long shot.

        It was ALSO more prevalent and therefore infection spread easier for that AS WELL.

        Your claim requires proof. Because there's fuck all about "it's more prevalent" that disallowes "less secure" from being true too.

    • by Anonymous Coward

      Nonsense.
      False data leads them in circles. Register your computer and email on someone famous and dead, like say, Bush Cheney, then go wherever you want. Pull their legs, and send outrageous messages on SMS so these people look like left wing ,greenie, racist, porn hooked, tax cheating drug sniffing activists. It is a right pain having 3 computers, one never connected to the internet, but this is what happens. A 5% false positve rate will really hamper unconstitutional brown-nosing.
      Wonder what would happen

    • by Desler (1608317)

      Which means that you have a better chance of dodging the abuse if you simply don't put yourself in the center of the target, by not using any Google product.

      Both extremely wrong and naive. Tons and tons of websites are still reporting back your data about you to Google through their analytics tools. Google is still getting plenty of your data without ever visiting a single one of their products. No different than Facebook being able to aggregate data about people who have never been members simply through the people that person knows posting info about them.

    • by tlhIngan (30335)

      Big data monopolies like Google are the stuff of nightmare for privacy-minded individuals.

      But there's a silver lining to that particular cloud: as the most important player in the field, they're the most visible target for abuse of all kinds. Which means that you have a better chance of dodging the abuse if you simply don't put yourself in the center of the target, by not using any Google product.

      You DO realize it's pretty much impossible to avoid Google, right?

      You may think to avoid direct Google-owned ser

    • by ISoldat53 (977164)
      I wonder if there is an IP issue here? Can Google sue the NSA over using their techniques?
  • by Anonymous Coward on Wednesday December 11, 2013 @05:24AM (#45658959)

    A CEO of one of the most successful US Corporations in the entire world wants to put an end to data gathering, and doesn't somehow fucking get that their company exists only because they are in the business of data gathering.

    Oh, I love how they pander to us while continuing to shake hands with the devil. You act like they're going to turn away one of their largest customers.

    Don't get me wrong, businesses like Google almost have to take this stance "against" the enemy of the People, else they risk losing other portions of their customer base. I simply don't like being lied to by them any more than I like being lied to by my own government.

    In the end, nothing will change. Nothing. The US government won't allow it. You're a fool to think otherwise.

    • by quixote9 (999874)
      [Google] doesn't somehow fucking get that their company exists only because they are in the business of data gathering.
      Exactly. Now that it's all out there, now -- gee whiz! -- they want it to stop. (Note: then turn off the tracking on your own damn servers. See? Simple.)
      The time to stop it was years ago, when some man of wealth and taste first suggested it in a meeting.
    • you're right on the 1st part,

      But the agency is not a customer of Google. Just that a free Internet is what it is....
      There's a saying in the spy business: if I can see you, you can see me (intel 101). ... transparency is built into all the communication protocols and the agency is just exploiting it, and with the opt-in nature of the 'net, ANY advertising company can do the same without being a Google customer. ANY. And ad companies love selling data....

      Google is spinning PR that the problem is the gov't age

  • by Anonymous Coward

    not a surprise, these people are giving each other foot jobs under the table

  • by yacc143 (975862) on Wednesday December 11, 2013 @05:32AM (#45658979) Homepage

    Personally, the collection of privacy relevant information by private companies like Google is way more scary than what a government fools around with.

    And don't come, it's voluntary. It's anything but, considering how many sites include elements from Google/Facebook/... (e.g. ads or like buttons), and they DO track you even if you are not a registered user. And the end user tools to customize browser behavior (to suppress unwanted elements of a webpage) are mostly non-available on mobile platforms

    Worse, as is the "fundamental law" of privacy & data collection, any data collected will be abused. (Classical example, when the truck toll system in Germany was introduced, it was only allowed by the data privacy commissioner because it's absolutely illegal to use the data for anything but tolling. Couple years later, new government, and immediately "let's use the toll data for law enforcement" is a nice idea in the back rooms.)

    So Google might be collecting "anonymous" data about person X, not knowing who X is, but that does not mean that the identity of X cannot be revealed later on, or be known by a third party.

    Worse, anonymizing data (removing the parts that identify the user and potentially replacing them by a random id) is way harder, e.g. an interested adversary can usually reconstruct the identities, sometimes even trivially.

  • I've said it once, and I'll say it again: We gave you a decentralized network capable of self-healing in the face of thermonuclear war -- Packets routed around cities moments after they've vanished. Then you took the Internet, and built centralized data silos with it like fools. There is no such thing as a client and server, there are only peers that wear those hats. From here you look silly with them glued firmly in place.

    There's no reason not to have your own recommendation engine in your own home. There's no reason to send personal messages and pictures to a third party just so your friends and family can see them too. As I've said: You will decentralize services, or the web will die by the folly. It may yet be too late. It would be wise to plan on a re-beginning.

    Repent. The end is incredibly fucking nigh!

    • by Sockatume (732728) on Wednesday December 11, 2013 @06:36AM (#45659143)

      There's no reason not to have your own recommendation engine in your own home.

      Apart from the obvious design advantages to centralising it. A recommendation engine, of all things, benefits enormously from being a shared resource. Communications, less so. There is nothing saying that you have to make that same trade-offs. That's the internet's other strength: heterogeneity.

      When you assume something only happened because 99% of people are stupid, check again. There is usually a more informative explanation, especially when your criticisms can be applied to something like the majority of the world's scientific computing resources which are indeed centralised.

  • by Anonymous Coward

    I'd say this is to be expected after all the revelations. Why leave a gold mine like Google cookies unused when the whole point is to end all privacy?
    This might cause Google to gather less data or give users the option to remove online profiles they have on you.
    Altough that seems unlikely, because lets face it Google does not care about privacy, they only care about customers not trusting their service anymore.

  • Im just waiting... (Score:5, Interesting)

    by gmuslera (3436) on Wednesday December 11, 2013 @05:39AM (#45659003) Homepage Journal

    till some hacker group uses NSA backdoors to cause mayhem in in US computers. Cookies are more or less harmless, as most of the privacy you lost with them is already lost by some other NSA program. But the NSA (and associated groups) backdoors are a bit more versatile, they are prepared to go into offensive mode [schneier.com], and probably a lot of US citizens have them installed (I don't think it is limited to just Tor [slashdot.org], or social networks [slashdot.org] users).

    And yes, they can cause mayhem in non-US computers, but how you know that it wasn't intended to happen by the NSA or some related company? The bombs are already in place.

  • (n/t)
  • Self destruct cookie (Score:5, Interesting)

    by pmontra (738736) on Wednesday December 11, 2013 @06:03AM (#45659075) Homepage

    This firefox plugin [mozilla.org] deletes the PREF cookie and all the others as soon as you close a tab. This means that it's created again every time with a different value.

    I went to youtube and got this (I must split the values with spaces because /. complaints about long strings of letters)
    google.com PREF ID=b59d89f696da3efa:FF=0: TM=1386759139:LM=1386759139:S=mRC2qiDMZ3ir_5JK
    google.com NID 67=c1dV2B25sq3P2XdfPrBzGx9yb89H089A9yORn8UeoYGlGbjOUIbHPs03t_7JesDo_7NcnT UlDm90BZEpoSPX9A7FmbYORqBl5WwLmUiCzjreycq2wGE1rAMOSuXlFaZg

    I closed the tab, waited for the cookie destruction message, went to google.com:
    google.com PREF ID=024924c1c44d8beb:U=9b9ed7f900bfc1f0:FF=0: TM=1386758246:LM=1386759139:S=GCtQO6AoyqL-fqze
    google.com NID 67=lPuV792TXm6MLVCnzVYUN-U2Q7B-XRd1d5xCYp7DXjvXvKzEjxtn99DTIbvaFFIg9a8uk2 AmkokD1TaYRnXL3iNA9SrPc1hj3611xY66gObS6pCY4jTTMeQpF6YHLJnn

    Different. Well, mostly different. That LM=1386759139 in both PREF worries me. I should understand what it is for.

    • by bruce_the_loon (856617) on Wednesday December 11, 2013 @06:14AM (#45659091) Homepage

      If you plug the number into a unix timestamp to GMT converter, it returns Wed, 11 Dec 2013 10:52:19 GMT, so it looks like it is a time stamp, probably LastModified or something.

      • by pmontra (738736)
        Yes, that's it. You posted while I was writing my answer. Check it [slashdot.org] for more details.
    • by pmontra (738736) on Wednesday December 11, 2013 @06:15AM (#45659095) Homepage

      I answer myself because I looked for it and found this paper (PDF) [cmu.edu] titled "An Analysis of Google Logs Retention Policies".

      LM is the timestamp of the last modification to the user Google's preference. It can be used to track down the user because we update our preferences at different times. This applies also to non logged in users like me.

      Luckily it's easy to reset LM. Just go to google.com, click the menu, turn on or off Safe Search, click again and turn it back to its original value. LM is different.

      Obviously Google could store the old and new value and link them into a db ;-)

    • by Mr0bvious (968303)

      LM = timestamp of the last preferences change..

    • by swillden (191260)
      Alternatively, the Google-provided Keep My Opt-outs plugin will prevent Google from ever sending you the PREF cookie.
  • by Anonymous Coward

    How can Larry Page object to bulk collection of user data? Isn't that exactly what Google is designed to do?

    • He's objecting to the Government asking Google for the bulk data they collect. They can do it three ways:

      * Just ask for it, and say "due to the third-party doctrine [wikipedia.org] you have no legal reason to refuse"

      * Show up with a National Security Letter, take the data, and say "this is OK due to FISA oversight. BTW, you can't tell anyone about this."

      * Copy the data as it passes through the thoroughly suborned telecom infrastructure, without even asking.

      Bulk data collection by Google is potentially bad. Bulk data col

  • by nimbius (983462) on Wednesday December 11, 2013 @06:27AM (#45659127) Homepage
    if you continue to use google for searches, discontinue this practice immediately and instead use duckduckgo.com
    Keep a whitelist of cookies you're willing to accept, and accept them only for the session in which they are generated. this type of limitation can be controlled in Firefox's preferences under privacy. you should routinely delete the whitelist, as a periodic audit of what you need is more expensive than simply rewhitelisting your most visited sites and discarding the one-time stuff you no longer need.

    at one time there was a slashdot article on 4 things you can do to increase your privacy as outlined by the EFF, however i cant find it and see no harm in reposting it.
    1. use adblock plus
    2. use noscript
    3. use HTTPS everywhere
    4. block any and all cookies, as mentioned above, with strict whitelisting for banks and reputable online merchants.
    newer nerds to slashdot may reconsider the virtues of using mutt, cone, or alpine for email as they effectively render tracking pixels and malicious http content an exercise in futility on the part of the sender. RMS uses links/lynx for all of his web browsing, and while that may be a bit extreme for most of us, it certainly cant hurt to use it for opening email links should you be faced with the necessary evil of a questionable URL.
  • Noise generation (Score:4, Interesting)

    by wbr1 (2538558) on Wednesday December 11, 2013 @06:44AM (#45659167)
    How about someone develop benign virus that spreads easily, then browses everywhere similar to a spider or crawler and resets it's own cookies (and/or built in creds for various data gathering sites), frequently. With a relatively low CPU and network footprint, a big enough botnet doing just this would make just about all data collection pointless, as the SNR would become problematic.
  • by EmagGeek (574360) <(moc.loa) (ta) (hciretg)> on Wednesday December 11, 2013 @07:01AM (#45659215) Journal

    The reality is that Government and Corporations are on the same side and none of them want to get rid of the tracking.

  • what did they say about absolute power again?

  • As if ... (Score:4, Insightful)

    by gstoddart (321705) on Wednesday December 11, 2013 @07:49AM (#45659383) Homepage

    For years, privacy advocates have raised concerns about the use of commercial tracking tools to identify and target consumers with advertisements. The online ad industry has said its practices are innocuous and benefit consumers by serving them ads that are more likely to be of interest to them.

    No, the advertising industry wants to target ads to us to benefit themselves, and in the process they've made everything we do tracked, monitored, cataloged, and neatly bundled up for sale to someone else.

    And since I am not willing to provide them with this, I feel no compunction about blocking cookies, beacons, analytics, and a host of other things.

    For website owners who rely on this, too fucking bad. Because your precious content isn't worth trading my privacy for, and I do not give a damn. It's like going to an Italian Restaurant and being told that Vinnie here also needs to get a cut.

    I don't believe Google is really interested in stopping collecting user information. They may want to limit what the government can access, and they want to give the appearance of fighting for the consumer. But the big companies like Google who have really made this widespread have a huge financial interest in continuing this practice.

    Once you have things like Ghostery and the like installed, and realize just how much crap is on every web page, it's astounding. Hell, right now, on Slashdot I've blocked "Google Analytics", "Google AdWords Converter", a "Scorecard Research" beacon, and whatever the hell "Janrain" is, and something called rpxnow.com -- and Slashdot isn't the "worst" site I've seen. But absolutely none of those sites is entitled to (or is actually receiving) any of my information.

    Fuck the lot of them. I've more or less determined the internet is a place where 80% of the big players can't be trusted, so as much as possible, I just deny them the information they want in the first place.

    Because, let's face it, doubleclick.com and the like have been douchebags for better part of 15 years. Why would we assume that would ever change?

    • by Sockatume (732728)

      Most advertisers seem genuinely convinced that they're doing us a favour with their advertising. I'll let readers speculate as to why that might be.

      The funny thing is I actually don't mind market research as a field nearly as much. If a company is looking to understand that I prefer phones that fit in my pocket and cost less than two weeks' wages, and wants to fill that niche, then more power to them. However all they seem to want to do these days is use that information to try to convince me to buy somethi

  • by advocate_one (662832) on Wednesday December 11, 2013 @07:57AM (#45659407)
    the problem HERE lies with the National Security Act which allows them to get this data from Google without having to jump through the hoops of having to provide due cause and a proper warrant. National Security Letters should be outlawed...
    • Re: (Score:3, Interesting)

      by Desler (1608317)

      But if these companies didn't have such huge troves of private user data there would be no need to worry about NSLs, etc. They'd have nothing to give over. He's not against bulk collection of data, etc. He's simply against the government competing against him in the data collection realm.

      • by swillden (191260)

        But if these companies didn't have such huge troves of private user data there would be no need to worry about NSLs, etc. They'd have nothing to give over. He's not against bulk collection of data, etc. He's simply against the government competing against him in the data collection realm.

        There's a big difference. The Google data collection is optional for users (Google even provides tools to make opting out easy), and in their individual control. Government data collection is not (unless we collectively take charge of our governments and stop it).

    • The Hoops are all electronic and binary; "Default state = request denied."

      If (request) then {return:result};

      It's not a complicated hoop, but there is at least a virtual one.

  • I've had enough of the NSA. I'm going to unplug from the Internet. I'll just yank this cord from my keyb

  • I guess it would have been a less compelling story if it didn't have the anti-advertising bent, and was more along the lines of "NSA uses web analytics cookies to pinpoint users."

    Uniquely identifying web browsers by assigning a unique ID into a cookie has been a core behavior of the web analytics industry for over 15 years. You want to know how many unique visitors are coming to your web site? Assign an ID!

    If advertising didn't exist, and Google remained the most popular website, the NSA would still hav

  • by gumpish (682245) on Wednesday December 11, 2013 @11:04AM (#45660695) Journal

    I guess we're just supposed to assume that any reports like this were made possible by Snowden unless someone says otherwise?

  • While I do appreciate the ongoing releases of how we are tracked, mostly for the less technical crowd to come up to speed, I think it's time to realize that if you are connected to any network with any device, regardless of what "security" measures you take, you will be tracked.
  • USRP
    https://www.ettus.com/product [ettus.com]

    Software Defined Radio used to spoof Cell towers. Looks like NSA is deploying SDRs everywhere. This is more interesting than some google cookie.

10.0 times 0.1 is hardly ever 1.0.

Working...