[GLLUG] Proposed meeting topic and maybe a project

[Charles Ulrich]

Stanley C. Mortel wrote:
> As many of you probably know, Google is watching us and stockpiling data 
> about our on-line activities. Here is a partial list of information 
> Google stockpiles (from a TechRepublic article) if you use their services:

While I agree that Google has been less than forthcoming about how much 
data they ultimately store[1], it's worth pointing out that if you're 
really that worried about it, the best option is not to use Google. :) 
Or, use Google but mix in other competing services so that nobody has a 
reasonably complete profile of your online activity. (E.g. Microsoft for 
maps, Yahoo for email, etc.)

>     * Search results
>       <http://googleblog.blogspot.com/2008/09/another-step-to-protect-user-privacy.html>
>       that you ask for and click on.
>     * Directions <http://maps.google.com/> to places that you query
>       Google Maps for.
>     * Using Analytics <http://en.wikipedia.org/wiki/Google_Analytics>,
>       Google receives/retains information on visited Web sites.

This is easily defeated by any number of proxies or browser extensions, 
like Adblock or Ghostly. But keep in mind that it's a website operator's 
choice to implement Analytics on their site, not Google's.

>     * Gmail <http://mail.google.com/mail/help/privacy.html> membership
>       allows Google to retain the content of sent and received e-mail
>       messages.
>     * Enabling My Location
>       <http://google-latlong.blogspot.com/2009/07/blue-circle-comes-to-your-desktop.html>,
>       enables Google to track your position real-time.

Only if you specifically opt-in for it.

>     * If Public DNS <http://code.google.com/intl/en/speed/public-dns/>
>       is used, Google can retain your DNS lookups.

Google took a lot of heat for not explaining the privacy implications of 
this for the first few hours it was launched. If you believe them, 
however, they say that the only logging they do is strictly for 
performance and troubleshooting and that your IP is not kept for more 
than 48 hours. This is an opt-in service as well.

http://code.google.com/speed/public-dns/privacy.html

> Moxie Marlinspike <http://www.thoughtcrime.org/about.html> has an app. 
> called GoogleSharing that will anonymize personal information, 
> preventing Google from tracking movement on the Internet.  It 
> intermingles Google user requests, and thus complicates making any 
> association between the query and the requester’s personal information.  
> It intercepts Google requests, redirecting them to the GoogleSharing 
> proxy, which removes all identifying information, replacing it with a 
> surrogate identity. The request is then forwarded to Google.

I tried this when it came out and my biggest complaint was that there 
was no way to tell whether or not it was actually working. Moxie's 
pretty well-known in the hacker community, so chances are slim that he 
would do anything underhanded with the plugin. Unless it was really, 
really funny.

Also, there's an older Google anonymous proxy called Scroogle that 
basically does the same thing. They have a number of browser search 
plugins (much more lightweight than an extension). The best feature, in 
my opinion, is that you can submit queries and receive results over SSL. 
Very nice if you suspect your local connection is being monitored or 
filtered and want a bit more privacy. The only downside is that you lose 
access to handy features like cached pages, similar results, etc.

http://www.scroogle.org/

https://ssl.scroogle.org/

> Now, the interesting thing to me, considering you have to trust 
> Marlinspike more than Google to use this, is that he has made the 
> GoogleSharing software 
> <http://www.googlesharing.net/server/googleshare-0.4.tar.gz> available 
> for download. That way, you can create your own proxy. The GoogleSharing 
> website has a FAQ page <http://www.googlesharing.net/faq.html> 
> explaining how.  Sounds like a GLLUG project to me.  Topic for tomorrow?????

It sounds like an excellent conversation, wish I could be there. :)

Charles


1.  The tinfoil-hat guy inside me wouldn't be surprised if Google had a 
reasonably accurate profile of every person online since around 2000.

-- 
http://bityard.net