Slashdot Mirror
Google Desktop Search Functions As Spyware
dioscaido writes "Users of the Google Desktop Search software beware -- it indexes your files across all users on your PC, bypassing user protections. The Google cache feature allows all users to browse the contents of messages and files it has indexed, irrespective of who is logged in. 'This is not a bug, rather a feature,' says Marissa Mayer, Google's director of consumer Web products. 'Google Desktop Search is not intended to be used on computers that are shared with more than one person.'" Reminds me of a Neal Stephenson essay: "The Hole Hawg is dangerous because it does exactly what you tell it to. It is not bound by the physical limitations that are inherent in a cheap drill, and neither is it limited by safety interlocks that might be built into a homeowner's product by a liability-conscious manufacturer. The danger lies not in the machine itself but in the user's failure to envision the full consequences of the instructions he gives to it."
Whether or not Google intended this, I take great pause at knowing any e-mail I write or read on a PC with Google Desktop Search could be called up and read by a complete stranger.
This application is intended for single user machines which pretty much limits it, in most cases, to home machines. I don't have complete strangers roaming around my house so it is not an issue for me.
Mayer dismissed my concern that this is a security issue. She points out that you can configure Google Desktop Search not to index Web pages or specific domains. That would prevent Google Desktop Search from indexing and caching the URL "mail.yahoo.com".
So what part of that did the reporter not understand? Finally, this is not mandatory software. A user has to hunt it down, download it, and install it. So don't use it if it is a problem for your computer. Now, I am not trying to be a jerk and some of this is said with tongue planted firmly in cheek. Still, you gotta wonder why people need to find things to be upset about. I am not sure why this irks me so much, maybe I should drink less coffee.....
http://www.busyweather.com/
From reading the article, there is no indication that protected files were actually read. In fact, pretty much everything he talks about seems to have been pulled from the web cache. With default security on Windows XP, each user's cache is accessible to the other users. As are everyone's Outlook data files. This is not great security, but that is not Google's responsibility.
So, I'd be really interested to know if the desktop search application runs as an admin process, or with system rights. Unless it does, this article is nothing but hot air. Google indexes files that you can read anyway? OMG!!! This is teh suxxorz!!!
And spyware? Hardly. Nothing in the article even comes close to suggesting that all of this indexed information is transmitted anywhere.
Floating face-down in a river of regret...and thoughts of you...
Keep in mind that once you have physical access to the machine, all bets are off.
However...
Google's tool could be a danger if someone figures out a way to launch it remotely, by getting a user to click a link, or through some Windows exploit. If so, it's plausible that a remote attacker could gain access to the cache and use the information to gain administrative access to the machine.
---
"I contend that we are both atheists. I just believe in one fewer god than you do. When you understand why you dismiss all the other possible gods, you will understand why I dismiss yours."
-Sir Stephen Henry Roberts
Does it phone home, sending entire indexes of your harddrive to google?
yeah, certainly not "spyware" in any usual sense of the word if the information isn't being made available or transmitted off the box.
Unless you add the path to the preference option of the user that you don't want to be indexed. This also isn't release software. Its beta toy tools stuff. You know, the kind that says "use at your own risk."
The Hole Hawg is dangerous because it does exactly what you tell it to.
Yes, well computers in general are dangerous because they are very good at doing exactly what you tell them to do. For better OR for worse.
Per Square Mile, a blog about density
Since when does this constitute spyware? To my knowledge, spyware sends information to a third party without the user's knowledge.
It indexes all the files that you'd have access to anyway...
Can't see what the fuss is.
My Journal
Sounds like another fiasco that Google is gonna have to withstand, just for being honest. Anyone remember when the privacy hounds were out about GMail perpetually storing your mail, and that a *gasp* computer would actually read it! Reminds me exactly of this. Of course, they'll come out and clarify it later, but by then the damage will be done. Oh well.
Hurricane Ivan: A 17th century prison collapsed. All of the inmates escaped.
Suddenly I'm not so bothered that there's no Mac version!
goog up 2 bucks on the news
try { do() || do_not(); } catch (JediException err) { yoda(err); }
The first versions of locate(1) had the same problem - the cronjob was indexing all the files and reporting on all the files even if the user running locate would not be able to learn of the file name. This was used as an way to circumvent the systems with the "security by obscurity" way of collaboration via random directory names. Today's slocate doesn't have this fallacy.
VKh
Spyware has a different definition...
But then again, I like things to do what I tell them to. That's why I no longer use Windows at home.
Si la vida me da palo, yo la voy a soportar Si la vida me da palo, yo la voy a espabilar
I spent a year in Iraq looking for WMD and all I found was this lousy sig.
I can't remember. Is Google good or evil these days? Or is it an every-other day thing?
I can already see the girlfriend-snooping potential here.
This security concern does not apply to browsers other than IE. Only the cache of IE is searched, although that might change in upcoming releases.
This is a weak argument by Google. Saying that this tool is only for single-user systems is just a cover for laziness. Why in hell would an operating system implement a system of file permissions if security weren't an issue? Since the tool functions the same whether or not the system is single-user, Google is implicitly admitting they're lazy and don't care if their software can be used to spy on others. I don't see a problem with a tool that indexes all users' files, but I do have a problem if it doesn't restrict file listings when used by non-administrators. How hard could that be to implement?!
"'This is not a bug, rather a feature,' says Marissa Mayer"
If it were really intended as a feature, Google would have developed the option to install for individual users or accros all users.
With default security on Windows XP, each user's cache is accessible to the other users. As are everyone's Outlook data files. This is not great security, but that is not Google's responsibility.
Indeed. Yet another reason I use Opera. With IE, I've never been able to figure out exactly where the cache is, much less how to kill it without trashing the OS. Not that I've tried very hard, because it's so much easier to take care of it in Opera:
* "File"
* "Delete Private Information"
* check all the boxes
* hit OK
Extremely handy when you're at work and you click on a link that didn't go where you meant for it to. Closing the browser is one thing... knowing that goatse guy isn't hiding in some system file somewhere is real peace of mind.
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.
Windows users have had "home" directories that are inaccesible to anyone except themselves and a domain administrator since NT4 was released. If this Google tool is allowed to index things it's not suppose to index, then that's not Google's fault, and it's certainly not Microsoft's. It's the fault of whomever configured that machine. AFAIK NTFS security has not been comprimised yet.
And the "spyware" tag? Love it. FUD works both ways, doesn't it?
If there is no windows security stopping someone from seeing those files their public aren't they?
It's not spyware it does what is supposed to and Microsoft doesnt.
I just installed Google Desktop today, but so far I'm pretty impressed. Even though it's still indexing, I haven't noticed any difference in speed.
Google Desktop isn't spyware, because it makes what it is doing clear before you install it. Of course it reads your files; that's how Google works. As long as my data doesn't go back to Google, I couldn't care less.
And actually, if everyone could choose just some of our files to make available publicly, think how much more useful Google would be.
Maybe that's their plan. Get everybody to index their disks, and than offer killer p2p on Google.com.
Does anybody *else* think that would be awesome?
Now I can share all those important email attachments people keep sending me!
Yeah, on my two user XP Pro box, I was able to index and search the seconds user's files, but their account was not "protected" using a password, etc.
One annoyance is that the second account cannot use Google desktop at all. It warns roughly "Only the user who installed this can use the Google Desktop", etc.
Your hybrid is not saving the environment. Its purpose is to make you feel good about buying something.
Seems like every step Google has taken to make searching more integrated into our life and software has been shot by the media saying it's "too intrusive", and this is on BETA software and BETA programs that Google are running.
This says that either Google's far too ahead of it's time, or that the media really needs to grow up. Google's policy is that their software does no evil, it's the user's responsibility to make sure that they are not evil with it. Besides, if someone wanted to write a trojan to scan all of a user's files and report back somewhere, it could be done a lot easier than hacking GDS.
Face facts people; Google's here to stay, and they're here to help.
"Victory means exit strategy, and it's important for the President to explain to us what the exit strategy is." G.W.Bush
The problem as I see it is in the startlingly easy way google desktop search makes intrusion possible, sometimes even without the person searching intentionally looking into other user's data. Any keyword I type is an instantaneous hook into the world of the other user who used the pc before me. That is what I find scary.
Agreed this is a non-issue inside a household where one or two people use a PC, yet the potential of this sends a slight tingle down my spine...
How the heck is this spyware? Its not like it sends it anywhere. Thats what spyware does.
Maybe I'm mistaken here, but does this even allow you to search files that you wouldn't otherwise be able to access via Windows' built in search? If not then this whole google/spyware freak-out is just a bunch of bullshit and the people propagating it are idiots.
When the google service is running, surfing to www.google.com shows a Desktop choice. When it is not running it doesn't. This works in IE and Firefox -- but not Lynx.
How can www.google.com tell the service is running on the local computer without using activex? I thought maybe it had some javascript that checked http://127.0.0.1:4whateverportituses, but I didn't see that. Must be that.
If it can do that, it can upload data to google!
Hey i got the bills for every single bit of my internet cache !
Tools, Internet Options, Delete Files, check "Delete all offline content". You can also clear auto-complete history for form user IDs and password stored in the isolated storage system.
Your IE cache is stored under [rootDrive]:\Documents And Settings\\Local Settings\Temporary Internet Files, if you feel so inclined to look at them in some other way or delete them manually, which it must be said, has never "trashed the OS" in any way shape or form.
That wasn't too hard, now was it.
That's still an information leak, and thus a security breach. If a user can see filenames of other user's files, or inspect URL's that other users typed in, then they accessed that other user's private data. Just knowing what files are accessed or what webpages were visited, can be as serious a security breach as any, depending on the context.
It runs under the account of the user who installed the program -- so, as has been said, if Google Desktop Search found something, the user already had access to the same data.
Sadly, GDS doesn't seem to be able to install multiple web servers on different ports, so each individual log in can have their own index. The first userid to install GDS gets to use it, and no one else.
Yes, it's true. This man has no dick.
First of all, most Windows PCs are single-user.
Second, this just lets any user find anything that he has read permission on. As usual, Windows default settings are suitable only for single-user machines.
Third, it could only be ``spyware'' if it phoned home. Even the silly article didn't suggest that it does that.li>
Just another sensationalist /. headline. Nothing to see here ....
See what I've been reading.
The default file permissions seem to vary by the app that created them. My .mozilla and .kde directories are not world-readable, so the web caches would not get scanned. However, plenty of other files are world-readable by default, along with most documents I create.
This general situation has been around for many years. If you do share a machine, it's probably just a good idea to learn about file permissions in general.
I'd go so far to say that if someone else is using your system (aka computer) it is neither safe or reliable in any sense of the word -- so on one hand it doesn't matter and on the other it doesn't matter. As to the product - I'm in love.
I never installed the google search tool since it warned that it be installed as an Internet Explorer "helper application." Ahem, cough....IE...helper application...back to the drawing board google.
That's still an information leak, and thus a security breach. If a user can see filenames of other user's files, or inspect URL's that other users typed in, then they accessed that other user's private data. Just knowing what files are accessed or what webpages were visited, can be as serious a security breach as any, depending on the context.
If the files don't have appropriate permissions set, what expectation do you have of someone not being able to do this? This is why the question whether the files are protected is important.
In UNIX, I could use "locate" to find out whether a co-worker has cookies from porn sites if the permissions are not set. And what about Windows' "Search for files containing the following text?"
We have a total lack of information.....
LedgerSMB: Open source Accounting/ERP
it makes me sad when people try to sensationalize stories to make them more exciting. No information is being sent back to a mothership (the usual definition of spyware) ...
The locate command was designed to get around the terribly slow transversal of directories when looking for a particular filename. It suffered the same basic design flaw in that it did not take user permission into account. The slocate (s as in secure) was designed to get around this obvious flaw. I'm a tad surprised Google didn't see this one coming. Maybe they've been hiring a few too many PhDs and not enough folks with real experience :-)
The Hole Hawg is dangerous because it does exactly what you tell it to
The (supposed) problem in this case, though, is that the Google software will do things that it was not (explicitly) told to do, and that users might not expect it to do, or even realize it is doing.
That's [rootDrive]:\Documents And Settings\[yourID]\Local Settings\Temporary Internet Files
Makes sense that you don't bite the hand that feeds ya.
next...
This article looks like a plant from the Microsoft PR department. There really is not much of a story here.
I know it has to be driving MS nuts that google is getting into the filesystem niche, especially with all the trouble they've had over the years with putting together a database-based filing system. I imagine if they keep on pushing the release out past Longhorn, google is going to overtake them .
"[Google Desktop] indexes your files across all users on your PC, bypassing user protections. "
If this is true, then the problem lies with your operating system not the application. How is it that Google Desktop was allowed to bypass user protections? Maybe because there are actually no protections at all?
If you read the report the problem isn't that Google is bypassing protections, it's that some other application is caching the information - likely Internet Explorer or Firefox is setup to save web passwords. Google is just taking advantage of this knowledge.
So where is the security violation? It was already on your PC, you just didn't realize it until Google Desktop came along. Good thing it did, or you wouldn't have realized it until someone loaded up Internet Explorer's password database and showed it to you.
Joseph Elwell.
Does it install itself onto your PC without your permission? No.
Does it gather personal information and send it to Google? No.
Does it run secretly in the background, with no way to remove it save an anti-spyware tool? No.
Does it allow you to access anything you couldn't access without it? No.
How is this spyware again? Or even a security threat? As another poster pointed out, this tool doesn't access anything you couldn't access through Explorer.
What's this, is Slashdot helping to spread FUD?!? Say it ain't so!
I think it's funny that the people complaining about Spyware use SlashDot which often serves DoubleClick ads. And the author who links to PCWorld which has a few DoubleClick and Avenue A, Inc. ads. The DoubleClick threat as defined by SpyBot reads, "Use information about your web surfing... that could include any information, like accounts and passwords." The threat for Avenue A, Inc. reads "They say they no longer do tracking."
--I smoked my sig.
Let's see: 1) monopoly 2) bugs are features 3) global sprawl 4) two billionaires in charge Hmmm....I wonder where this is heading?
Now, If I install this as a non-administrator, I take it that it
runs as non-administrator ? Or does it install itself as as service
running with administrator provileges...
Bottom line is, can a program running as a normal user somehow access
files of other users ?
the google desktop process runs with user privelages not system, for those wondering. i think this article should DEFINATELY be renamed because it doesnt even come CLOSE to being spyware.
It runs as *four* processes on my box:
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
Seems like more than enough.
I am finished indexing.
I can see how this could be useful if I owned a windows machine. I want to find a file regardless of which user put it there. (on Linux I just use a find or locate as root)
The fact that it bypasses user protections speeks more about the security of Windows than the product itself. While only a privledged user should be able to do system wide searches, only a priviledged user should be able to install the software. If you let users run as root, then it's your own damn fault if someone installs it.
Users of the Google Desktop Search software beware -- it indexes your files across all users on your PC, bypassing user protections.
This is just too misleading to be accidental. Talk about bias.
So dioscaido, you are suggesting Google defeats NTFS users/groups directory permissions and encryption?
No?
Oh.
Yeah, that's what I thought. Completely irresponsible journalism at work folks.
Basically this utility works NO DIFFERENT than "Start-->Search-->Search IN files", except that noobs don't know how to use Search properly, and Google search is "prettier". Oh, and MS's brain dead Search can't peek inside compressed files. Whoopie-do.
If I were more cynical, I'd chalk this fear-mongering up to someone with a lot of Yahoo stock, or someone afraid their wife/husband will find email evidence of an extra-marital affair. By default in Windows, ALL USERS CAN READ EACH OTHER'S FILES.
Nothing to see here, move along..
DISCLAIMER: I own no Google or Yahoo stock.
"I was able to...view personal messages sent and received on public PCs.
There should be no expectation of privacy when using a public PC.
My lack of God, it's Trotsky!
When you run GDS, it runs under your Windows login's security context.
Therefore, it only indexes the files that you have permission to see. The article describes a scenario where a user installs GDS and reads pages out of the browser's cache that were left there by other people who used the same Windows login.
Of course those files are visible to GDS. They could have also been retrieved by simply browsing through the cached files normally or using Window's crappy built-in search tool.
Conclusion: DUH. Nothing to see here, move along people...
OtakuBooty.com: Smart, funny, sexy nerds.
Your IE cache is stored under ..., if you feel so inclined to look at them in some other way or delete them manually
You should NOT delete the cache manually. The proper way to do it is through IE or using the DeleteUrlCacheEntry function.
PC World has long been a Microsoft yellow journalism rag. It's just Microsoft Corp.'s Department of Monopoly Security at work.
Really, the Google tool is simply very powerful and is merely exposing the low default security in Windows profiles to the masses--but it's nothing me and the parent haven't known for 4 or 5 years now..........
Nothing to see here.
Cool! Amazing Toys.
but, consider that spyware can now ask your google desktop for all sorts of useful information.
Spyware can now be much more efficient since it can query google desktop to find out what your interests are, who you are friends with etc....
Yea, it's pretty eaisy to read other user's files when your a numbnuts and allow everyone to have admin rights by default. Puhlease...nothing new to see here you couldn't do beforehand.
Read the article more carefully. As far as I can tell what's actually happening is that Google Desktop Search makes copies of users protected files into an unprotected folder that may be accessed by all users. As the author says:
"I was not able to access the query results directly, but Google Desktop Search stores cached versions of search results found on your desktop, just like it does for its Web searches. The cached versions of the pages could be viewed."
... To believe otherwise is naive. I think the article's fear is right on. The idea that every file on my computer is indexed along with web pages, email, etc, means that there is one less barrier between my personal content and hackers, not to mention intellectual property theft. How can you honestly not see how dangerous this is? This may be fine for people who have machines filled with data they don't care about, but what about authors, musicians, programmers? Though I like and use Google's internet search engine, I don't see the necessity moving that to my personal desktop. That's what the file system is for. This type of 'marginal-improvement' feature is the kind of thing that caused the growth and burst of the dot-com bubble, and will continue to plague IT unless we approach such things with more skepticism. When it all comes down to it, if you don't know how to find files, email, and documents on your own machine with the current tools available, you need some serious help with organization. If your excuse is that 'your file-system is too big' then you probably have so much data that anyone who finds a way in will know their hard-earned work was worthwhile.
Sorry, but indexing everything in "Documents and Settings" regardless of which user is running the program is a security issue ... especially for your typical family situation where mom and dad may have files they don't necessarily want junior to see. Or, for that matter, in an office environment with roaming profiles off.
And I don't buy the excuse of all the Google apologists who say "it's your own fault for not securing your Windows config correctly." Sorry, but there is no way to "secure" Windows while still allowing all users on a machine to install programs, which is a user requirement even in many corporate environments I've seen. (Pointy-headed boss won't tolerate having to get IT guy to come over to install something every time a new version of RealPlayer comes out.) So the reality is that in many situations, all users on a machine are running in Power User or Administrator mode, and they have access to everything on the hard drive.
And there is a big difference between browsing random Documents and Settings directories looking at someone else's files (that's called snooping, and it requires at least some technical skill) and inadvertently pulling up someone's private files every time you Google something.
Blame Microsoft for having an unsecure OS. Blame sysadmins or home users for their less-than-paranoid security practices.
But blame Google too. Shipping a piece of software whose default configuration is to completely ignore individual users' privacy (stuff in my Documents folder is mine, stuff in Joe's Documents folder is his) is bad.
Google has a history of trouble getting their software designed to work well with multi-user Windows XP installations. Their Picasa photo software can only run as the Admin. user. Now their Desktop search software only works for the first user that installs it. Sad...
So why can't Google get it right?
while i can understand why some people might be leary of the security implications here, how in the world does this qualify as spyware? it doesn't pop up annoying adds, it doesn't send my data to some secret gathering place, it doesnt report any of my habits to any other person (unless thay also have physical access to my computer and can search for that information)
oh yeah, got ahead of myself. spyware is the new virus. its just a word one person uses to scare another person when neither one really knows what they are talking about. nothing to see, move along...
If I don't put anything here, will anyone recognize me anymore?
And a proper umask wouldn't hurt either.
Comment removed based on user account deletion
Slashdot's suffering from an awful lot of spin these days. Is it just me, or is article quality degrading?
Homer: Now, talks into mouse Computer, kill Flanders.
Flanders: Did I hear my name? My ears are burning.
Homer to computer: Good start. Now finish the job.
Flanders: Catch you later computator!
If only computers were that good at doing what you tell them too...sigh...
"It's all just meme meme around here"
The problem as I see it is in the startlingly easy way google desktop search makes intrusion possible, sometimes even without the person searching intentionally looking into other user's data. Any keyword I type is an instantaneous hook into the world of the other user who used the pc before me. That is what I find scary.
/. user. It only indexes files in your Documents directory, it only indexes a handful of files (.doc, .xls, .txt, .html files for example). It has SEVERAL limitations that are annoying. For example: I want it to index my java source code and javadocs for the project I'm working on. However, it refuses to index them.
But that's just it. It's a SEARCH tool. It's supposed to find things that you don't know about. If it didn't, it wouldn't be a very good search tool. This should not be installed on public computers. And, if you are personally are concerned about it, there are products out there that will store all that sensitive information (browser history, email files) on a USB drive that you plug into the public computer before use.
As it is, I don't know how useful it will be to the average
Also, it doesn't index my Firefox cache or history, nor does it index my Thunderbird mail files.
In other words, nice try Google, but it's not useful to me (yet).
Don't count your messages before they ACK.
I read this article a couple of hours ago, so I did what any self-respecting geek would do: I tried to see if the reporter/bloghead was full of shit or not. If you don't want to read any further, he is.
He used a public machine, presumably using a single logon. The software functioned as expected. It cached, separate from your IE cache, all traffic it was designed to cache. He then was able to search the data that anyone left on the machine. I contend that any douchebag that is dumb enough to send sensitive data from public terminal deserves whatever they get, ignorant or not.
The desktop search stores data in the c:\documents and settings\username\Local Settings\Application Data\Google\Google Desktop Search directory. On any PC that is relatively private, the average user isn't going to be able to search anyone else's data without a little bit of work. I had to actually copy the cache files from another user's profile to my PC in order to read the files. If were sharing a PC, I'd have to have elevate rights and access to the other user's provile in order to see anything of value.
As far as I'm concerned, the reporter that wrote the article doesn't know squat. There's no story here. Well, there is. He should have written abou the dangers of using a public terminal to send personal and/or sensitive data.
It's 11PM, do you know where your pants are?
i actually think it's kinda cool, I found stuff on my computer i haven't found in years!
But it's not supposed to let you see files you don't have access to. And apparently that's what the reporter found - they couldn't access the files directly, but they WERE able to access them through the google cache.
The other thing is that locate doesn't let you search within files. Normally, the name of a file is not that important, what is inside is. There are exceptions, of course.
Is Karl Rove now approving submissions?
This is by far the best Troll I have ever seen.
Infact, it is the meta-troll; the troll from which all other trolls spring from.
This particular troll managed to get the troll posted as an article. And all replies are baited.
My hats off to you, good sir!
In the future, I would want to not be isolated from my friends in the Space Station.
Neither the post nor the article say anything about the Google tool being able to read files create by other "accounts" on the computer (it may be able to, but that is not what this article is about).
It is talking about multiple users/people using the same computer, under the same login account (it is a computer at a tradeshow booth), to access their web-based email. Of course Google doesn't integrate with Hotmail/Yahoo/etc to check credentials of who is searching.
This story might be interesting if the tool allows you to read files on a computer created by a different password-protected computer account. For example, I cannot read the files in someone else's My Documents folder on my computer (assuming I am not an Admin). If the Google Desktop Search allows this (by running with elevated priveleges), there may be a valid concern.
Considering that the essay is largely about the superiority of Unix, and the blindness of the prevailing PC/Mac culture to the existence of Unix, the PC/Mac dichotomy presented here seems oddly appropriate.
Of course this notion of "downloading" a compressed version is dumb. Harper Collins just needs to add mod_gz to their web server, so they can transparently compress for most modern browsers.
Although it lets you set what to index and what not to index, the indexer starts immediately as soon as you install the software, thus not giving you the chance to exclude certain files and directories from getting indexed.
Simpy
This is essentially the same stance as "We shouldn't blame the virus writer for infecting your computer, it's your fault because you're an idiot." It's irresponsible to release a product with no safety features, or one which does not obey common sense (like the rule that if a particular user installs a program, that program's entire domain of operation should be restricted to that user unless explicitly expanded).
bypassing user protections
uh? What user protections? I once without problems managed to log in as guest on my friends "unconfigured" computer (xp). Oh yes I couldn't do much but I could view and delete her files. I don't need a google toolbar to do that, windows already does it for me...
You should NOT delete the cache manually. The proper way to do it is through IE or using the DeleteUrlCacheEntry function.
Hmm. So here's my choice:
Opera: File, Delete Private Information, select exactly what I want deleted, click "OK".
MSIE: Tools, Internet Options, Delete Files, check 'Delete all offline content', wonder what that means, hit "OK" and hope for the best.
Sure, both apps are closed-source. Both have some history of bugs and security gaps. But my gut tells me that Opera is by far the l3ss3r 3vil.
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.
I don't even think the slocate database is readable to normal users. The locate executable runs as root.
Karma: Segmentation fault (tried to dereference a null post)
Google Desktop Search Functions As Spyware
Where does the spyware part come from??
Here's one definition I found for it:
"Software that tracks usage and reports it to others, such as advertisers. Usually the tracking is concealed from the user of the software."
It goes well with my personal thoughts about what spyware is.
Is it spyware because it doesn't obey user restrictions when scanning a hard drive?!
Would seem like a totally new definition of spyware in that case. *confused*
Beware: In C++, your friends can see your privates!
Example: Script Kiddies.
nuff said
[Fuck Beta]
o0t!
Hmm, I always knew google wasn't being completely honest with their 'software'. I have been using the google toolbar for awhile and using my packet sniffer I kept seeing packets being sent back about my activity although I chose the setup which would not send any data back to google. E-mail to google about this went unanswered.
I also notice that this sounds strangely famaliar to what Real Networks did (read http://grc.com/downloaders.htm) back around 2000 with their download program and Player.
Rent this movie: Outfoxed: Rupert Murdoch's War on Journalism
True story. MS does some bizzare virtualization of the cache directory. What explorer sees really isn't there. Go go command prompt, CD to the cache folder, and do dir /AH and dir /AS and compare to explorer.
I browse on +1 so AC's need not respond, I won't see it.
> In UNIX, I could use "locate" to find out whether a
> co-worker has cookies from porn sites
No, that's wrong. Locate searches a database of filenames not a files content.
k2r
First let me say this is a very powerful and convenient tool that works as advertised right out of the box. However, I am also upset by how easily this group defends Google and attacks Microsoft. I'm sorry, but if you are creating software you need to keep the users in mind and work with the environment you are given.
I have done a lot of research into how the Google Desktop system works. Here are some things I found...
1. The indexing "agent" (not a windows service) runs as the current user. So, Windows security should block Google from viewing those files.
2. Google installs its own web server on the machine and maps to port 4664. They also do a lot of validation to make sure you can only see this information from the local machine. This appears to be pretty strong.
3. Google stores its cache in the following windows directory: C:\Documents and Settings\username\Local Settings\Application Data\Google\Google Desktop Search -- Leading me to believe that this is user specific. I checked permissions on this other users do not have access to the cache, leading me to believe they would have their own version of the cache.
4. Google seems to abide by the rules of the operating system. Unless they are somehow bypassing Windows security (being google they could reverse engineer anything I guess), this is pretty sound. So it really comes down to the user for setting permissions on their files. Otherwise any old search program could also find those files.
5. Google Desktop search is not spyware. I think the fear is how it integrates your desktop with the Google home page but the truth is no information is sent. At least that's what Google says. However, I looked at the source of what is returned and this is not done using client-side script or an ActiveX object, so I'm not sure how they pull this off. This sort of scares me. For instance, the path to one of my files is seen coming from the their server.
Now, the bad side...
While I was impressed by the lockdown of interface to the local machine, this is easily compromised. In an hour or two I created a VBScript class that could host on the user's machine and use local HTTP to access this data. This means that spyware could be created that allow remote access to the otherwise ironclad cache. This is obviously bad since you could just start searching for passwords and possibly get them.
My suggestion to Google? Add additional settings. For instance, right now the default setting is EVERYWHERE, with some control over WHAT gets indexed. I suggest being able to point the index at specific folders, or be able to not index other folders. This is sort of like shipping a firewall with all ports open. Sure its up to the user to lock it down, but if you don't... bad things happen.
Also, more filetypes would be really good. Especially more code files, etc.
I also think the ability to share your cache could be an option. This would be handy to install on a corporate file server to provide access to files (this is the reason I created the remote access hack)
Of course this may be Google's strategy all along... make the free version do everything and be for personal systems, and then sell a version with more file types, more granular control, sharing etc. Sounds like good bait and switch to me.
So that is all. Very good software, very easy to use. Ships wide open and could breach privacy on beginner level users. Can be used for attack and Google needs to consider this. Overall.. thank you Google!
In this case, this tool lets you spy on other people using the same machine, rather then fuck up your computer and send data back to the master computer.
And anyway, this is nothing like the drill. It's more like a drill that explodes when you try to use it. Clearly, you should have realized that it would explode, right? Wrong. Even if it's 'obvious' that such a drill would explode at a certan RPM, the maker is still responsible to make sure that their products won't explode.
Anyway, this is software. Pretty much all software contains errors, they'll fix it. There's a huge diffrence between this (some software with privacy exploit) and what we normaly call "spyware".
bla bla, click here, etc
autopr0n is like, down and stuff.
Okay, time to debunk this article.
Boys and girls, open your command prompt and type:
(reformatted so that
You will notice that the GoogleIndexer is actually running as my username (non-priviledged). In fact, all of the google programs currently running on my computer are running as the person logged in. If you happen to be running as Administrator, then you will be able to see all of the files on the computer. It is impossible for the indexer to look at files that I can't access through a normal way (via explorer). Conclusion, this article was probably written by a MS PR Monkey trying to cast a little FUD towards one of their main competitors in the search market...Google.
Don't count your messages before they ACK.
Let's face it. Google has turned evil.
copernic is going to charge for their desktop search...does this mean they're toast? or are the products sufficiently differenciated to leave room for a free one and a for-fee one?
meanwhile, copernic http://copernic.com/ has a server version too.
Here's the whole (hole?) essay:
http://steve-parker.org/articles/others/stephenso
Some choice quotes:
It's very, very difficult to have both the presence of mind and the physical strength to hang onto a powerful drill that's just flung you off your ladder. Kudos to that guy-- I wasn't so lucky.
There never seemed to be a good happy medium between holding the drill tightly enough that when it hung up I had enough of a grip to let it grind through whatever was hanging it up and loosely enough that when it REALLY hung up I could abandon it without injury.
Apply appropriate Windows/UNIX metaphors.
No it isn't. Updatedb runs as root and it does nothing but caches the file tree. It doesn't go though the files. It doesn't cache file contents. Any file that 3rd party is not suppose to be read, cannot be read by a 3rd party. Period.
Updatedb/locate do nothing but make it faster to search though a file tree for a given filename.
I doubt that Google, or any other company dedicated to develop software, could do such a silly application. In any case, it would be Windows fault if their supposed protected files could be ready by a user (or application) not authorized. Also, as somebody already pointed, nobody is forcing you to donwload and install this tool, if you wanna use it then do so, it's free and it's easy.
Alexis Bellido
And that's what I like about NTFS and XP (if you turn off 'simple file sharing'; you can set permissions for local files and folders (which I'd missed ever since I started working with Linux).
:)
This allows me to hide stuff as my diary and other stuff from my brother, who's got an account on the box. At least he's old enough so I don't have to hide the pr0n
That's not to say the security system in XP is not severely flawed though...
I think he was a little confused... in Win32 cookies are stored in a folder named Cookies and all have filenames like 2342345j2h34i52uh34i25uh4@www.yoursite.com
Maybe he's using cygwin on Windows? Then locate would display that behavior.
this sig limit is too small to put anything good h
And removed it today.
I arrived home from work today, and fired up a simple search using my now-indexed Google Desktop. The first item listed, by dint of a coincidental search term, was an email my cleaning lady had sent.
The 'drill' in the email was NOT the one I was looking for.
I must say, I was quite surprised - the search cached viewed and sent emails from a private hotmail account - it even kept a view of the inbox.
This is, well, bullshit. Really - how many people NEVER have anyone else on their system. This search has wayyyyyyyyyyyy tooo much room for abuse - and once they fix it, I guarantee you this old version will be worth $$$ on the black market...
The last fucking thing you want is my undivided attention...
Or just try regedit... You'll find some odd keys in there on a search
Hopefully you at least read the article. Because your trolling is not helping.
So as to not be a troll, the point is that anyone with physical access to your machine can install something that takes advantage of caches, or creates it's own. This "news item" is blown out of proportion because the user went to a machine that had *already* had Google Desktop Search installed.
Any user that wanted to read all your yahoo email could just as easily have installed a key catcher, either hardware or software. Or all sorts of other types of spyware/snoopware.
The only real news here is that you shouldn't be doing anything you want kept private on a public machine. Is that news to anyone here?
In particular I'd like someone to prove the news summary posted here at slashdot, "it indexes your files across all users on your PC, bypassing user protections ". Go ahead and prove it. Come over to my house, install the software and then show me my Yahoo email. Good luck.
Joseph Elwell.
Yep, that is indeed a potential privacy issue with locate. Sure, you can't read the files using locate, but depending on your users, even just knowing about the existence of, say, a /home/raven/candid-pussy-shots/ directory might be enough to get 'raven' into trouble. (Even if the directory happens to contain, for instance, nothing worse than pics of raven's favorite feline.)
Consider switching to slocate instead - it's an improved (from the security/privacy standpoint) version of locate, which only lists files that the user actually has permissions to access.
That depends, to some extent, on your distribution. Red Hat distros, for instance, create home directories with all group/world access disabled by default. (This wasn't always the case for RH, but the switch was made at least as far back as RH9, probably earlier.)
Amen and hallelujah - knowing what you're doing is a solution that works across all distros!
A marriage is always made up of two people who are prepared to swear that only the other one snores.
locate .com | grep sex will do a remarkable job of finding such cookies.....
LedgerSMB: Open source Accounting/ERP
I'd like to think that the long range plan here is to make people aware of how useless Microsoft software is for people who are interested in protecting their data, thereby raising interest in real operating systems like Linux and OS X.
Too bad the versions for those platforms aren't available yet, because then the Google response could be the perfect "That's just because you're using a worthless OS. Try one of these..."
My
Boffoonery - downloadable Comedy Benefit for Bletchley Park
In UNIX, I could use "locate" to find out whether a co-worker has cookies from porn sites if the permissions are not set.
Isn't this why Linux has slocate (secure locate), as opposed to the original locate? And the locate/slocate database will only exist if someone with root privileges has created it. And, as someone else already pointed out, it only indexes filenames, not file contents.
Find free books.
Updatedb doesn't necessarily run as root. My machine defaulted with updatedb set to run as "nobody" out of the box. This automatically guarantees that it won't reveal any information that other people couldn't see anyway. My point was that a lot of systems allow rather liberal read access to users' account directories by default, and users should be aware of that.
But everything else, spot on.
go beagle go!
So what is that thing, 1/2 hp? Taking half a horse up a ladder sounds dangerous to me.
I guess that makes it spyware...
It does exactly what I expected it to do. No more, no less. The only 'issue' here is that folks don't understand how much information they have sitting around on their PC's
Your monitor is staring at you.
I installed the google desktop search.
I had to be an admin to do the install. That means I have to have rights to read all files on the machine to install it.
I switched to a non admin account, I was told only the original person who installed it could run it.
I switched to a different admin account, tried to run it, got the message that only the installer could. I attempted to install it again under this account, I got the message that it's not meant for multi-user systems, only one user can install it on a PC at a time.
So in summary, if you don't trust someone who's an admin on your system, don't use that system. The search only makes it easier for them to see your data - they already have rights to.
The program indexes content as you view it, and it's an option to index secure content. This has nothing to do with Windows being insecure, such as an insecure file system. The program running under the user's privileges should always be able to view their files, this is just common sense. And it has nothing to do with Google writing spyware, because this program operates as it was intended and it doesn't report this information back to a server. If you don't want it to index secure content, then turn the option off in the options.
: Vernalex.com malware guide
"The optimist proclaims that we live in the best of all possible worlds, and the pessimist fears this is true." --James
Are we talking about installing this Google Desktop Search software on Windows XP Home edition or Windows XP Pro? There is a huge difference between how these two operating systems handle user right assignments. Windows XP Home has a very stripped down version of the system whereby you can't easily change user permissions of individual folders. My guess is that most people will set up user accounts on the home version with "Administrator" rights as many programs simply don't work correctly in XP as a "User".
Because XP Pro is typically used in office environments, if you set up a user account and you log in, you will NOT be able to see the other users folders unless an Admin sets those permissions.
Of course, all this seems silly as linux has had proper file permission settings forever whereas Windows has just recently added that feature.
What if someone else can view that cache? Can they? I don't know. I certainly hope not. If they can, this is a serious flaw in the software, one that was certainly not made well known. FAQ my arse. What if Microsoft puts in an obscure webpage somewhere 'we don't guarantee this software is free of security holes'. Why aren't you rushing to their defense? Don't install it... they told you about it.
Quite honestly, if this makes it easier to view other people's documents, this is a flawed piece of software and you should be aware of this.
dominionrd.blogspot.com - Restaurants on
Oh no, it indexes all the files on the harddisk. It can do that regardless anyway, regardless of whose user it is. Thats spyware???
Spyware is where information is sent back to a server to spy on a user.. Last time I checked, this just uses a local daemon and doesn't send any info to google. Therefore, this isn't spyware.
I'd imagine though that files which are encrypted would be ignored completely though. If they were that worried about it, they would realise that it wouldn't make a difference whose user it is anyway, because they could just run the windows search function on it.
Sometimes I wonder how some of these articles make it on slashdot. Next they'll be telling us Linus isn't the author of Linux.. err wait a sec, that already happened too
This is no cause for concern and its actually an even more invalid concern then the gmail privacy worries
The coders of this program were quite retarded. On install it immediately tries to install to a preset path on C: with no option to change it. For me, this means it immediately bitches about less than 1GB free on C: and dies. I emailed google's support telling them that it's unlikely a small partition designed just to fit my OS will ever have 1GB or more free though it's welcome to use the hundreds of GB on the other partition in my system. They said they might allow you to specify where it installs to someday, maybe, possibly, if they feel like it.
Introducing the new Occam Fusion! Now with sqrt(-1) fewer blades!
But it's not an issue anyway. The spyware claim in this article is ridiculous. It's sensationalist journalism at its worst.
I'm not going to go into any greater detail, as many have put it more eloquently than I can, earlier in this discussion.
Clever signature text goes here.
You can get EVERYTHING that you have ever done?! How to stop it?! Oh. Go to preferences?
From the preferences page (there is a checkbox by each item)
Search Types
Index the following items so that you can search for them:
Outlook email
Outlook Express email
AOL IM Word
Excel
PowerPoint
Text and other
Web history
Include secure pages (HTTPS) in web history
I was getting to write a screed on how the headline to this topic is verging on libel, with reckless disregard for the truth. But then I realized there are spyware-like aspects to the software. Imagine a husband and wife sharing the same machine. The tech-savvy husband suspects his wife is cheating on him with his neighbor Rick. So he installs Google Search on the machine. Whenever the wife logs on, her email is indexed, and then, yes, the husband is thus able to spy on her by looking up any instances of the name "Rick."
Of course, any reasonably expert computer user is going to be able to view the wife's info anyway. But since this software seems to greatly facilitate the process, and reportedly does so in a way which is not necessarily transparent to all the users, I think that calling it potential spyware really is not that much of a stretch.
A possible solution might be to force each user to enter her password into the software before it starts to index any of their files. And then to offer her a choice -- to make her information globally accessible, or to encrypt her index so it is only accessible to the individual user.
I haven't downloaded or used this program yet, so if I've somehow misunderstood and it already does something like this, then I apologize in advance.
There are two kinds of people: 1) those who start arrays with one and 1) those who start them with zero.
if its for single user machines, why does it purposly bypass security and scan for other users?
anyway, it probably only runs on IE anyway (i didn't rtfa), so one more piece of spyware isn't going to hurt now is it?
i setup windows XP for my dad last week on his new computer. I said to my sister "im going now, download mozilla firefox, and install it right now, before you go on the internet, and dont use internet explorer for anything other than firefox"
I left, went camping for the weekend, came back. the computer was so slow (AthlonXP 2800, 512mb ram), as was the 150k internet connection, that adaware couldn't help, and i couldn't even get to the spybot homepage. i reinstalled and made sure firefox was installed and default myself before i left.
the moral of the story is:
a) dont trust a woman to do anything with a computer that isn't playing the sims
b) install firefox and set it as default before you leave
c) dont build computers for other people (especially family), as they expect technical support
The point is that it will still find the files if the permissions were not appropriately set and the database exists. Yes the database must be created as root.
However....
If the files are not protected, a search will still find the files.
LedgerSMB: Open source Accounting/ERP
at work when I installed this, my firewall came up and asked me if I wanted to allow google desktop search to access the internet. Why the heck does it need to access the internet to allow me to search my own files?
Have slashdot's editors been replaced with National Inquirer "reporters"? If so, WHY WAS I NOT INFORMED!?
Or any machine to which you have administrator access, no shock there, you can do that without google's desktop search.
If it were spyware wouln't that mean data was sent to google without your permission, which is very much so not the case, though you do have the option of sending data on crashes, which probably contains how many files indexed etc.
Admitidly I'm not convinced enough to install it, it's tempting, but it really doesn't seem that much better than just waiting for search results, mabie if it included whistle a tune and find it in your mp3 collection, or draw a sketch and find it in your pictures, things you just can't do today.
Yes, my only tool is a hammer. And you're starting to look like a nail.
It isn't accessing the Internet - it uses a local loopback connection to talk to its server, but your firewall doesn't distinguish that.
Google Desktop can send debug info to Google, but the claim is that it sends no information about what you searched for or your local file contents to Google. You can opt out of the debug and statistical info collection.
It is impossible for the indexer to look at files that I can't access through a normal way (via explorer).
Your message is insufficient to prove that.
If Google Desktop was installed by an administrator, then it could've possibly installed a system-level DLL which that program can be using to look into forbidden files, without opening them directly itself.
Any program which had admin privs at installation could've kept them, meaning it can potentially violate file-access controls whenever the program is later run by a normal user. That's why I don't approve of videogame installers that require admin rights.
I haven't installed Google Desktop though, so I don't know if it requires administrator install- but I think most people install that way anyhow.
Firefox: Tools > Options > Privacy, find "Clear All Information Stored While Browsing", click "Clear All"
Or chose appropriate buttons on the same "Privacy" screen to delete only some things.
This post written under Gentoo-linux with an SCO IP license.
What it probably should do, and what it probably will do a year from now is to let each user select the set of users that get google search access to their index. It is actually useful to have it span multiple users on the system, if you sometimes log in as a different user (say I log in as my wife), and have a problem remember which user you saved a particular file as. On your typical home machine, I would hazard that you want Google Desktop to behave just the way it does in the beta.
I'm just curious but... isn't it a flaw of the operating system that files generated by a user aren't automatically restricted to access by that user? This isn't google's fault, the same exact design ported to linux would work flawlessly.
No it wouldn't. The default permissions (umasks) in almost every Linux distribution allow 'others' read access on new files.
Whether this is a good thing is left up to the reader.
How is this like the hole hawg? As long as I am aware of the potential consequences of using the hole hawg I can avoid them. If used correctly it can make just about any kind of hole I want. I can't control the google desktop, it simply allows users to jump the security rules that the OS and most software obey.
This inability to control this problem is why, my dear Ms. Mayer, this is a bug and not a feature.
ôó
Hmm, is it just me or does that statement sound like a paradox if you happen to be the user?
I would suspect that if users are not set up as administrators google desktop will not be able to index other user's files.
First of all we "pray" google introduces an easier and more thorough way to search our unwashed mass of files on our fixed-disks to find things faster and better.
Google introduces one such program and we praise it like sliced bread.
Then suddenly we complain it is spyware, searches unpermitted files, blah, blah...
Is it a case of blaming electricity because it can kill? or is it a case of lasers because they can be used to blind you...
I say when do we grow up and start treating tools and devices for what we want them to do instead of worrying about how to abuse them...
Iam heartily sick of such no-gooders and nay-sayers who call themselves critics but who in reality are Pussies...If such people had their way in earlier times we would still be riding Horse buggies because the Ford T would have been long banned for not having seatbelts, automatic transmission, pollution control, airbags.... etc.
"Doing what i can, with what i have." ~ Burt Gummer
So google releases an intrusive program with massive security risks and the ./ fanboys are falling all over themselves to explain why it isn't google's fault. YES, IT IS. It's bad software, you install it, you're a moron. I don't want google on my desktop and I don't want them in my browser and I don't trust them. Stop making excuses for them. They're out to make money like anybody else and they don't care how.
Geez...
Did anyone expect the program to NOT index everything? I installed this on my machine, and I run 2 accounts: admin and power user on Win2k.
You need admin privs to install the thing in the first place, which gives it full access to ALL files.
If a normal user could install this and see everything, I'd be more worried. But I can fully understand why the app does this.
Also, you need admin rights to run it as well. This is what i've found so far.
The only people who should be worried are those who suspect their sys admins... But then again, I'm quite sure those people have been suspecting their sys admins since before this app was released.
Finally, the only time it will pull e-mail up for searching is when a user has Outlook running. I haven't tested this feature yet, but that is what it says it does.
Insert Sig Here
Why would the permissions not be set properly? By default, most distros create secure user accounts, with /home/user owned by user:user and set to drwx------ permission. If I tried to list Bob's files, like so:
/home/bob
/home/bob Permission denied
$ ls
The result would be a swift:
ls:
Of course, it goes without saying that root can read anyone's files..
These guys, http://myradus.com/, will probably be annoyed about this.
If the Google Desktop source code were open, we could check to see what else it does that we don't expect, and wouldn't like. Like maybe sending hashes of your URL surfing history to the Google server.
--
make install -not war
How can all of you nit-wits be so short-sighted? How can you not care if this indexes the internet cache? This basically means you can never check your webmail on a friends computer again without them being able to easily read your emails. That's really lame. I hate Google now.
I don't see what the fuss is about. You set it to index what you want and don't set what you don't want. I don't see how it can be set up across networks, even a home network, yet.. and there are many other more advanced programs that allow companies to 'spy' on employees internet usage so even IF they installed it secretly on each machine , it isn't networked so each machine would have to be scanned for usage tracking .. what's the point when there are networked programs that give screen shots of exactly what each employee is looking at every minute of every day ?
For home use , use passwords and the profile settings for each user and there is no cross indexing of it around that feature on XP anyway.
What I REALLY would like to know is after you search and find info that you didn't know was still there I was SHOCKED to see how much I thought was untracable that is still on my system, how to delete it leaving no trace , directly from the search page , i see no option for that and THAT would be a very cool feature. Anyone find a delete option on it ?
I suppose after locating emails, logs, websites etc , I can manually go to the location and delete it , but in doing that does it leave a trace of the deletion that is then indexed ?
That is my main concern. I am new at geekdom , not too nerdish , working on it, Friday night at 12:23 and i'm sitting here reading this site, so that's a good start I'd say :)
I am wondering how, short of wiping out my whole hard drive and starting over to get RID of the stuff I found is still there after installing the google indexing program today. I'm stunned and want to get rid of alot of it , there has to be an easier way, you'd think right ? If it is all right there on a quick search , why not an option to shred it ?
If there is and I missed it, someone please clue me in . thanks ! AND if anyone knows how to stop windows messenger from logging in at random without being asked or even showing the icon or contact list anywhere , PLEASE let me know, I have been puzzled by this phenomenon for months now, I know it's an issue and should install the XP upgrade which i beleive fixes that however, i am burnt so not into figuring out other issues at the moment. I am not referring to MSN messenger, it's the windows messenger that simply logs me on randomly and I don't even know i'm logged in , just suddenly a 'buddy' starts saying hey and THAT is more of a privacy issue at times than googling your computer and maybe your spouse will find the name of someone who you don't even know who IM'd you b/c the damn thing logged you on for no apparent reason ;) hey it happens.. Anyway, apparently there is no way to stop it , i've tried most everything.. annoying.. i'm new and it's late forgive my babbling.. i just don't see what the fuss is about , there are SO many privacy issues, this is just a non issue compared to most. I just want to know how to stop Windows messenger and how to use the google indexing to find and destroy all the old files i am finding and want to get rid of , is that too much to ask ??
TY!!!
Iam dissapointd that even slashdot allows the word 'spyware' to be used in title.
In a wide user base like calling someone 'spyware' without verification is blasphemy.
Why does yahoo do this
You mean to tell me that a program running as an unpriviledged user can access priviledged files? That hasn't been my experience with WinXP. The indexer runs in the background as the user that installed the program. Anyway, this is all moot. It was designed for single user systems (ie, 99% of the installed home user base).
Don't count your messages before they ACK.
installed a system-level DLL which that program can be using to look into forbidden files
Oh, I see what you mean. My mistake. That may be the case. I guess I could try by creating a severely limited account and seeing if it will install.
Don't count your messages before they ACK.
It should come with a tinfoil hat.
While I was impressed by the lockdown of interface to the local machine, this is easily compromised. In an hour or two I created a VBScript class that could host on the user's machine and use local HTTP to access this data. This means that spyware could be created that allow remote access to the otherwise ironclad cache. This is obviously bad since you could just start searching for passwords and possibly get them.
Well, the thing is, if spyware is installed, it already has access to all the user's files, so it has no need of the google cache to locate the ones it wants. How exactly could they prevent access for a local program? I can't see a suggestion in your post. I suppose they could encrypt it but this would hit performance in a serious way.
All your other points are interesting, and it's nice to see someone looking at this critically - in particular it'd be nice if they added the ability for the user to add other file types (many of which are just text anyway), but I'm sure that will come in time. The security problems you mention are mostly a result of windows security policy though aren't they?
I suspect, is that you need to install using administrative privileges and try to a do a search using a severely limited account to see if the search will let you see stuff which you're not supposed to.
The theory, I believe, is that when you install as admin., it installs a "search server" and any unprivileged users which install afterwards just get a "search client" which connects to this server (via TCP over localhost or whatever). If the server returns results which allow the client to see stuff it's not supposed to, then there is information leakage (and quite a grave one at that). If not, then it's a load of hot air.
HAND.
I for one have been waiting for a long time for google to index my desktop. This is a feature that will give google a clear advantage over Yahoo and any other search engine. If you are afraid of your files being compromized, then this product is definitly not for you or your files are stored in the wrong locations. Congratulations google.
The first rule of system security is that the only security is PHYSICAL security.
;-). You need to make that decision yourself but I do admit that most kids can find out what they need to know to penetrate any parents computers VERY easily. I do cruise the script-kiddie boards (often) to see what they are up to and the tools are all there within easy reach (Google search ;-) ).
What are the flaws here? It's a publicly accessible machine. Anyone can walk up and since it is publicly accessible, can merrily publicly access away. The presence or absence of the Google search tool in and of itself means nothing. In addition, with the tools that I have here, even if you DID have individual accounts I can own that machine, one way or another, in under a minute. It would slow me down some if someone with real Windows knowledge set up the system secuirty, but that is all that would happen, it would slow me down. After all, I do this for a living (systems security consultant). Don't be overjoyed Linux users, if I know your version, I can get you too. I track the vulnerability lists on a daily basis and no one save the truly paranoid (moi, of course) patches THAT quick!
Now, in the context of a personal PC, whose ox is getting gored here? No one. By definition. Note, I said personal PC. My personal PC, fully locked down Win'Server 2003 Ent., or as fully locked down as you can get with Windows (snort), happens to have this beast installed and yes I did pause to read the documentation, EULA, and all the warnings that they posted. This is just another search tool that just happens to use a web server front end so you can search using a browser interface that looks just like Google. Powerful (not Windows Find in my book) search tools have existed for eons in the computing world. This is yet another one and pretty spiffy actually. I was pretty impressed that it found in under a second something that I had been searching for for days, yes even with some pretty powerful search tools. Nice job!
Now, is my system less secure? No, if someone walked up, or happened to break into my system from the outside (about as likely as hell freezing over), then yes, having this available to them is a bit more of a problem but if they get in the door, then they already know where to drill down for personal information. Anything I'm really interested in protecting (under NDA, etc.) is already living on an encrypted HD with a VERY long key. Again, I'm paranoid. For the average user, again, once in somehow the presence of this tool changes nothing.
What is interesting is the potential for abuse in the case of a family or office setting. Be assured that half the problem in knowing where to go in those settings is identifying the interesting places and then you can identify the system security penetration required. This is NOT recommended for use in an office setting, but Google points out that it was not intended for such use anyway and spells it out most eloquently in the EULA as well. You do read the EULA, don't you? I do.
For the home, how much do you want to hide from your parents, spouse, or kids? Having no spouse of kids, I can't say. As for my parents, I'm the one locking down their systems
So that's my two cents. Mere FUD. BTW, what idjit uses a public computer and expects no one to know what they are doing? Apparently a LOT of idjits accordinig to a fellow SysOp elsewhere that happens to have a day job at a large library. If the cops want to catch a lot of kiddie porn and kiddie stalkers, I can tell them right where to go, but they aren't listening (sigh).
NetBlackOps
-"Never give entropy an entrance!"
OK, so this guy who wrote the article is a moron. I installed this on my Win2000 machine using my main account which is an Administrator account (but not 'administrator') and had it index my machine. I then switched to the 'administrator' username just to see what would happen, and it says that it was installed by somebody else (a different account) and couldn't run. Therefore, there is no security breach that I can see, and I was using two different administrator accounts.
The FAQ mentions multiple users who use the same login and password. Well, of course, duh. If several people use the same account, of course they can see the same files. It's the same damn account.
And one more thing, it isn't spyware as spyware returns information about you to someone else, like a company. At most, it could be classified as a 'priviledge elevation' of sorts, since purportedly you can see other people's files, although I can't reproduce this on my machine.
So let's posit the worst case scenario should Google turn out to have been really very evil all along. The biggest potential for evil as I see it is the possibility for google to sell private, undisclosed web services interfaces to layers of data that we just don't have access to. Perhaps as a private high net worth client I could google for individual people, their news reading habits (i.e. the articles they follow from news.google.com), their gmail, their desktop files, their friends (i.e. people they invited to gmail, people in their address books), their buying tastes (the ads they click on or products they search on), web surfing habits (google ads again) and their reading tastes (print.google.com). Google could cross reference this data against traditional google searches and google searches on 'hidden' pages - i.e. pages that have been indexed by machines that do not ever declare themselves as being google, but masquerade as other indexing agents, and which run through and index everything in spite of no-robots files and instructions.
Such a webservice would make a fantastic tool for a more precise purge of social undesirables. What state security apparatus, especially one fighting a war of^Hn terror, would want to be without one. Stalin's almost random enslaving and death of 30 million odd people would have been much more focussed by such a tool. No need for messy torture to find out who your friends are - until of course you have all of them in custody too and still have a quota to fill. You can just see the ads - "A revolution in state oppression!".
Google have in theory at least, a terrible potential for abuse. Given how terrible it is, I think Google would be well advised to prove beyond all reasonable doubt that they really truly do not link everything up like that under the hood, that they recognise the inherent lurking evil that would just love to get its hands on Google itself, hire a team of ethicists to help them actually define what evil is and isn't, and take a public ethical stand on issues - after all one of the greatest ways to allow evil to flourish is to remain silent.
I used to have a better sig than this, but I got tired of it
It's always been my impression that "spyware" was software that was installed on your (typically Windows-based) PC, usually without your knowledge or consent, which then communicated some otherwise private information back to a vendor (be it a spammer, a software company, or what have you) for use in marketing or advertising, or maybe just because the vendor is abnormally nosy. This article doesn't say that GDS does anything of the kind.
Yeah, sure, someone could walk up to my laptop when I'm grabbing a soda down the hall, and do a quick search, but so what? They could do the same thing by clicking 'Search' on the Start menu. My fault for not locking my screen.
-- -R
n/t
OK, bashing where it is due, NT-based OSes at once introduced the concept of local admin to a community that was not ready for it. They provided the vehicle for segmenting privilege while implying to joe user that he should usurp it all if he is to be able to get his work done. It got the whole world of n00bs thinking they had to be root and not just via context-switching to get particular tasks done. It has fed the average windows user's megalomania into believing himself to be a computing genius.
In Redmond's defense, they developed these features in an earnest attempt to enable best practices functionalities in the product line. The problem was that even though the features had been enabled in an somewhat OK manner, nobody who would be caught dead in a Win32 environment knew the first thing about how to implement those best practices given the tools. MS knew it too, but they still had to sell this "Windoze is EZ to use, even at the server, so you can pay less for adminz and more for s0ftwarez" line a little longer if they were to penetrate the server market enough to ensure they didn't have to compete seriously with Novell and/or IBM again for another 15 years or so. To be fair, from a purely market driven view, they have played it well. Their products were insecure to some degree, the implementations were disastrously so, but the market bears it without so much as a whimper and comes back for more.
Redmond's dilemma now is they are trying to make themselves over as the Trustworthy One, because they are no longer selling themselves to businesses, they are selling themselves to entire industries. And particularly industries that NEED the kind of security they wish they could be seen as providing. So they are pumping out obscene amounts of $$$ to try to make the systems truly enterprise-grade securable, while dragging (kicking and screaming I might add) that admin community that got hired cheap and promised easy advancement. The admins still make shit wages, even though some have adequately educated themselves with real security education, not MS certification crap. And then there are the users they support and their PHBs who understand PC security about as well. And the PHB says "just make 'em local admins on the box - that'll solve everything". If you mean dis-solve, maybe.
Can I bum a sig? I left mine at the office.
their ultimate goal is to complete the inevitable commoditization of the windows platform. then it is only a short step to porting that system (web and desktop integrated) to other platforms that are open and freely available like gnome, to replace windows.
"You never want a serious crisis to go to waste." - Rahm Emanuel
clicking "about" and then "contact us" gets you there. Interesting to note that they already have voting options for the obvious missing features under "suggestions" (e.g. firefox support, more filetypes, etc.):
I don't know how this got posted. Are the slashdot editors trying to get net geek street cred by bashing a google tool that does what it is supposed to?
Jesus guys.
I only post twice a year, who needs a sig?
well, luckily not on systems with proper access-rights.
/konqueror seems to save its browser-cache as files labelled by sitename.
But you are right in a way:
KDE
KDE + sloppy access rights + locate
= global browser history for anyone
k2r
And it's not simply that GDS might allow access by others of files they shouldn't access. It's also that it causes files and other transactions to hang around longer than people think, due to the cache. For example, if you believe you've deleted a sensitive file or e-mail message, and even wiped it with one of several programs that can do this, you're wrong. The GDS cache still has the data. At the very least, this creates yet another place that data you thought was gone is still around (think personal info, future legal discovery processes, etc.).
Mike Langberg of the San Jose Mercury News provided an additional view (reg req'd) yesterday. Sample quote:
RTFA - it is Google's search index that is accessible, it has nothing to do with permissions on user's files per-se.
As not all Windows have the ability to set per-user permissions, they should have password-protect their software so that the search index file is accessible/usable only when the user is logged in to Google desktop search engine.
I'd only consider this "spyware" if it sent confidential information back to Google without telling me. There's no indication that it does that.
As for security against other local users, I agree with the vast majority of posters that this is a non-issue.
Read my keyboard review.
Anyone else see how terribly ironic this post is? "I doubt that Google, or any other company dedicated to develop software, could do such a silly application." Ummm, Microsoft does a thousand silly things a day as far as releasing software with massive security loopholes, why should Google be any different? I see your point, I do tend to hold Google in much higher regard than MS, but it's your wording that I found so hilarious. Now, with all that said, your defense is, "don't download it if you don't like what it does", it seems like it's more than that. Scenario, a student in a school has an account on a machine that multiple people use. They could load this software and then gain access to personal information from all users on this machine. This goes from a personal security issue for the person installing it on their machine to a personal security issue for all of those who use the machine. It's the equivalant of putting a keystroke recorder or a packet sniffer on a network to gather information. It is a software developer's responsibility to not release software that can be used maliciously, and this one sounds like it can.
dioscaido seems to have a misconception of the word spyware, or a vengeance against google, not sure which.
This is not transmitting any information to a 3rd party, or for that matter to any party. the information is gathered on your computer and so far cannot be remotely accessed (though I am curious as too how long it will take somebody to exploit this index).
This software does not maliscously install. you have to choose to put it on your computer.
This in no way resembles spyware, and calling it such is a prime example of why people dont take us seriously everytime we cry wolf.
If you want to worry about a problem with this indexing service worry about what can be done with it if accessed remotely.
New and improved Guilt. Now its alcohol soluble!