Google Desktop Search Functions As Spyware

dioscaido writes "Users of the Google Desktop Search software beware -- it indexes your files across all users on your PC, bypassing user protections. The Google cache feature allows all users to browse the contents of messages and files it has indexed, irrespective of who is logged in. 'This is not a bug, rather a feature,' says Marissa Mayer, Google's director of consumer Web products. 'Google Desktop Search is not intended to be used on computers that are shared with more than one person.'" Reminds me of a Neal Stephenson essay: "The Hole Hawg is dangerous because it does exactly what you tell it to. It is not bound by the physical limitations that are inherent in a cheap drill, and neither is it limited by safety interlocks that might be built into a homeowner's product by a liability-conscious manufacturer. The danger lies not in the machine itself but in the user's failure to envision the full consequences of the instructions he gives to it."

Tin foil hats for everyone!!

For God's sake, this is a long ways to go to find something to be paranoid about.

Whether or not Google intended this, I take great pause at knowing any e-mail I write or read on a PC with Google Desktop Search could be called up and read by a complete stranger.

This application is intended for single user machines which pretty much limits it, in most cases, to home machines. I don't have complete strangers roaming around my house so it is not an issue for me.

Mayer dismissed my concern that this is a security issue. She points out that you can configure Google Desktop Search not to index Web pages or specific domains. That would prevent Google Desktop Search from indexing and caching the URL "mail.yahoo.com".

So what part of that did the reporter not understand? Finally, this is not mandatory software. A user has to hunt it down, download it, and install it. So don't use it if it is a problem for your computer. Now, I am not trying to be a jerk and some of this is said with tongue planted firmly in cheek. Still, you gotta wonder why people need to find things to be upset about. I am not sure why this irks me so much, maybe I should drink less coffee.....

Re:Tin foil hats for everyone!!

Using the new software, I was able to bypass user names and passwords that secure Web-based e-mail programs and view personal messages sent and received on public PCs. She didn't bypass user names and passwords. She accessed unprotected files just like Windows Explorer allows. This is a non-issue. If users don't want their information to be seen, they should be protecting their profile's Documents and Settings folder.

PC WORLD

PC World has long been a Microsoft yellow journalism rag. It's just Microsoft Corp.'s Department of Monopoly Security at work.

Really, the Google tool is simply very powerful and is merely exposing the low default security in Windows profiles to the masses--but it's nothing me and the parent haven't known for 4 or 5 years now..........

Nothing to see here.

Re:PC WORLD

PC World has long been a Microsoft yellow journalism rag. It's just Microsoft Corp.'s Department of Monopoly Security at work.

Then why do they distribute Linux install disks attached to the cover from time to time?

False!

Read the article more carefully. As far as I can tell what's actually happening is that Google Desktop Search makes copies of users protected files into an unprotected folder that may be accessed by all users. As the author says:

"I was not able to access the query results directly, but Google Desktop Search stores cached versions of search results found on your desktop, just like it does for its Web searches. The cached versions of the pages could be viewed."

Re:False!

It's stored in %USERPROFILE%\Local Settings\Application Data\Google\Google Desktop Search. If I lock off my profile to other users (if they existed), then they wouldn't be able to read the files that exist therein, including the Google cache.

Re:Tin foil hats for everyone!!

Someone using a single user OS like Home shouldn't really be worried about having unprotected files against local users.

Re:Tin foil hats for everyone!!

Yes she did. As I understand it from other sources, the problem is when you install google desktop, you are administrator. As such, you index the whole hard drive, since the administrator has permissions to it. Later, this index is available to all users, and the cache allows for unprotected vieweing of the contents of the files.

Re:Tin foil hats for everyone!!

You can exclude URLs and directories!

This is the same old *I want my PC to do everything I tell it to, but I don't want it to possibly ever harm me* mentality...if you're going to install something, read the documentation and understand what that means.

This is not even close to spyware. Now Windows, I don't ever recall seeing documentation on Windows until after it was installed... :)

Slanted article

I read this article a couple of hours ago, so I did what any self-respecting geek would do: I tried to see if the reporter/bloghead was full of shit or not. If you don't want to read any further, he is.

He used a public machine, presumably using a single logon. The software functioned as expected. It cached, separate from your IE cache, all traffic it was designed to cache. He then was able to search the data that anyone left on the machine. I contend that any douchebag that is dumb enough to send sensitive data from public terminal deserves whatever they get, ignorant or not.

The desktop search stores data in the c:\documents and settings\username\Local Settings\Application Data\Google\Google Desktop Search directory. On any PC that is relatively private, the average user isn't going to be able to search anyone else's data without a little bit of work. I had to actually copy the cache files from another user's profile to my PC in order to read the files. If were sharing a PC, I'd have to have elevate rights and access to the other user's provile in order to see anything of value.

As far as I'm concerned, the reporter that wrote the article doesn't know squat. There's no story here. Well, there is. He should have written abou the dangers of using a public terminal to send personal and/or sensitive data.

Re:Tin foil hats for everyone!!

Actually not FOS at all. We covered this in my Information Assurance and Computer Security class before the midterm. You boot Linux from removable media and change the Administrator password. Now you have it all.

Austrumi is a Linux bootable ISO image for recovering NT passwords and other cool tools and methods, sized for Business Card size CD media (50Mb). It allows you to change any password, including that of the Administrator, on a partition occupied by Windows NT, Windows 2000 or Windows XP. Simply boot the CD and when you get to the initial boot prompt, type: boot: nt_pass This will launch a console utility that will detect Windows partitions on the hard disk and provide you with a menu to modify any user or Administrator passwords on the Windows system. It will even give access to the Windows registry for recovery purposes. Quite a handy utility to keep in your wallet (AUSTRUMI is small enough to fit on a business card-size CD) if you are unfortunate enough to having to deal with Windows machines in your line of work.

Read more at http://sourceforge.net/projects/austrumi

Re:Let's get this into perspective

I agree 100% it should honor the ACLs, but I wonder if we could do anything else?

We essentially have the google bot on our machines, would it be good to honor the standards the realbot uses?

Would it pick up and honor my robots.txt file?

Will we start seeing meta tags inside emails and word documents and stored pages to exclude from indexing?

Re:Tin foil hats for everyone!!

I'm just curious but... isn't it a flaw of the operating system that files generated by a user aren't automatically restricted to access by that user? This isn't google's fault, the same exact design ported to linux would work flawlessly.
Regards,
Steve

Re:Tin foil hats for everyone!!

My cache is stored in: C:\Documents and Settings\[Current Account]\Local Settings\Application Data\Google\Google Desktop Search

I wasn't aware this was a publically accessible folder. I'm not allowed to access said folder under other users' accounts, on this machine, unless I run as Admin. That said, I haven't tried searching for files that would be found only under their accounts.

Re:Tin foil hats for everyone!!

I haven't used WinXP in awhile, so correct me if I am wrong... doesn't XP have a little checkbox in the "User Accounts" dialog that says something like "Make my data private" or something to that effect? I believe it is unchecked by default. Can anyone confirm that by default XP doesn't make user folders strict, and that you have to explicitly enable this option. I'm pretty sure Windows 2000 doesn't work this way.

Just a confirmation please, and if not, a correction against what I've said.

Thanks.

Re:Tin foil hats for everyone!!

So what part of that did the reporter not understand? Finally, this is not mandatory software. A user has to hunt it down, download it, and install it. So don't use it if it is a problem for your computer.

The thing is, most people don't understand computers well enough to know the potential for privacy issues involved when they install software. It's unreasonable to demand users to become experts before using their computer. This tool sounds like it makes things worse. Google doesn't seem to be acting very responsibly here, even if a technically astute user can mitigate the risks.

This article sounds a lot like, "Hey, dumb users such as myself, I installed the Google Desktop Search and some of my previously hidden data showed up to other users on the system. Take caution until Google addresses the issue."

Security Breach? Really?

From reading the article, there is no indication that protected files were actually read. In fact, pretty much everything he talks about seems to have been pulled from the web cache. With default security on Windows XP, each user's cache is accessible to the other users. As are everyone's Outlook data files. This is not great security, but that is not Google's responsibility.

So, I'd be really interested to know if the desktop search application runs as an admin process, or with system rights. Unless it does, this article is nothing but hot air. Google indexes files that you can read anyway? OMG!!! This is teh suxxorz!!!

And spyware? Hardly. Nothing in the article even comes close to suggesting that all of this indexed information is transmitted anywhere.

Re:Security Breach? Really?

The problem as I see it is in the startlingly easy way google desktop search makes intrusion possible, sometimes even without the person searching intentionally looking into other user's data. Any keyword I type is an instantaneous hook into the world of the other user who used the pc before me. That is what I find scary.

But that's just it. It's a SEARCH tool. It's supposed to find things that you don't know about. If it didn't, it wouldn't be a very good search tool. This should not be installed on public computers. And, if you are personally are concerned about it, there are products out there that will store all that sensitive information (browser history, email files) on a USB drive that you plug into the public computer before use.

As it is, I don't know how useful it will be to the average /. user. It only indexes files in your Documents directory, it only indexes a handful of files (.doc, .xls, .txt, .html files for example). It has SEVERAL limitations that are annoying. For example: I want it to index my java source code and javadocs for the project I'm working on. However, it refuses to index them.

Also, it doesn't index my Firefox cache or history, nor does it index my Thunderbird mail files.

In other words, nice try Google, but it's not useful to me (yet).

Re: Security Breach? Really? Dreaded "locate"

That's still an information leak, and thus a security breach. If a user can see filenames of other user's files, or inspect URL's that other users typed in, then they accessed that other user's private data. Just knowing what files are accessed or what webpages were visited, can be as serious a security breach as any, depending on the context.

If the files don't have appropriate permissions set, what expectation do you have of someone not being able to do this? This is why the question whether the files are protected is important.

In UNIX, I could use "locate" to find out whether a co-worker has cookies from porn sites if the permissions are not set. And what about Windows' "Search for files containing the following text?"

We have a total lack of information.....

Re:Security Breach? Really?

The situation is somewhat similar with the Linux 'updatedb' and 'locate' built-in search facilities. On my box, by default, the scanner runs under the 'nobody' account. However, unless a user takes specific action to change it, their home directory is world-readable by default.

The default file permissions seem to vary by the app that created them. My .mozilla and .kde directories are not world-readable, so the web caches would not get scanned. However, plenty of other files are world-readable by default, along with most documents I create.

This general situation has been around for many years. If you do share a machine, it's probably just a good idea to learn about file permissions in general.

A problem if accessible remotely

Keep in mind that once you have physical access to the machine, all bets are off.

However...

Google's tool could be a danger if someone figures out a way to launch it remotely, by getting a user to click a link, or through some Windows exploit. If so, it's plausible that a remote attacker could gain access to the cache and use the information to gain administrative access to the machine.

---
"I contend that we are both atheists. I just believe in one fewer god than you do. When you understand why you dismiss all the other possible gods, you will understand why I dismiss yours."
-Sir Stephen Henry Roberts

Re:A problem if accessible remotely

Well, there you go - Windows Exploit.

The problem in that case becomes Microsoft's, not Google's. It's just using a feature (or a bug, depends on the perspective) that exists in Windows.

It's easy to blame third parties whose software can be exploited because of inherent problems in the OS, but you're passing the buck.

Maybe if the OS were more secure, the possibilities for such exploits wouldn't exist in the first place.

Re:A problem if accessible remotely

I have tried to access the tool remotely. It appears that it only accepts connections locally on the computer.

uhhh...sorta

Unless you add the path to the preference option of the user that you don't want to be indexed. This also isn't release software. Its beta toy tools stuff. You know, the kind that says "use at your own risk."

Re:uhhh...sorta

Its beta toy tools stuff. You know, the kind that says "use at your own risk.

Like windows.......

That was too easy, ignore my post.

An adage I've heard before

The Hole Hawg is dangerous because it does exactly what you tell it to.

Yes, well computers in general are dangerous because they are very good at doing exactly what you tell them to do. For better OR for worse.

Uh.

Since when does this constitute spyware? To my knowledge, spyware sends information to a third party without the user's knowledge.

Re:Uh.

Worse, all that this does is use a feature of the OS - nothing more.

It's almost National Enquirer-esque, sensationalist.

Whether or not Google intended this, I take great pause at knowing any e-mail I write or read on a PC with Google Desktop Search could be called up and read by a complete stranger.

If a complete stranger has physical access to your single user system, you have more problems than you realize. Don't blame Google for that. Duh.

Re:Uh.

"Worse, all that this does is use a feature of the OS - nothing more."

I don't know about your OS, but mine does not send my usage data to third parties [washingtonpost.com].

"Once the Google search technology is installed for free on a personal computer, it will transmit basic data daily about usage patterns. For example, it will tell the company how often Google is being used to search personal computers, how often it is used to search the Web, and how often simultaneous searches are done. Google lets users opt out of sending some usage data, but not all of it.

However, Mayer said the data collected will be aggregated so that the company knows where to focus its efforts on upgrading the search technology. She emphasized that the daily up-loading will not transmit any personal information to Google and said it is typical for major software programs that offer voluntary upgrades and fixes for bugs to capture that sort of information as a matter of routine."

Nothing to see

It indexes all the files that you'd have access to anyway...

Can't see what the fuss is.

Re:Nothing to see

Even worse.. Google's FAQ on Multiple Users [google.com] states that it is not for multiple user systems, so all of this nonsense is perfectly within it's working parameters, and as a beta program, is to be expected. Don't like it? Don't use it. Period.

Another fiasco...

Sounds like another fiasco that Google is gonna have to withstand, just for being honest. Anyone remember when the privacy hounds were out about GMail perpetually storing your mail, and that a *gasp* computer would actually read it! Reminds me exactly of this. Of course, they'll come out and clarify it later, but by then the damage will be done. Oh well.

original locate vs. slocate

The first versions of locate(1) had the same problem - the cronjob was indexing all the files and reporting on all the files even if the user running locate would not be able to learn of the file name. This was used as an way to circumvent the systems with the "security by obscurity" way of collaboration via random directory names. Today's slocate doesn't have this fallacy.

Spyware?!

Spyware has a different definition...

Was there a warning?

I haven't used this, but the only problem I'd have with it is if there wasn't a warning. Was there a mention anywhere that it was only intended for one user computers? If there was, then good for Google. If there wasn't, I still don't think it's that huge of an oversight.

Re:Was there a warning?

Yes, its in the 'getting started guide' and in the application FAQ. And as another user above said, "It only indexes files you would otherwise have access to anyway", IE if it gets indexed, theres nothing stopping you manually interrogating the file anyway.

Google, the new Microsoft

FUD, clear and simple. With the usual hysterical Slashbot "OMFG TEH COMPANIE IS TEH SUXXORZ!!1!" byline. It's amazing how once a company starts entering different areas and markets everyone starts whining, crying wolf and feeling threatened.

Windows users have had "home" directories that are inaccesible to anyone except themselves and a domain administrator since NT4 was released. If this Google tool is allowed to index things it's not suppose to index, then that's not Google's fault, and it's certainly not Microsoft's. It's the fault of whomever configured that machine. AFAIK NTFS security has not been comprimised yet.

And the "spyware" tag? Love it. FUD works both ways, doesn't it?

Google Desktop seems useful.

I just installed Google Desktop today, but so far I'm pretty impressed. Even though it's still indexing, I haven't noticed any difference in speed.

Google Desktop isn't spyware, because it makes what it is doing clear before you install it. Of course it reads your files; that's how Google works. As long as my data doesn't go back to Google, I couldn't care less.

And actually, if everyone could choose just some of our files to make available publicly, think how much more useful Google would be.

Maybe that's their plan. Get everybody to index their disks, and than offer killer p2p on Google.com.

Does anybody *else* think that would be awesome?

Re:Google Desktop seems useful.

It would be cool if you could put txts and docs into a special folder acessible to the outside world.

Gee, if only someone could make some kind of program [apache.org] that could make files on your computer accessible to the outside world.

Year of Google Contraversy

Seems like every step Google has taken to make searching more integrated into our life and software has been shot by the media saying it's "too intrusive", and this is on BETA software and BETA programs that Google are running.

This says that either Google's far too ahead of it's time, or that the media really needs to grow up. Google's policy is that their software does no evil, it's the user's responsibility to make sure that they are not evil with it. Besides, if someone wanted to write a trojan to scan all of a user's files and report back somewhere, it could be done a lot easier than hacking GDS.

Face facts people; Google's here to stay, and they're here to help.

A long way from spyware!

First of all, most Windows PCs are single-user.

Second, this just lets any user find anything that he has read permission on. As usual, Windows default settings are suitable only for single-user machines.

Third, it could only be ``spyware'' if it phoned home. Even the silly article didn't suggest that it does that.li>

Just another sensationalist /. headline. Nothing to see here ....

The same mistake was made in Unix!

The locate command was designed to get around the terribly slow transversal of directories when looking for a particular filename. It suffered the same basic design flaw in that it did not take user permission into account. The slocate (s as in secure) was designed to get around this obvious flaw. I'm a tad surprised Google didn't see this one coming. Maybe they've been hiring a few too many PhDs and not enough folks with real experience :-)

Not spyware

Does it install itself onto your PC without your permission? No.

Does it gather personal information and send it to Google? No.

Does it run secretly in the background, with no way to remove it save an anti-spyware tool? No.

Does it allow you to access anything you couldn't access without it? No.

How is this spyware again? Or even a security threat? As another poster pointed out, this tool doesn't access anything you couldn't access through Explorer.

What's this, is Slashdot helping to spread FUD?!? Say it ain't so!

FOUR processes

It runs as *four* processes on my box:

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe

Seems like more than enough.
I am finished indexing.

Who wrote this summary, Fox News?

Users of the Google Desktop Search software beware -- it indexes your files across all users on your PC, bypassing user protections.

This is just too misleading to be accidental. Talk about bias.

So dioscaido [slashdot.org], you are suggesting Google defeats NTFS users/groups directory permissions and encryption?

No?

Oh.

Yeah, that's what I thought. Completely irresponsible journalism at work folks.

Basically this utility works NO DIFFERENT than "Start-->Search-->Search IN files", except that noobs don't know how to use Search properly, and Google search is "prettier". Oh, and MS's brain dead Search can't peek inside compressed files. Whoopie-do.

If I were more cynical, I'd chalk this fear-mongering up to someone with a lot of Yahoo stock, or someone afraid their wife/husband will find email evidence of an extra-marital affair. By default in Windows, ALL USERS CAN READ EACH OTHER'S FILES.

Nothing to see here, move along..

DISCLAIMER: I own no Google or Yahoo stock.

how is this spyware?

while i can understand why some people might be leary of the security implications here, how in the world does this qualify as spyware? it doesn't pop up annoying adds, it doesn't send my data to some secret gathering place, it doesnt report any of my habits to any other person (unless thay also have physical access to my computer and can search for that information)

oh yeah, got ahead of myself. spyware is the new virus. its just a word one person uses to scare another person when neither one really knows what they are talking about. nothing to see, move along...

The Irony - "stuffit" or zip

I've long enjoyed this essay. I find some irony in the linked version, which gives us a teaser paragraph and then:

Download the rest of the article here. Mac stuffit or PC Zip

Considering that the essay is largely about the superiority of Unix, and the blindness of the prevailing PC/Mac culture to the existence of Unix, the PC/Mac dichotomy presented here seems oddly appropriate.

Of course this notion of "downloading" a compressed version is dumb. Harper Collins just needs to add mod_gz to their web server, so they can transparently compress for most modern browsers.

Very Powerful Tool

First let me say this is a very powerful and convenient tool that works as advertised right out of the box. However, I am also upset by how easily this group defends Google and attacks Microsoft. I'm sorry, but if you are creating software you need to keep the users in mind and work with the environment you are given.

I have done a lot of research into how the Google Desktop system works. Here are some things I found...

1. The indexing "agent" (not a windows service) runs as the current user. So, Windows security should block Google from viewing those files.

2. Google installs its own web server on the machine and maps to port 4664. They also do a lot of validation to make sure you can only see this information from the local machine. This appears to be pretty strong.

3. Google stores its cache in the following windows directory: C:\Documents and Settings\username\Local Settings\Application Data\Google\Google Desktop Search -- Leading me to believe that this is user specific. I checked permissions on this other users do not have access to the cache, leading me to believe they would have their own version of the cache.

4. Google seems to abide by the rules of the operating system. Unless they are somehow bypassing Windows security (being google they could reverse engineer anything I guess), this is pretty sound. So it really comes down to the user for setting permissions on their files. Otherwise any old search program could also find those files.

5. Google Desktop search is not spyware. I think the fear is how it integrates your desktop with the Google home page but the truth is no information is sent. At least that's what Google says. However, I looked at the source of what is returned and this is not done using client-side script or an ActiveX object, so I'm not sure how they pull this off. This sort of scares me. For instance, the path to one of my files is seen coming from the their server.

Now, the bad side...

While I was impressed by the lockdown of interface to the local machine, this is easily compromised. In an hour or two I created a VBScript class that could host on the user's machine and use local HTTP to access this data. This means that spyware could be created that allow remote access to the otherwise ironclad cache. This is obviously bad since you could just start searching for passwords and possibly get them.

My suggestion to Google? Add additional settings. For instance, right now the default setting is EVERYWHERE, with some control over WHAT gets indexed. I suggest being able to point the index at specific folders, or be able to not index other folders. This is sort of like shipping a firewall with all ports open. Sure its up to the user to lock it down, but if you don't... bad things happen.

Also, more filetypes would be really good. Especially more code files, etc.

I also think the ability to share your cache could be an option. This would be handy to install on a corporate file server to provide access to files (this is the reason I created the remote access hack)

Of course this may be Google's strategy all along... make the free version do everything and be for personal systems, and then sell a version with more file types, more granular control, sharing etc. Sounds like good bait and switch to me.

So that is all. Very good software, very easy to use. Ships wide open and could breach privacy on beginner level users. Can be used for attack and Google needs to consider this. Overall.. thank you Google!

The Hole Hawg

These drills are great. I doubt anyone could really appreciate how much like UNIX they really are until they've injured themselves with one.

Here's the whole (hole?) essay:

http://steve-parker.org/articles/others/stephenson /holehawg.shtml [steve-parker.org]

Some choice quotes:

The Hole Hawg is a drill made by the Milwaukee Tool Company. If you look in a typical hardware store you may find smaller Milwaukee drills but not the Hole Hawg, which is too powerful and too expensive for homeowners. The Hole Hawg does not have the pistol-like design of a cheap homeowner's drill. It is a cube of solid metal with a handle sticking out of one face and a chuck mounted in another. The cube contains a disconcertingly potent electric motor.

During the Eighties I did some construction work. One day, another worker leaned a ladder against the outside of the building that we were putting up, climbed up to the second-story level, and used the Hole Hawg to drill a hole through the exterior wall. At some point, the drill bit caught in the wall. The Hole Hawg, following its one and only imperative, kept going. It spun the worker's body around like a rag doll, causing him to knock his own ladder down. Fortunately he kept his grip on the Hole Hawg, which remained lodged in the wall, and he simply dangled from it and shouted for help until someone came along and reinstated the ladder.

It's very, very difficult to have both the presence of mind and the physical strength to hang onto a powerful drill that's just flung you off your ladder. Kudos to that guy-- I wasn't so lucky. :)

Where my homeowner's drill had labored and whined to spin the huge bit around, and had stalled at the slightest obstruction, the Hole Hawg rotated with the stupid consistency of a spinning planet. When the hole saw seized up, the Hole Hawg spun itself and me around, and crushed one of my hands between the steel pipe handle and a joist, producing a few lacerations, each surrounded by a wide corona of deeply bruised flesh. ... After a few such run-ins, when I got ready to use the Hole Hawg my heart actually began to pound with atavistic terror.

There never seemed to be a good happy medium between holding the drill tightly enough that when it hung up I had enough of a grip to let it grind through whatever was hanging it up and loosely enough that when it REALLY hung up I could abandon it without injury.

Apply appropriate Windows/UNIX metaphors. :)

I installed this yesterday...

And removed it today.

I arrived home from work today, and fired up a simple search using my now-indexed Google Desktop. The first item listed, by dint of a coincidental search term, was an email my cleaning lady had sent.

The 'drill' in the email was NOT the one I was looking for.

I must say, I was quite surprised - the search cached viewed and sent emails from a private hotmail account - it even kept a view of the inbox.

This is, well, bullshit. Really - how many people NEVER have anyone else on their system. This search has wayyyyyyyyyyyy tooo much room for abuse - and once they fix it, I guarantee you this old version will be worth $$$ on the black market...

Only one copy, one user per PC

I have an XP pro machine.

I installed the google desktop search.

I had to be an admin to do the install. That means I have to have rights to read all files on the machine to install it.

I switched to a non admin account, I was told only the original person who installed it could run it.

I switched to a different admin account, tried to run it, got the message that only the installer could. I attempted to install it again under this account, I got the message that it's not meant for multi-user systems, only one user can install it on a PC at a time.

So in summary, if you don't trust someone who's an admin on your system, don't use that system. The search only makes it easier for them to see your data - they already have rights to.

Home vs. Pro edition of XP

Are we talking about installing this Google Desktop Search software on Windows XP Home edition or Windows XP Pro? There is a huge difference between how these two operating systems handle user right assignments. Windows XP Home has a very stripped down version of the system whereby you can't easily change user permissions of individual folders. My guess is that most people will set up user accounts on the home version with "Administrator" rights as many programs simply don't work correctly in XP as a "User".

Because XP Pro is typically used in office environments, if you set up a user account and you log in, you will NOT be able to see the other users folders unless an Admin sets those permissions.

Of course, all this seems silly as linux has had proper file permission settings forever whereas Windows has just recently added that feature.

Re:Home vs. Pro edition of XP

"Of course, all this seems silly as linux has had proper file permission settings forever whereas Windows has just recently added that feature."

Windows has had proper file permission settings since Windows NT 3.5 shipped September 1994. Slackware 1.0 (I consider this the first viable installable distribution) shipped August 1993. That's a whole year different. Percentage wise, Linux has had proper file permission settings 10% longer than Windows.

Not to mention, Windows ACL are more fined grained than what most Linux distributions offer.

To preempt the argument that Windows defaults are insecure: I am comparing the technical abilities of the systems out of the box; which are the tools an administrator may use to configure what he feels are "proper file permission settings."

The only security

The first rule of system security is that the only security is PHYSICAL security.

What are the flaws here? It's a publicly accessible machine. Anyone can walk up and since it is publicly accessible, can merrily publicly access away. The presence or absence of the Google search tool in and of itself means nothing. In addition, with the tools that I have here, even if you DID have individual accounts I can own that machine, one way or another, in under a minute. It would slow me down some if someone with real Windows knowledge set up the system secuirty, but that is all that would happen, it would slow me down. After all, I do this for a living (systems security consultant). Don't be overjoyed Linux users, if I know your version, I can get you too. I track the vulnerability lists on a daily basis and no one save the truly paranoid (moi, of course) patches THAT quick!

Now, in the context of a personal PC, whose ox is getting gored here? No one. By definition. Note, I said personal PC. My personal PC, fully locked down Win'Server 2003 Ent., or as fully locked down as you can get with Windows (snort), happens to have this beast installed and yes I did pause to read the documentation, EULA, and all the warnings that they posted. This is just another search tool that just happens to use a web server front end so you can search using a browser interface that looks just like Google. Powerful (not Windows Find in my book) search tools have existed for eons in the computing world. This is yet another one and pretty spiffy actually. I was pretty impressed that it found in under a second something that I had been searching for for days, yes even with some pretty powerful search tools. Nice job!

Now, is my system less secure? No, if someone walked up, or happened to break into my system from the outside (about as likely as hell freezing over), then yes, having this available to them is a bit more of a problem but if they get in the door, then they already know where to drill down for personal information. Anything I'm really interested in protecting (under NDA, etc.) is already living on an encrypted HD with a VERY long key. Again, I'm paranoid. For the average user, again, once in somehow the presence of this tool changes nothing.

What is interesting is the potential for abuse in the case of a family or office setting. Be assured that half the problem in knowing where to go in those settings is identifying the interesting places and then you can identify the system security penetration required. This is NOT recommended for use in an office setting, but Google points out that it was not intended for such use anyway and spells it out most eloquently in the EULA as well. You do read the EULA, don't you? I do.

For the home, how much do you want to hide from your parents, spouse, or kids? Having no spouse of kids, I can't say. As for my parents, I'm the one locking down their systems ;-). You need to make that decision yourself but I do admit that most kids can find out what they need to know to penetrate any parents computers VERY easily. I do cruise the script-kiddie boards (often) to see what they are up to and the tools are all there within easy reach (Google search ;-) ).

So that's my two cents. Mere FUD. BTW, what idjit uses a public computer and expects no one to know what they are doing? Apparently a LOT of idjits accordinig to a fellow SysOp elsewhere that happens to have a day job at a large library. If the cops want to catch a lot of kiddie porn and kiddie stalkers, I can tell them right where to go, but they aren't listening (sigh).

NetBlackOps

crap

OK, so this guy who wrote the article is a moron. I installed this on my Win2000 machine using my main account which is an Administrator account (but not 'administrator') and had it index my machine. I then switched to the 'administrator' username just to see what would happen, and it says that it was installed by somebody else (a different account) and couldn't run. Therefore, there is no security breach that I can see, and I was using two different administrator accounts.

The FAQ mentions multiple users who use the same login and password. Well, of course, duh. If several people use the same account, of course they can see the same files. It's the same damn account.

And one more thing, it isn't spyware as spyware returns information about you to someone else, like a company. At most, it could be classified as a 'priviledge elevation' of sorts, since purportedly you can see other people's files, although I can't reproduce this on my machine.

Re:How is it spyware?

Does it phone home, sending entire indexes of your harddrive to google?

Yeah, then it kills your entire family and rapes your dog. Not being evil isn't as easy as it sounds I guess.

Re:i thought the headline was talking about this..

It isn't accessing the Internet - it uses a local loopback connection to talk to its server, but your firewall doesn't distinguish that.

Google Desktop can send debug info to Google, but the claim is that it sends no information about what you searched for or your local file contents to Google. You can opt out of the debug and statistical info collection.