Slashdot Log In
Google to Anonymize Users' Search Data
Journal written by leamanc (961376) and posted by
samzenpus
on Thu Mar 15, 2007 06:31 AM
from the poof-you're-gone dept.
from the poof-you're-gone dept.
Google's official blog states they are on an effort to anonymize their search data after 18-24 months. After previously fighting turning over search data to the feds, it looks like they are striking another blow to the "think of the children" crowd. Any bets on whether MSN or Yahoo! will follow suit?
This discussion has been archived.
No new comments can be posted.
Google to Anonymize Users' Search Data
|
Log In/Create an Account
| Top
| 151 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
The real WTF is.. (Score:2, Interesting)
(http://b100dian.lx.ro/)
Re:The real WTF is.. (Score:5, Funny)
Studies have shown that 43% of all people who search for "Donkey Love" will buy our product within 3 years if they see our ads.
Re:The real WTF is.. (Score:4, Funny)
Studies have shown that 43% of all people who search for "Donkey Love" will buy our product within 3 years if they see our ads.
...and that number rises to 98.3% if we mention we found that item in their search history.
Uhm (Score:3, Interesting)
Re:Uhm (Score:5, Insightful)
Re:Uhm (Score:5, Insightful)
(http://whineymacfanboy.googlepages.com/ | Last Journal: Thursday April 12 2007, @09:28AM)
I know where you're coming from, but that would kinda fuck with their targetting advertising business model dontcha think?
Re:Uhm (Score:4, Insightful)
Historical data that identifies a unique user is extremely useful. I do the same thing with our Intranet search and report tools. If I want to improve something, oftentimes the logs will give a very telling tale. (This accounting department employee searched for "expense", then "expense excel", then "expense spreadsheet", then "expense log", finally getting his document. I can then add the keywords 'excel' 'spreadsheet' to the actual document entry.) That said, you don't actually need to know who the unique user is, for all intents and research purposes, User5486734067 is just as useful as an IP+Cookie.
Mine already is (Score:3, Informative)
Re:Mine already is (Score:5, Informative)
I guess that's what happens when you Slashdot before caffeine. I'm sorry.
Re:Mine already is (Score:4, Informative)
How about (Score:2)
(http://www.crazysquirrel.com/index.jspx)
anonymizing it straight away! That would be an even quicker solution to the problem.
0 months? (Score:2)
Re:0 months? (Score:5, Insightful)
(http://slashdot.org/)
Because Google's primarily a media company... (Score:5, Informative)
Shouldn't be collecting that info anyway (Score:2, Informative)
There is no need to collect the IP addresses of searchers that haven't opted in to Google's personalized search. There is no law, that requires it.
There is no need to store the IP addresses of individual visitors to websites when Google analytics is used on a web page.
There is no need to store IP addresses of pages delivered to adsense viewers. Clicks maybe for a short time to prevent click fraud, but viewers, no.
None of this information should be recorded, and further the EU privacy directive should be enforced to ensure that none of that information is recorded. The law says we have privacy, Google should be forced to comply with that law.
No Consent (Score:4, Interesting)
"The moment you sent your request out over the internet in plain text to a third party (that is a corporation out to make money you know) you lost that."
Not so, the law says we have to consent and we didn't consent!
And what about when that party isn't Google? Google analytics is not on Google's site, it's embedded on third party sites, Google's adsense is on other people's site too. I didn't consent to handing my data to Google when I surfed to third parties site, Google took that data and recorded it in violation of EU privacy laws.
This has also been sued for before resulting in Doubleclick backing down over exactly this issue.
http://archives.cnn.com/2000/TECH/computing/01/28
"A California woman has filed suit against DoubleClick, accusing the U.S.-based online advertising company of unlawfully obtaining and selling consumers' personal information, according to a statement issued by her attorney's office."
"Hariett M. Judnick filed the suit in Marin County Superior Court in California, on behalf of the "general public of the state of California," the statement said.
The suit alleges that DoubleClick employs Internet cookies to identify users and track their movements on the Internet. The company tracks and records the sites an individual visits, as well as the information transmitted on the sites, such as names, ages, addresses, shopping patterns and financial information."
According to TFA (Score:5, Insightful)
(http://stuckinthecube.blogspot.com/)
It's there servers (Score:2, Troll)
(http://libtom.org/)
I should point out that your google query goes over plaintext HTTP so anyone inbetween can eavesdrop on your queries.
Tom
Re:It's there servers (Score:5, Insightful)
If you've got nothing to hide, you should have no problem with this.
Re:It's there servers (Score:5, Interesting)
Funny - my computer is in my house, behind locks and blinds too. Hey Google's computers also are behind lock and key, and they even have security guards and alarm systems. I don't ever remember giving Google permission to disclose any information shared between them and I - oh and heaven forbid I go around giving away the information Google found for me - I'd get sued!
Why would the whole world automatically be party to the information Google and I shared one evening? My computer sent that information to a specific internet address, and the answer came back specifically to my computer.
Not so out of context...
Re:It's there servers (Score:4, Insightful)
(http://libtom.org/)
Assuming you're not trolling...
When you send a query to google, it goes over the "internet" in the clear. That is, not encrypted. Anyone who can see it can read it. Well who can read it? Turns out a lot of people. Between me and google are probably 10 different boxes. 5 of which are just my ISPs routers. The other five are boxes on other networks, not even related to Google.
There is no inherant requirement for privacy like there is with telephones (maybe their ought to be one). But that said, you're giving your data to Google, willingly no less. That gives them every right to record it. You gave them permission by using their service, I guess you never read their TOS [google.ca] which is your fault, not theirs. Think about the analogy in the real world. This is like you handing your drivers license to every stranger you meet, then getting upset when some of them write it down.
If you don't want your assets [IP, location, name, platform, etc] leaked to Google you should use an anonymous proxy.
Tom
IAO (Score:1)
We still think of the children! (Score:1, Interesting)
Makes me wonder how fast does the CIA anonymize their material? Ha!
rom the poof-your-gone dept. (Score:1, Offtopic)
This is quite significant, (Score:1)
Firefox can already anonymize Google (Score:1)
(http://seandiggity.com/)
18-24 months? (Score:2, Insightful)
Yeah Right (Score:2)
You won't be anonymous, and it doesn't matter (Score:3, Interesting)
I don't think it will mean much unless they publish their anonymization technique. Even Google seems to have doubts about it, and considering the resources of some attackers (e.g., national governments), if the anonymization can be broken it will be.
But Google's anonymization does not have to be perfect: Google isn't the only place your google.com activity is recorded: There's your personal computer, possibly your ISP, other sites (referrer links show Google search terms), etc. As long as Google makes their anonymity difficult enough to break that it's significantly easier to go elsewhere for the information, they've done their job. If you need to be anonymous, I hope you are taking other steps.
I, for one, welcome the merciful intentions of our benign new overlords.
Um... (Score:1)
(http://www.superbusnet.com/)
Personally... we knew this was going to happen. Anyone that's surprised is a fool.
Things That Bit Butts, Part Deux (Score:5, Insightful)
(http://slashdot.org/journal.pl?op=list&uid=911325 | Last Journal: Saturday November 10, @12:25PM)
List of nifty little phrases that have bitten their speakers in the ass:
Now Google brings us:
Let's just be less evil, now that we've been caught.
well (Score:1)
(http://www.crush0meter.com/)
'Twould be better if it all stayed anonymous, in my opinion
Hash the IP addresses? (Score:2, Insightful)
So forgive me if I don't get all thankful for Google's big gesture. Heh.
Re:Hash the IP addresses? (Score:5, Insightful)
(http://mapache.org/)
(If your solution is to increase the space of inputs by adding a variable salt value, please explain how this allows them to use the resulting hashes for aggregation.)
127.0.0.1 (Score:4, Funny)
Does that mean ... (Score:1)
Google doesn't deserve any good press over this (Score:2)
18 months? (Score:2)
(http://www.jraxis.com/)
There is absolutely no reason for them to retain logs linking searches to IP addresses for even 18 seconds, let alone 18 months -- this isn't "improving Google" for any of their users, no matter how much they claim it is.
Keeping search history for logged-in users is one thing; I can see how some users could find that useful, just like browser history autocomplete. Perhaps they want to keep logs of non-logged-in users around for something like geographical targeting, but there's no reason they can't process out the IP information immediately, or on a quick rolling schedule such as every 24 hours. Or, just keep the /24 or /16 form of the IP address; that effectively anonymizes the data but still provides enough information for geo-targeting or other forms of aggregation. If they want to track the flow of requests (a user searched this, then that, clicked here, then...), they can use their cookie for that, or do something like generate a hash of each IP's hostname* and track requests by the hash.
"18-24 months, however, is about the right length of time that this data could be useful for the government for purposes of intelligence gathering or criminal prosecution, however.
* Hashing the IP itself is useless as there aren't enough IPs (4,294,967,296 in theory, much less in practice due to all the reserved /8s) to make reversing the hash back to the IP difficult. However, the domain of valid hostnames is incredibily large (any alphanumeric string up to 256 characters), such that one can be reasonably confident the hostname cannot be computed from the hash.
I don't understand (Score:2)
How About "Let's Not Allow Children To Think"? (Score:1)
Bollocks.
People have been creating a world with a lid that is so "screwed down" by "authority" that if the trend continues, children will be growing up in a living hell, in which they are not allowed to think for themselves even after becoming adults.
Is this good for them? Is it good for *anybody*??
I think not.
so do it yourself who needs google (Score:1)
Well, we actually do evil, but we'll stop in 2 yrs (Score:2)
They know what you search for, who you IM and email and about what, where you have appointments and what you bought. You essentially have no privacy.
If you value your privacy do not use any single provider and spread your searches, IM, email and purchases accross multiple service providers. The government can use its powers to get your data and correlate it, but no commercial entity should have the equivalent power. Commercial interests of Google or any other provider run counter to protecting your privacy.
Re:right.... (Score:5, Insightful)
(http://www.baruchito.com/)
Maybe because they do business in Europe?
Re:right.... (Score:5, Informative)
The data retention directive only applies to ISPs, and only deals with who you "communicate" with. It does not explicitly say that a record of which websites you visit should be retained, and it explicitly says that the content of the communication must not be retained.
However, as for all EU directives, it only contains the baseline of regulation. Directives are never law themselves, but have to be implemented in each respective member state by each respective legislative body. These, in turn, are free to implement whatever they want ABOVE the baseline, so some member states may have longer retention periods for this data, some member states may require ISPs to retain additional data.
The deadline for this directive is September this year, but if you read it, a few member states have reserved the option to postpone parts of the directive, typically of the internet-related traffic. This basically means that they recognize the difficulties in implementing it, and want more time to think about on how to do it, or possibly obstruct it.
What all of this boils down to is that maybe, sometime in the future, if you have an European ISP, they may be required to store all the URLs that you access. Google search data is transmitted as querystring parameters that are part of the URL, which means that your search data may be stored by your ISP, in a non-anonymized way. There's nothing in this possible future that Google has to comply with, as long as they are not an European ISP.
Re:right.... (Score:2)
(http://obsessivemathsfreak.org/ | Last Journal: Friday June 09 2006, @08:15PM)
Re:I for one... (Score:2)
Funny you mention that, I was searching just the other day for "sofa porn" and "kinky Goldfish covers"...